No. Time Source Destination Protocol Info 118 8.528278 x.x.x.x 89.223.234.248 FTP [TCP Retransmission] Response: 150 Here comes the directory listing. Frame 118 (95 bytes on wire, 95 bytes captured) Arrival Time: May 30, 2010 12:31:22.143740000 [Time delta from previous captured frame: 0.429941000 seconds] [Time delta from previous displayed frame: 0.429941000 seconds] [Time since reference or first frame: 8.528278000 seconds] Frame Number: 118 Frame Length: 95 bytes Capture Length: 95 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x05ef (1519) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xf89f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: ftp (21), Dst Port: 52896 (52896), Seq: 438, Ack: 114, Len: 39 Source port: ftp (21) Destination port: 52896 (52896) [Stream index: 2] Sequence number: 438 (relative sequence number) [Next sequence number: 477 (relative sequence number)] Acknowledgement number: 114 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 5824 (scaled) Checksum: 0x9038 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60587000, TSecr 987608186 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 113] [The RTT to ACK the segment was: 0.438091000 seconds] [Number of bytes in flight: 39] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.438136000 seconds] [RTO based on delta from frame: 112] File Transfer Protocol (FTP) 150 Here comes the directory listing.\r\n Response code: File status okay; about to open data connection (150) Response arg: Here comes the directory listing. No. Time Source Destination Protocol Info 119 8.528309 89.223.234.248 x.x.x.x TCP [TCP Dup ACK 113#1] 52896 > ftp [ACK] Seq=114 Ack=477 Win=230000 Len=0 TSV=987608194 TSER=60587000 Frame 119 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:31:22.143771000 [Time delta from previous captured frame: 0.000031000 seconds] [Time delta from previous displayed frame: 0.000031000 seconds] [Time since reference or first frame: 8.528309000 seconds] Frame Number: 119 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: Bad TCP] [Coloring Rule String: tcp.analysis.flags] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4553 (17747) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb262 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52896 (52896), Dst Port: ftp (21), Seq: 114, Ack: 477, Len: 0 Source port: 52896 (52896) Destination port: ftp (21) [Stream index: 2] Sequence number: 114 (relative sequence number) Acknowledgement number: 477 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3563 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608194, TSecr 60587000 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 118] [The RTT to ACK the segment was: 0.000031000 seconds] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 113] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3230 70.028457 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3230 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:23.643919000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 70.028457000 seconds] Frame Number: 3230 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x930d (37645) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5f50 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2303713, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2303713 (relative sequence number) [Next sequence number: 2305081 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4b77 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608809, TSecr 60593149 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: ~VM|d`\326\003E\a\340<\331rB5\315nY\326;\224\3236\fP\211/n\352\024pUZ?\373\377\262\224t(JX)\336\360\275d\365\247vf\305\021\217\205\310l\277\026\333\365V\350<\371-\032\304d\362}f\354K\030 \226\374\002\213JR\227n\037\24 No. Time Source Destination Protocol Info 3256 70.568581 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2313289 Win=87552 Len=0 TSV=60593203 TSER=987608810 Frame 3256 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.184043000 [Time delta from previous captured frame: 0.060135000 seconds] [Time delta from previous displayed frame: 0.060135000 seconds] [Time since reference or first frame: 70.568581000 seconds] Frame Number: 3256 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a6c (19052) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb449 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2313289, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2313289 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xba69 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593203, TSecr 987608810 No. Time Source Destination Protocol Info 3257 70.568627 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3257 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.184089000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 70.568627000 seconds] Frame Number: 3257 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xab43 (43843) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x471a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2328337, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2328337 (relative sequence number) [Next sequence number: 2329705 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6ef7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608814, TSecr 60593203 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3256] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: "\212\367LVH\202UM\237\372\362\\370\270~Io\224\307\231\326\262\311\344]\3027~\351\366\324\220\000\000\000A!\001/\214d\027\030\035\223x\256 Z\367\373\233{\377B8\221\377\207d\223$\223\3113\371\262\251\215\246<\272\352\2 No. Time Source Destination Protocol Info 3258 70.568636 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3258 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.184098000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 70.568636000 seconds] Frame Number: 3258 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9255 (37461) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6008 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2329705, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2329705 (relative sequence number) [Next sequence number: 2331073 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x25cd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608814, TSecr 60593203 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \317\226\256\343\325pM\265X\207<\244I\302s^\3629\342\\221\v\204\033 \276\356Z~[\337\254\255\264z\351\247\342%\356\351\346\275\351P\273\276\357\207 \000\000\000P\001\000p\252AX.0k8\205\350R\032\275\353\353\250I\256\322 No. Time Source Destination Protocol Info 3259 70.568647 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3259 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.184109000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 70.568647000 seconds] Frame Number: 3259 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8d48 (36168) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6515 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2331073, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2331073 (relative sequence number) [Next sequence number: 2332441 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8050 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608814, TSecr 60593203 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \250H'h\323\376\237\020\367\377\362\021\326\025\335\3049\274G\257\v\377?\301\261\250\241\000\r\005i\217\360\a\272\203'\344\252\250\346[/\356\373~h\177\377\005\207\223\023\2070\000\005\300\210:\332\304\375g>\351;\275\0 No. Time Source Destination Protocol Info 3262 70.638446 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2316025 Win=87552 Len=0 TSV=60593209 TSER=987608811 Frame 3262 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.253908000 [Time delta from previous captured frame: 0.037154000 seconds] [Time delta from previous displayed frame: 0.037154000 seconds] [Time since reference or first frame: 70.638446000 seconds] Frame Number: 3262 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a6d (19053) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb448 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2316025, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2316025 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xafb2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593209, TSecr 987608811 No. Time Source Destination Protocol Info 3263 70.638492 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3263 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.253954000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 70.638492000 seconds] Frame Number: 3263 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0334 (820) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xef29 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2332441, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2332441 (relative sequence number) [Next sequence number: 2333809 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe6d8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608815, TSecr 60593209 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3262] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \277\372\337u\206\251\232\326T+\253_\364\266\224\337V31m^\210\330\224\246\217\346\374i\351\207\242V\371|leu\032\304>\2462j\235\324\363~\254\024\246\235\035\212\246\373\357\273\177\323M&[[\364\327~\237X'\321?\265\243\2 No. Time Source Destination Protocol Info 3264 70.638500 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3264 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.253962000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 70.638500000 seconds] Frame Number: 3264 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8d0a (36106) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6553 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2333809, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2333809 (relative sequence number) [Next sequence number: 2335177 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe07c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608815, TSecr 60593209 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \205\025\337\376\017t\236\237\277Q\017\2537\360\263\200\201\365t\367\267\246\356\372\247\0040:6\363\366\317\365\273\344\357\223\275"\366\361=\257\300\000\000\006D%\000\341\270 !q\237\377\370"\212\a\307|\375\257w\205\0 No. Time Source Destination Protocol Info 3265 70.730720 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2318761 Win=87552 Len=0 TSV=60593215 TSER=987608811 Frame 3265 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.346182000 [Time delta from previous captured frame: 0.092220000 seconds] [Time delta from previous displayed frame: 0.092220000 seconds] [Time since reference or first frame: 70.730720000 seconds] Frame Number: 3265 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a6e (19054) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb447 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2318761, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2318761 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa4fc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593215, TSecr 987608811 No. Time Source Destination Protocol Info 3266 70.730765 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3266 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.346227000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 70.730765000 seconds] Frame Number: 3266 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe123 (57635) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x113a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2335177, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2335177 (relative sequence number) [Next sequence number: 2336545 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x70b0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608816, TSecr 60593215 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3265] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: ~\336\243\0251\342h\261\335G<\271\271s \212\2177\333\231\323\374\317\257w\277\177}*\257S5\350}.p\331\245x\322\273\376\362\365?\326y\317\321\373\260\263\226\353\205\234g\a\377\225qb\365\325k\233<\246\352\002\316\000}Ub No. Time Source Destination Protocol Info 3267 70.730772 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3267 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.346234000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 70.730772000 seconds] Frame Number: 3267 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8679 (34425) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6be4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2336545, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2336545 (relative sequence number) [Next sequence number: 2337913 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdd09 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608816, TSecr 60593215 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \317\267\377\351O\247\256\t\271\177\250\354%*\263\377_\347\321R"u\340\202\376\251\202k\2422a\016\327Z\352\365Y\271~_L\347\376V\026\327\353\331\325\003\223!\245\r\204\370\236EYy\237dq\370G\347\376G\021\356\376\375\267p No. Time Source Destination Protocol Info 3268 70.748544 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2321497 Win=87552 Len=0 TSV=60593221 TSER=987608812 Frame 3268 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.364006000 [Time delta from previous captured frame: 0.017772000 seconds] [Time delta from previous displayed frame: 0.017772000 seconds] [Time since reference or first frame: 70.748544000 seconds] Frame Number: 3268 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a6f (19055) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb446 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2321497, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2321497 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9a45 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593221, TSecr 987608812 No. Time Source Destination Protocol Info 3269 70.748595 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3269 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.364057000 [Time delta from previous captured frame: 0.000051000 seconds] [Time delta from previous displayed frame: 0.000051000 seconds] [Time since reference or first frame: 70.748595000 seconds] Frame Number: 3269 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc06a (49258) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x31f3 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2337913, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2337913 (relative sequence number) [Next sequence number: 2339281 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1482 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608816, TSecr 60593221 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3268] [The RTT to ACK the segment was: 0.000051000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: Z\360\263\203\253\373\255\177|\332\327\342\333\003\235~\023{W\351\255\260r\030W4\357R\345\227\366\373\n+~7\v-\252`\340\000\222\366\a%\267d=\370\256\362\242a\023"?P\367\355F\027)c=\334\365\311W\345\326\351\314P\322\360 No. Time Source Destination Protocol Info 3270 70.748605 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3270 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.364067000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 70.748605000 seconds] Frame Number: 3270 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5b61 (23393) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x96fc [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2339281, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2339281 (relative sequence number) [Next sequence number: 2340649 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa794 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608816, TSecr 60593221 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: 52904 [ACK] Seq=1 Ack=2324233 Win=87552 Len=0 TSV=60593227 TSER=987608812 Frame 3271 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.425091000 [Time delta from previous captured frame: 0.061024000 seconds] [Time delta from previous displayed frame: 0.061024000 seconds] [Time since reference or first frame: 70.809629000 seconds] Frame Number: 3271 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a70 (19056) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb445 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2324233, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2324233 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8f8f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593227, TSecr 987608812 No. Time Source Destination Protocol Info 3272 70.809673 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3272 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.425135000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 70.809673000 seconds] Frame Number: 3272 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6548 (25928) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8d15 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2340649, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2340649 (relative sequence number) [Next sequence number: 2342017 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1f76 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608817, TSecr 60593227 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3271] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \026\037\245\353\374D\317~\346\375\034\a:'\245zc\341\276_/\210X\231\235\345\212\205\327\311\224\324\272 \017\374)\353\+\202|mw\377\337\246U\322\277\234\022\t=\337\202\271\365,\271\004z\357\324y[\305@\017\276\274E\322M No. Time Source Destination Protocol Info 3273 70.809681 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3273 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.425143000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 70.809681000 seconds] Frame Number: 3273 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2404 (9220) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xce59 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2342017, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2342017 (relative sequence number) [Next sequence number: 2343385 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x14df [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608817, TSecr 60593227 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \t\005\306\033?\377\377\377\375\234\233\273\037\202??\271\350\177\237\035\367ww\362\335\334\377\377\376\v={\360[\377K\375\325\336\271\240\213\311\334\367\bb\346\246\022\332\253\356\262\t\313\332\235\203.n&!\243UZ\314) No. Time Source Destination Protocol Info 3274 70.888808 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2325601 Win=87552 Len=0 TSV=60593236 TSER=987608813 Frame 3274 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.504270000 [Time delta from previous captured frame: 0.079127000 seconds] [Time delta from previous displayed frame: 0.079127000 seconds] [Time since reference or first frame: 70.888808000 seconds] Frame Number: 3274 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a71 (19057) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb444 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2325601, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2325601 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8a2d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593236, TSecr 987608813 No. Time Source Destination Protocol Info 3275 70.888845 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3275 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.504307000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 70.888845000 seconds] Frame Number: 3275 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x762e (30254) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7c2f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2343385, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2343385 (relative sequence number) [Next sequence number: 2344753 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd462 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608817, TSecr 60593236 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3274] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3276 71.038500 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2328337 Win=87552 Len=0 TSV=60593250 TSER=987608814 Frame 3276 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.653962000 [Time delta from previous captured frame: 0.149655000 seconds] [Time delta from previous displayed frame: 0.149655000 seconds] [Time since reference or first frame: 71.038500000 seconds] Frame Number: 3276 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a72 (19058) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb443 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2328337, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2328337 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7f6e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593250, TSecr 987608814 No. Time Source Destination Protocol Info 3277 71.038565 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3277 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.654027000 [Time delta from previous captured frame: 0.000065000 seconds] [Time delta from previous displayed frame: 0.000065000 seconds] [Time since reference or first frame: 71.038565000 seconds] Frame Number: 3277 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0d14 (3348) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe549 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2344753, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2344753 (relative sequence number) [Next sequence number: 2346121 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcefa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608819, TSecr 60593250 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3276] [The RTT to ACK the segment was: 0.000065000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3278 71.038575 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3278 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.654037000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 71.038575000 seconds] Frame Number: 3278 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4917 (18711) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa946 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2346121, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2346121 (relative sequence number) [Next sequence number: 2347489 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7899 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608819, TSecr 60593250 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3279 71.039410 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2331073 Win=87552 Len=0 TSV=60593251 TSER=987608814 Frame 3279 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:24.654872000 [Time delta from previous captured frame: 0.000835000 seconds] [Time delta from previous displayed frame: 0.000835000 seconds] [Time since reference or first frame: 71.039410000 seconds] Frame Number: 3279 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4a73 (19059) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb442 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2331073, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2331073 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x74bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593251, TSecr 987608814 No. Time Source Destination Protocol Info 3280 71.039434 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3280 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.654896000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 71.039434000 seconds] Frame Number: 3280 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9a61 (39521) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x57fc [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2347489, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2347489 (relative sequence number) [Next sequence number: 2348857 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6500 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608819, TSecr 60593251 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3279] [The RTT to ACK the segment was: 0.000024000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \211+BO\272)\030\02526\261 \314\327\336\030\232\032\204\025\001P\021\030\212B\026\251\026IGA[\236_\036\a\272r\350\027\357\254\372\364P\331ZC\246\005m\227-h\372T\352\265\r\n\244\276\302\26355\251\020\245\235\r\021\344\ No. Time Source Destination Protocol Info 3281 71.039440 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3281 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.654902000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 71.039440000 seconds] Frame Number: 3281 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x196c (6508) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd8f1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2348857, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2348857 (relative sequence number) [Next sequence number: 2350225 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa44d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608819, TSecr 60593251 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \362\305\fX\304\326\260B#\222\375lB\016U:\340T>\271\3271\354\257^\302\372\023\213\274\021\222\001\357\344\302Q\353Y[\252\030.\205\352\377\026\341\317\035<\262rs\275\347\276\265\236jh\324pE\277\036\274\232c!)&\3270\234 No. Time Source Destination Protocol Info 3282 71.039445 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3282 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:24.654907000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 71.039445000 seconds] Frame Number: 3282 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0732 (1842) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xeb2b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2350225, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2350225 (relative sequence number) [Next sequence number: 2351593 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9ffe [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608819, TSecr 60593251 [SEQ/ACK analysis] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \264\310\273\252\275\033\300\344\251\251\215I[,\031\314`\216\364\325e\202Kf\372\372\325\v\344J@3BL\020\266f\204x\211\244w\233\332\210Q\211\215\035,\253+\363J\2344\236U\266PIOk\241\024\2020T\272\35599B\330\224\337u\255 No. Time Source Destination Protocol Info 3517 75.218513 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3517 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.833975000 [Time delta from previous captured frame: 0.000032000 seconds] [Time delta from previous displayed frame: 0.000032000 seconds] [Time since reference or first frame: 75.218513000 seconds] Frame Number: 3517 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xda79 (55929) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x17e4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2511649, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2511649 (relative sequence number) [Next sequence number: 2513017 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe226 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593667 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3514] [The RTT to ACK the segment was: 0.070112000 seconds] [Number of bytes in flight: 9576] FTP Data [truncated] FTP Data: \364\305v\371x\255\354B\221\360\240 \003\030l\bB\003\240\233\253\233\246\177\212Z\225\331\214\022:;`y\006B\367[\352\330\241\272B-\247\264i\353\323@\000\000\001j\001\000\341\250\303`\270\303\2527\205\025\260\310!\320\2 No. Time Source Destination Protocol Info 3518 75.238551 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2510281 Win=86656 Len=0 TSV=60593670 TSER=987608859 Frame 3518 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:28.854013000 [Time delta from previous captured frame: 0.020038000 seconds] [Time delta from previous displayed frame: 0.020038000 seconds] [Time since reference or first frame: 75.238551000 seconds] Frame Number: 3518 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ace (19150) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2510281, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2510281 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 86656 (scaled) Checksum: 0xb6f0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593670, TSecr 987608859 No. Time Source Destination Protocol Info 3519 75.238590 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3519 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.854052000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 75.238590000 seconds] Frame Number: 3519 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3533 (13619) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbd2a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2513017, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2513017 (relative sequence number) [Next sequence number: 2514385 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3be2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593670 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3518] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 9576] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3520 75.238598 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3520 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.854060000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 75.238598000 seconds] Frame Number: 3520 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd36e (54126) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1eef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2514385, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2514385 (relative sequence number) [Next sequence number: 2515753 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9eb5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593670 [SEQ/ACK analysis] [Number of bytes in flight: 10944] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3521 75.238604 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3521 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.854066000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 75.238604000 seconds] Frame Number: 3521 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xac4b (44107) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4612 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2515753, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2515753 (relative sequence number) [Next sequence number: 2517121 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0620 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593670 [SEQ/ACK analysis] [Number of bytes in flight: 12312] FTP Data [truncated] FTP Data: \330Gj\230\nb\243\225\340`\354\317S\231\b\222\bv,\v\025\224\017\304p!\f\024U\256\221\vc \204 \227\370\3653[\245\365\272\243\001\2234\272\227\032\253\305\000*\210\034\374H^\204\321{|h\361O4x\0225U8H\316X\277\245n\r\333 No. Time Source Destination Protocol Info 3522 75.238609 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3522 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.854071000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 75.238609000 seconds] Frame Number: 3522 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1550 (5456) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdd0d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2517121, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2517121 (relative sequence number) [Next sequence number: 2518489 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd3a4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593670 [SEQ/ACK analysis] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \315\031ga\f-KUU\024\260\274\022KhK\212O\n`&\2639.\027|\217\036I\211\240\342\315:\021\300\315\255\271\247\313F\002Ba\300R\0320h]C\362\301\370\216!\f\0245\216\254\315 \202^\314foW&\350QS\n\271Z\226\215i\330\001\371\351 No. Time Source Destination Protocol Info 3523 75.238616 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3523 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.854078000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 75.238616000 seconds] Frame Number: 3523 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2342 (9026) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcf1b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2518489, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2518489 (relative sequence number) [Next sequence number: 2519857 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf91b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593670 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: /c\316\233\271l\232M]+\t\342a\213~-'\243\261\266e\r\3755KP\331\021BEa\023\020\2010\220\345\266\323^\230i\211\364\310\020f\366\210< \f\302f\v\t?\240g9z 52904 [ACK] Seq=1 Ack=2511649 Win=87552 Len=0 TSV=60593673 TSER=987608860 Frame 3524 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:28.893989000 [Time delta from previous captured frame: 0.039911000 seconds] [Time delta from previous displayed frame: 0.039911000 seconds] [Time since reference or first frame: 75.278527000 seconds] Frame Number: 3524 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4acf (19151) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e6 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2511649, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2511649 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb186 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593673, TSecr 987608860 No. Time Source Destination Protocol Info 3525 75.278570 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3525 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.894032000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 75.278570000 seconds] Frame Number: 3525 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xee65 (61029) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x03f8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2519857, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2519857 (relative sequence number) [Next sequence number: 2521225 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6d5d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608861, TSecr 60593673 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3524] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \335\316\266\327w\365\373J\366x\205`\324lm\325\235\v\240\310\333\315#@\215\353\323U\032s,\317\331\n\306\216)\234Yq*h\004\241\312\023\2070D\021\004`\223W4(\321\242T\306t\345\331R\202\251NK\276\331\027\322\257\221S\317\ No. Time Source Destination Protocol Info 3526 75.330205 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2513017 Win=87552 Len=0 TSV=60593679 TSER=987608861 Frame 3526 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:28.945667000 [Time delta from previous captured frame: 0.051635000 seconds] [Time delta from previous displayed frame: 0.051635000 seconds] [Time since reference or first frame: 75.330205000 seconds] Frame Number: 3526 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad0 (19152) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e5 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2513017, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2513017 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xac27 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593679, TSecr 987608861 No. Time Source Destination Protocol Info 3527 75.330241 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3527 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.945703000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 75.330241000 seconds] Frame Number: 3527 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1c4d (7245) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd610 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2521225, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2521225 (relative sequence number) [Next sequence number: 2522593 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1bc8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608862, TSecr 60593679 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3526] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 12312] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3528 75.358292 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2514385 Win=87552 Len=0 TSV=60593682 TSER=987608861 Frame 3528 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:28.973754000 [Time delta from previous captured frame: 0.028051000 seconds] [Time delta from previous displayed frame: 0.028051000 seconds] [Time since reference or first frame: 75.358292000 seconds] Frame Number: 3528 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad1 (19153) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e4 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2514385, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2514385 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa6cc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593682, TSecr 987608861 No. Time Source Destination Protocol Info 3529 75.358333 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3529 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.973795000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 75.358333000 seconds] Frame Number: 3529 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb513 (46355) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3d4a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2522593, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2522593 (relative sequence number) [Next sequence number: 2523961 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4147 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608862, TSecr 60593682 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3528] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3530 75.358352 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3530 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.973814000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 75.358352000 seconds] Frame Number: 3530 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa025 (40997) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5238 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2523961, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2523961 (relative sequence number) [Next sequence number: 2525329 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0d13 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608862, TSecr 60593682 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \304\270\250\030\376\265\301P+\023\022\016}S\276\317\365o\a\237\377\017\373\361\002\215\205\025L\340\037\217\004Bi\313\366\267\362\365\r6\363\360\224\020\017\025{kc\n\n\2349\234`\233\213\325\265=\377\r\027{\347\t\026\ No. Time Source Destination Protocol Info 3531 75.378416 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2515753 Win=87552 Len=0 TSV=60593684 TSER=987608861 Frame 3531 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:28.993878000 [Time delta from previous captured frame: 0.020064000 seconds] [Time delta from previous displayed frame: 0.020064000 seconds] [Time since reference or first frame: 75.378416000 seconds] Frame Number: 3531 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad2 (19154) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e3 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2515753, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2515753 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa172 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593684, TSecr 987608861 No. Time Source Destination Protocol Info 3532 75.378459 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3532 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:28.993921000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 75.378459000 seconds] Frame Number: 3532 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x420a (16906) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb053 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2525329, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2525329 (relative sequence number) [Next sequence number: 2526697 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc87c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608862, TSecr 60593684 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3531] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: x\246/\211 &\332\027\027!&\323\227\327\271\345\265U\347\025\225&\270M\v\325\210\312A\212\344\301eEy\035E\371|^\341q\3650\263]\376\337U\345\005z\252\252\325[\333\322\312\241\200Q\341\356A\334\b\2617\273\233l\+\313\r\00 No. Time Source Destination Protocol Info 3533 75.418287 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2517121 Win=87552 Len=0 TSV=60593688 TSER=987608861 Frame 3533 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.033749000 [Time delta from previous captured frame: 0.039828000 seconds] [Time delta from previous displayed frame: 0.039828000 seconds] [Time since reference or first frame: 75.418287000 seconds] Frame Number: 3533 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad3 (19155) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e2 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2517121, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2517121 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9c16 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593688, TSecr 987608861 No. Time Source Destination Protocol Info 3534 75.418325 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3534 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.033787000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 75.418325000 seconds] Frame Number: 3534 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf57e (62846) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xfcde [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2526697, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2526697 (relative sequence number) [Next sequence number: 2528065 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa9c4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608863, TSecr 60593688 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3533] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \220\247#\370\374\025\365<\343\003f\203\0028v\327\244\037\216\312\240\354\326c5XL\326*\253\272\342]k\353\025\341\340\260K\216\371\254\032C\310g\373q\222\251\3128\034\232\202\252\343\247\201`t\305\324a\257?\005|\341\30 No. Time Source Destination Protocol Info 3535 75.438550 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2518489 Win=87552 Len=0 TSV=60593690 TSER=987608861 Frame 3535 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.054012000 [Time delta from previous captured frame: 0.020225000 seconds] [Time delta from previous displayed frame: 0.020225000 seconds] [Time since reference or first frame: 75.438550000 seconds] Frame Number: 3535 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad4 (19156) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e1 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2518489, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2518489 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x96bc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593690, TSecr 987608861 No. Time Source Destination Protocol Info 3536 75.438585 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3536 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.054047000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 75.438585000 seconds] Frame Number: 3536 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x850d (34061) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6d50 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2528065, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2528065 (relative sequence number) [Next sequence number: 2529433 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1ca1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608863, TSecr 60593690 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3535] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \3601>]\217\233^\355D\025\226\024\222/\340\330\325\351\207\206\003\203\2632\356[\024ynP\205\322\277\313i\n\305n\333\274\201\260\360\360\216\360Gwwj'\253\322@\253H\300\216\317\030\366~]UP\204\027Zw\2656\232D\210\270\00 No. Time Source Destination Protocol Info 3537 75.468236 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2519857 Win=87552 Len=0 TSV=60593693 TSER=987608861 Frame 3537 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.083698000 [Time delta from previous captured frame: 0.029651000 seconds] [Time delta from previous displayed frame: 0.029651000 seconds] [Time since reference or first frame: 75.468236000 seconds] Frame Number: 3537 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad5 (19157) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3e0 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2519857, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2519857 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9161 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593693, TSecr 987608861 No. Time Source Destination Protocol Info 3538 75.468273 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3538 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.083735000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 75.468273000 seconds] Frame Number: 3538 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6a60 (27232) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x87fd [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2529433, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2529433 (relative sequence number) [Next sequence number: 2530801 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5203 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608863, TSecr 60593693 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3537] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: +>{\252\245R\361\263-;\004[\233\365PGU\353\276\252b\003\360c\210\252\353U\267\334\233\224'\234\325\245\256\027w<>\0255\353\266\326\266\220+\322--\367\345\303\026\000\000\000\251\001\344\035\v\214\340X\357\377\373\377\ No. Time Source Destination Protocol Info 3539 75.498507 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2521225 Win=87552 Len=0 TSV=60593696 TSER=987608861 Frame 3539 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.113969000 [Time delta from previous captured frame: 0.030234000 seconds] [Time delta from previous displayed frame: 0.030234000 seconds] [Time since reference or first frame: 75.498507000 seconds] Frame Number: 3539 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad6 (19158) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3df [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2521225, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2521225 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8c06 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593696, TSecr 987608861 No. Time Source Destination Protocol Info 3540 75.498551 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3540 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.114013000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 75.498551000 seconds] Frame Number: 3540 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9628 (38440) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5c35 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2530801, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2530801 (relative sequence number) [Next sequence number: 2532169 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2aba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608863, TSecr 60593696 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3539] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \265\257hU\356~\357R\337\340\223w\345\363R._l\021\336\270\271"\267\275_\250\254\330\273\237>\032\360A\341\217\006\037\236\202\222m\327sLoe\326n\342\365\223\2157\032r\356Op\000\000\000\353\001\000]\371\aB\343\026\030ww No. Time Source Destination Protocol Info 3541 75.529237 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2522593 Win=87552 Len=0 TSV=60593699 TSER=987608862 Frame 3541 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.144699000 [Time delta from previous captured frame: 0.030686000 seconds] [Time delta from previous displayed frame: 0.030686000 seconds] [Time since reference or first frame: 75.529237000 seconds] Frame Number: 3541 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad7 (19159) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3de [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2522593, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2522593 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x86aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593699, TSecr 987608862 No. Time Source Destination Protocol Info 3542 75.529274 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3542 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.144736000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 75.529274000 seconds] Frame Number: 3542 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbc6e (48238) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x35ef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2532169, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2532169 (relative sequence number) [Next sequence number: 2533537 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4db5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608864, TSecr 60593699 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3541] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \300\244\365\257\3606\207\315\315\306\0266G\326P\206\263\354F7w\277\365\n*H\t\2233\310\251\003\220>\rH\306\257\302\331\343\235\357t\312\377\377\320)\234\377\346\313I\202\366i\3525:\375t\t\251\v\227P\223\311\277\211\25 No. Time Source Destination Protocol Info 3543 75.558499 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2523961 Win=87552 Len=0 TSV=60593702 TSER=987608862 Frame 3543 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.173961000 [Time delta from previous captured frame: 0.029225000 seconds] [Time delta from previous displayed frame: 0.029225000 seconds] [Time since reference or first frame: 75.558499000 seconds] Frame Number: 3543 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad8 (19160) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3dd [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2523961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2523961 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x814f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593702, TSecr 987608862 No. Time Source Destination Protocol Info 3544 75.558549 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3544 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.174011000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 75.558549000 seconds] Frame Number: 3544 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2e47 (11847) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc416 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2533537, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2533537 (relative sequence number) [Next sequence number: 2534905 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x614a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608864, TSecr 60593702 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3543] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \252\242\v"\250\251]\377~\255lV*\206v4\244\274+9\177\340\t90\222\335\335*\366\033\177wi\245*[\210\263\301\254\245\250\314\236p\230\327\022\f\331\257\020\333\024\2653\017\345\272\325:\031\313\031m\264\306.\337\255\221A No. Time Source Destination Protocol Info 3545 75.589374 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2525329 Win=87552 Len=0 TSV=60593705 TSER=987608862 Frame 3545 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.204836000 [Time delta from previous captured frame: 0.030825000 seconds] [Time delta from previous displayed frame: 0.030825000 seconds] [Time since reference or first frame: 75.589374000 seconds] Frame Number: 3545 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ad9 (19161) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3dc [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2525329, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2525329 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7bf4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593705, TSecr 987608862 No. Time Source Destination Protocol Info 3546 75.589411 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3546 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.204873000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 75.589411000 seconds] Frame Number: 3546 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbb3a (47930) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3723 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2534905, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2534905 (relative sequence number) [Next sequence number: 2536273 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfeb1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608864, TSecr 60593705 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3545] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: q\217\f\322\2479\316\225\336\351^\377e-R\251\]?6t\237.]\335\3413\314\352'\254\217\022\260\\326\357\023y\251\231\227\3031\023:\206\000@\315\343&\001\366\306\324\035\250n\302\366#\361\203\215\354\225/I\347\321<[\221\330 No. Time Source Destination Protocol Info 3547 75.589418 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3547 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.204880000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 75.589418000 seconds] Frame Number: 3547 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8b2c (35628) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6731 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2536273, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2536273 (relative sequence number) [Next sequence number: 2537641 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x37bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608864, TSecr 60593705 [SEQ/ACK analysis] [Number of bytes in flight: 27360] FTP Data [truncated] FTP Data: -&\366\337on7B\252\004k8c>\337\267\363|\210\276R\271l\273\306U\367\3361\217\313\377\375\373\277\357y\263\307,\207\033\375\357\256\027\251\376lU\342{\023\371\303u\375\266\373\177\367\243\325\367`\236\037\302\363\330\23 No. Time Source Destination Protocol Info 3548 75.618493 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2526697 Win=87552 Len=0 TSV=60593708 TSER=987608862 Frame 3548 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.233955000 [Time delta from previous captured frame: 0.029075000 seconds] [Time delta from previous displayed frame: 0.029075000 seconds] [Time since reference or first frame: 75.618493000 seconds] Frame Number: 3548 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ada (19162) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3db [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2526697, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2526697 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7699 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593708, TSecr 987608862 No. Time Source Destination Protocol Info 3549 75.618549 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3549 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.234011000 [Time delta from previous captured frame: 0.000056000 seconds] [Time delta from previous displayed frame: 0.000056000 seconds] [Time since reference or first frame: 75.618549000 seconds] Frame Number: 3549 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2865 (10341) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc9f8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2537641, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2537641 (relative sequence number) [Next sequence number: 2539009 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6b7f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608865, TSecr 60593708 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3548] [The RTT to ACK the segment was: 0.000056000 seconds] [Number of bytes in flight: 28728] FTP Data [truncated] FTP Data: 3_\025\327\177X\234\bU\363\243\342:A<\346\bF\232\032\367\277\226(}<\332\247\016{u\306\262uo\227\204\234t\341\377\247\373\343\t\2437Bf\006\251\367\026\356\247\n\216p\360Pp\367\321#\334\037\024Z\206\252\222\370\036\336\ No. Time Source Destination Protocol Info 3550 75.688979 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2528065 Win=87552 Len=0 TSV=60593711 TSER=987608863 Frame 3550 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.304441000 [Time delta from previous captured frame: 0.070430000 seconds] [Time delta from previous displayed frame: 0.070430000 seconds] [Time since reference or first frame: 75.688979000 seconds] Frame Number: 3550 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4adb (19163) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3da [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2528065, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2528065 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x713d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593711, TSecr 987608863 No. Time Source Destination Protocol Info 3551 75.689026 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3551 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.304488000 [Time delta from previous captured frame: 0.000047000 seconds] [Time delta from previous displayed frame: 0.000047000 seconds] [Time since reference or first frame: 75.689026000 seconds] Frame Number: 3551 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3266 (12902) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbff7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2539009, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2539009 (relative sequence number) [Next sequence number: 2540377 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9605 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608865, TSecr 60593711 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3550] [The RTT to ACK the segment was: 0.000047000 seconds] [Number of bytes in flight: 30096] FTP Data [truncated] FTP Data: a3"\346\313V\236\236\263uEB\305o\276N\364\213\271\035\326!\3130[\264\033f\277N\367\276\374s\205G\037\373\374\330\035\372W\377\266\234w\274\314?\323E_\210a|g\277f\033_o\023\305L\266\250d\372'GQ}4\313\365\257\231\235"f\ No. Time Source Destination Protocol Info 3552 75.709202 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2530801 Win=87552 Len=0 TSV=60593717 TSER=987608863 Frame 3552 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.324664000 [Time delta from previous captured frame: 0.020176000 seconds] [Time delta from previous displayed frame: 0.020176000 seconds] [Time since reference or first frame: 75.709202000 seconds] Frame Number: 3552 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4adc (19164) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d9 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2530801, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2530801 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6687 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593717, TSecr 987608863 No. Time Source Destination Protocol Info 3553 75.709245 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3553 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.324707000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 75.709245000 seconds] Frame Number: 3553 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x661b (26139) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8c42 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2540377, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2540377 (relative sequence number) [Next sequence number: 2541745 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3e91 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608866, TSecr 60593717 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3552] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \276\224\350\213\323\323\356!Z\376\b\321:\033\332\v*\0375f&F\227\304\031\227\372\212i\n\342J2\320\330\245\2213\357\235\214q_\216SOlU\266\335\206\250\341\302p\005\251]\231\357\034\230\235;\344}\266\377\3212\360\373\r\3 No. Time Source Destination Protocol Info 3554 75.709252 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3554 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.324714000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 75.709252000 seconds] Frame Number: 3554 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4435 (17461) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xae28 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2541745, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2541745 (relative sequence number) [Next sequence number: 2543113 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7a85 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608866, TSecr 60593717 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \005}\366\356\2777__\252\213>\337\275}\274c\032\316\265R\002\r\255e\357u\210q\356\235\326\345\305k\001\206oP\025p\006\217-\323\337\377\317\357\021\375\024\310\202+5dt'o-\327}yv\377bj\375\2728n\246\235s|\273\275\377\20 No. Time Source Destination Protocol Info 3555 75.810901 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2533537 Win=87552 Len=0 TSV=60593723 TSER=987608863 Frame 3555 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.426363000 [Time delta from previous captured frame: 0.101649000 seconds] [Time delta from previous displayed frame: 0.101649000 seconds] [Time since reference or first frame: 75.810901000 seconds] Frame Number: 3555 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4add (19165) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d8 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2533537, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2533537 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5bd1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593723, TSecr 987608863 No. Time Source Destination Protocol Info 3556 75.810941 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3556 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.426403000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 75.810941000 seconds] Frame Number: 3556 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x131b (4891) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdf42 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2543113, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2543113 (relative sequence number) [Next sequence number: 2544481 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x96b3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593723 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3555] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \205A\000+\273\273\212\334V+IEb\271qB\002\227\264\320\255\267lS\027v\017\210q\270N3\022,D9\233\025\246(\304\340\353\301w\004\313\212\032\022\274^\352\337\020$\32 No. Time Source Destination Protocol Info 3558 75.828571 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2536273 Win=87552 Len=0 TSV=60593729 TSER=987608864 Frame 3558 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.444033000 [Time delta from previous captured frame: 0.017624000 seconds] [Time delta from previous displayed frame: 0.017624000 seconds] [Time since reference or first frame: 75.828571000 seconds] Frame Number: 3558 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ade (19166) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2536273, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2536273 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x511a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593729, TSecr 987608864 No. Time Source Destination Protocol Info 3559 75.828621 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3559 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.444083000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 75.828621000 seconds] Frame Number: 3559 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4152 (16722) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb10b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2545849, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2545849 (relative sequence number) [Next sequence number: 2547217 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0977 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593729 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3558] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \f\A\244\252\251=En\262\\211\274\345\273\201\331-B\260i$ \033\347\372\004\223\373\330e\255r\241<\376\325~o\005\232[a\016Ss\226\372\265L`I\334yr\345\024"\250i!\315\264\374\332\327ru\\361W{\342\374(\204\335\352\252\253\ No. Time Source Destination Protocol Info 3560 75.828631 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3560 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.444093000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 75.828631000 seconds] Frame Number: 3560 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc548 (50504) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2d15 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2547217, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2547217 (relative sequence number) [Next sequence number: 2548585 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x93b0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593729 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \327ui7\354\225f\306\034\265U\332[\274H\302\245\220\244\004\201\021\376_Z\264\265\220x\364(M\367LWx\\225d<9\nS\334A\302\177\227\335\271\373\031\003\200@8#\0058\3357{\305r\335\321\016HQ\230\021\354\250\021\356\233\266( No. Time Source Destination Protocol Info 3561 75.888580 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2539009 Win=87552 Len=0 TSV=60593735 TSER=987608864 Frame 3561 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.504042000 [Time delta from previous captured frame: 0.059949000 seconds] [Time delta from previous displayed frame: 0.059949000 seconds] [Time since reference or first frame: 75.888580000 seconds] Frame Number: 3561 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4adf (19167) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d6 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2539009, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2539009 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4664 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593735, TSecr 987608864 No. Time Source Destination Protocol Info 3562 75.888625 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3562 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.504087000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 75.888625000 seconds] Frame Number: 3562 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x916a (37226) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x60f3 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2548585, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2548585 (relative sequence number) [Next sequence number: 2549953 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe90a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593735 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3561] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \363\347\202\032\253\373AB.\260\276\271*\276\023\352\320\277M>^.\266Q\021\315\351\230\253\3328&w\211\366\205\323Y\232\365\313t\254\242\001\242c\354Qy\256\375\b5!\243\304b\274V\j\354\004\0200\005\033J.\356'\216\336\340 No. Time Source Destination Protocol Info 3563 75.888633 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3563 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.504095000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 75.888633000 seconds] Frame Number: 3563 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x696d (26989) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x88f0 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2549953, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2549953 (relative sequence number) [Next sequence number: 2551321 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x930a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593735 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: r>V\360\250\230~5\262q[\177\353\360V\021\273\273\336+\025\270\255\361!\301\327w\211\362\365\027\025\302\352\3744\023\273\273\305w\232#\021\377\372D\3079\302\314N\342\302\302\265\034$\021\376\n\245f:\206\006\335/\230E\ No. Time Source Destination Protocol Info 3564 75.888638 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3564 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.504100000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 75.888638000 seconds] Frame Number: 3564 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3e60 (15968) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb3fd [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2551321, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2551321 (relative sequence number) [Next sequence number: 2552689 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xbb69 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608867, TSecr 60593735 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \306\262\301\0001\021^\260\270\236d\267\363qq\037\262rG^\332\232;5\357~\315/>\233'\373)\271`!\247B\364\313!\327\216\343\276~\v\256\342\276\347\330$\300H\177\377\377\377\341\336\024\036\t"\273\312.\210N\353\205\207\311 No. Time Source Destination Protocol Info 3565 75.948589 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2541745 Win=87552 Len=0 TSV=60593741 TSER=987608865 Frame 3565 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.564051000 [Time delta from previous captured frame: 0.059951000 seconds] [Time delta from previous displayed frame: 0.059951000 seconds] [Time since reference or first frame: 75.948589000 seconds] Frame Number: 3565 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae0 (19168) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d5 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2541745, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2541745 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3bad [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593741, TSecr 987608865 No. Time Source Destination Protocol Info 3566 75.948627 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3566 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.564089000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 75.948627000 seconds] Frame Number: 3566 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x417c (16764) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb0e1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2552689, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2552689 (relative sequence number) [Next sequence number: 2554057 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf90e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608868, TSecr 60593741 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3565] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: qE\t\033D\a\343\316\001\327y\036Y\331W0+\345\302\3457\333\326\325E\343\234.qw\203[\305\253\020\331o\031\b\336^\252\265]\232\226\232\035\353\377\377\372\376A\037\201#\277\370Q\177\303=\327/\377\311\312\272\177\366\257\ No. Time Source Destination Protocol Info 3567 75.948634 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3567 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.564096000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 75.948634000 seconds] Frame Number: 3567 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8959 (35161) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6904 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2554057, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2554057 (relative sequence number) [Next sequence number: 2555425 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfa91 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608868, TSecr 60593741 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \234\372\317\222\252\253\000\000\000\347\001\250\303`\270\300\221\200\260\016\213\027\255^\270\\211\023\016N\306\b\230_@O(s\227\326\335~\027I!!\241\324 52904 [ACK] Seq=1 Ack=2544481 Win=87552 Len=0 TSV=60593747 TSER=987608866 Frame 3568 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.624256000 [Time delta from previous captured frame: 0.060160000 seconds] [Time delta from previous displayed frame: 0.060160000 seconds] [Time since reference or first frame: 76.008794000 seconds] Frame Number: 3568 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae1 (19169) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d4 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2544481, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2544481 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x30f6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593747, TSecr 987608866 No. Time Source Destination Protocol Info 3569 76.008860 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3569 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.624322000 [Time delta from previous captured frame: 0.000066000 seconds] [Time delta from previous displayed frame: 0.000066000 seconds] [Time since reference or first frame: 76.008860000 seconds] Frame Number: 3569 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1b1b (6939) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd742 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2555425, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2555425 (relative sequence number) [Next sequence number: 2556793 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6976 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608869, TSecr 60593747 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3568] [The RTT to ACK the segment was: 0.000066000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \341)\376\335\354\324\212\n4\022c:\273\3366s\373\273<\330\367zh\334\270\316N\025\331\260\203@\317\257H\207\002\t\034?\271\271\257\252\227{\337lH\255+\252\256\204W\251\004\316>\351k\244\357\304\267@\223\273\363cl\275}\ No. Time Source Destination Protocol Info 3570 76.008868 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3570 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.624330000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.008868000 seconds] Frame Number: 3570 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf61e (63006) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xfc3e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2556793, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2556793 (relative sequence number) [Next sequence number: 2558161 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x908c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608869, TSecr 60593747 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3571 76.078434 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2547217 Win=87552 Len=0 TSV=60593753 TSER=987608867 Frame 3571 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.693896000 [Time delta from previous captured frame: 0.069566000 seconds] [Time delta from previous displayed frame: 0.069566000 seconds] [Time since reference or first frame: 76.078434000 seconds] Frame Number: 3571 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae2 (19170) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d3 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2547217, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2547217 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x263f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593753, TSecr 987608867 No. Time Source Destination Protocol Info 3572 76.078475 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3572 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.693937000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 76.078475000 seconds] Frame Number: 3572 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x574a (22346) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9b13 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2558161, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2558161 (relative sequence number) [Next sequence number: 2559529 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8b2e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608869, TSecr 60593753 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3571] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3573 76.078483 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3573 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.693945000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.078483000 seconds] Frame Number: 3573 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x544c (21580) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9e11 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2559529, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2559529 (relative sequence number) [Next sequence number: 2560897 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0069 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608869, TSecr 60593753 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3574 76.128357 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2549953 Win=87552 Len=0 TSV=60593759 TSER=987608867 Frame 3574 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.743819000 [Time delta from previous captured frame: 0.049874000 seconds] [Time delta from previous displayed frame: 0.049874000 seconds] [Time since reference or first frame: 76.128357000 seconds] Frame Number: 3574 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae3 (19171) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d2 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2549953, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2549953 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x1b89 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593759, TSecr 987608867 No. Time Source Destination Protocol Info 3575 76.128405 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3575 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.743867000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 76.128405000 seconds] Frame Number: 3575 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3777 (14199) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbae6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2560897, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2560897 (relative sequence number) [Next sequence number: 2562265 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xaf00 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608870, TSecr 60593759 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3574] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: 3\035\304w\243{l\003\273k\305Gs\2705\306*`\245\257F\177\306=\323\351<\373\324\272\364\204\017/\271\265\350\003\274Xs\227\234z<\004\366@\v\006l3CE\033\262\252R\3073\246\2643\316\324\337\245\245\200~\246\247\256 52904 [ACK] Seq=1 Ack=2552689 Win=87552 Len=0 TSV=60593765 TSER=987608867 Frame 3577 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.803837000 [Time delta from previous captured frame: 0.059962000 seconds] [Time delta from previous displayed frame: 0.059962000 seconds] [Time since reference or first frame: 76.188375000 seconds] Frame Number: 3577 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae4 (19172) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d1 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2552689, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2552689 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x10d3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593765, TSecr 987608867 No. Time Source Destination Protocol Info 3578 76.188426 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3578 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.803888000 [Time delta from previous captured frame: 0.000051000 seconds] [Time delta from previous displayed frame: 0.000051000 seconds] [Time since reference or first frame: 76.188426000 seconds] Frame Number: 3578 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7f41 (32577) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x731c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2563633, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2563633 (relative sequence number) [Next sequence number: 2565001 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1345 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608870, TSecr 60593765 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3577] [The RTT to ACK the segment was: 0.000051000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \324i\3615\265\214\3157\024\3022\217 \255>-\334d\312\257\254\330[L\245\204\251C\001\303\025\260\303E\200\315\031t\342\214\232\250\324\b\302\314\372HC@T\0228\032kd\334F@\224\351\306\033\232%\264\304\266Y\242Y(\bm\304)\ No. Time Source Destination Protocol Info 3579 76.188433 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3579 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.803895000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 76.188433000 seconds] Frame Number: 3579 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3606 (13830) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbc57 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2565001, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2565001 (relative sequence number) [Next sequence number: 2566369 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfe4d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608870, TSecr 60593765 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: I\250P(\364\212\261&\211\033)\322\237\2047Q\361H\333.\345\352\220\324\262\002\235\262\306-O\274\003\205jX@\233\263!>\030\255\375\003S\005\351Q\251\n\rn\336G\352l\024v\272\273\377V|D@0X&[\275TT\341\3058\244\215E\232\30 No. Time Source Destination Protocol Info 3580 76.188445 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3580 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.803907000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 76.188445000 seconds] Frame Number: 3580 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7f50 (32592) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x730d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2566369, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2566369 (relative sequence number) [Next sequence number: 2567737 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x067e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608870, TSecr 60593765 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \335\032z7\211\200\311X\2400\277jq\327\262\006e=\244\362Q\276\323:\3721\212\265J5\177Z7m\256v\243u\234\247(eD\\3260S\031s\f\204\353Wv\315&\335S\245TT\037\035\222\031]s\t\273W\340\265\344P\307bE\232\325\275\036\264|.\3 No. Time Source Destination Protocol Info 3581 76.249635 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2555425 Win=87552 Len=0 TSV=60593771 TSER=987608868 Frame 3581 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.865097000 [Time delta from previous captured frame: 0.061190000 seconds] [Time delta from previous displayed frame: 0.061190000 seconds] [Time since reference or first frame: 76.249635000 seconds] Frame Number: 3581 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae5 (19173) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3d0 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2555425, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2555425 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x061c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593771, TSecr 987608868 No. Time Source Destination Protocol Info 3582 76.249696 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3582 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.865158000 [Time delta from previous captured frame: 0.000061000 seconds] [Time delta from previous displayed frame: 0.000061000 seconds] [Time since reference or first frame: 76.249696000 seconds] Frame Number: 3582 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd97b (55675) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x18e2 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2567737, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2567737 (relative sequence number) [Next sequence number: 2569105 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x100e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608871, TSecr 60593771 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3581] [The RTT to ACK the segment was: 0.000061000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3583 76.249706 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3583 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.865168000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 76.249706000 seconds] Frame Number: 3583 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x127e (4734) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdfdf [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2569105, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2569105 (relative sequence number) [Next sequence number: 2570473 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1564 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608871, TSecr 60593771 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \305b\267\025\273\371\274W\214\nOL\035\360U\030\210\314\307\332\353Z\242\223<)\017\207\343\201\241n\356\357\020\374\340hx\366\252E\374@\221\230\201\342\034-\212\000\304\000\340\221\304 \n\307\347&\341\030s\301\375\203 No. Time Source Destination Protocol Info 3584 76.309435 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2558161 Win=87552 Len=0 TSV=60593777 TSER=987608869 Frame 3584 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:29.924897000 [Time delta from previous captured frame: 0.059729000 seconds] [Time delta from previous displayed frame: 0.059729000 seconds] [Time since reference or first frame: 76.309435000 seconds] Frame Number: 3584 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae6 (19174) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3cf [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2558161, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2558161 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xfb64 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593777, TSecr 987608869 No. Time Source Destination Protocol Info 3585 76.309477 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3585 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.924939000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 76.309477000 seconds] Frame Number: 3585 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0a52 (2642) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe80b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2570473, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2570473 (relative sequence number) [Next sequence number: 2571841 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfd9c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608872, TSecr 60593777 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3584] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: 8\306Aq\234\036\177\303\377\274%\377\373\351\372\346\r\377\224\020vN\034\034\275\360\216/\352\253\N\b~\266\236\031\f\026\252\274Q\311U\371\002\032\326\222\323\246\277\343\276"\253\252\376&\265Z\327\006\000\361{\207Ax+ No. Time Source Destination Protocol Info 3586 76.309485 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3586 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:29.924947000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.309485000 seconds] Frame Number: 3586 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7d2f (32047) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x752e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2571841, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2571841 (relative sequence number) [Next sequence number: 2573209 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdd4f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608872, TSecr 60593777 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \362c\340\232\253\252\352\334a]W\304k\b\360\250\177\206\305\202,_\356q#\365)\222\372\233$\037a|xf\301\340`\023UUVS\347=\301\201\307\311\235\b\362\365\036h^\3513\t\002\325\\026\024)\\274O\005\306\034\020\346@\267\325/% No. Time Source Destination Protocol Info 3587 76.609883 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2560897 Win=87552 Len=0 TSV=60593806 TSER=987608869 Frame 3587 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.225345000 [Time delta from previous captured frame: 0.300398000 seconds] [Time delta from previous displayed frame: 0.300398000 seconds] [Time since reference or first frame: 76.609883000 seconds] Frame Number: 3587 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae7 (19175) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ce [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2560897, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2560897 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf097 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593806, TSecr 987608869 No. Time Source Destination Protocol Info 3588 76.609942 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3588 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.225404000 [Time delta from previous captured frame: 0.000059000 seconds] [Time delta from previous displayed frame: 0.000059000 seconds] [Time since reference or first frame: 76.609942000 seconds] Frame Number: 3588 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4e1e (19998) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa43f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2573209, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2573209 (relative sequence number) [Next sequence number: 2574577 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf723 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593806 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3587] [The RTT to ACK the segment was: 0.000059000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \372e\276A\201\203\205\313\274\376H\241B\3113\023\210l=\241\242\226\2416cS\350(<\271\241\270\000\357U\3727\367\376]\206G\237s}^\277\200Q\372?>~\353q+\324\310PEHF\332\270\262\027(!\212\337|\204\215\020+\301\377\225I\17 No. Time Source Destination Protocol Info 3589 76.609950 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3589 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.225412000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.609950000 seconds] Frame Number: 3589 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xab71 (43889) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x46ec [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2574577, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2574577 (relative sequence number) [Next sequence number: 2575945 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x07ec [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593806 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \230\203\356\355>\356\357-\036p\241'\334J\261\211Pl\032/\025\270\321Q\036\000\000\001+\001\000 \332\220V\v\214\262\206G\362\321\361\263+\336\363\264R\222:\312(|T\264\212|;\333\223\345\250OjL\317\2256\357\240\300\315\2 No. Time Source Destination Protocol Info 3590 76.611696 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2563633 Win=87552 Len=0 TSV=60593807 TSER=987608870 Frame 3590 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.227158000 [Time delta from previous captured frame: 0.001746000 seconds] [Time delta from previous displayed frame: 0.001746000 seconds] [Time since reference or first frame: 76.611696000 seconds] Frame Number: 3590 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae8 (19176) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3cd [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2563633, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2563633 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe5e5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593807, TSecr 987608870 No. Time Source Destination Protocol Info 3591 76.611721 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3591 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.227183000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 76.611721000 seconds] Frame Number: 3591 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6673 (26227) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8bea [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2575945, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2575945 (relative sequence number) [Next sequence number: 2577313 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0e9f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593807 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3590] [The RTT to ACK the segment was: 0.000025000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: Z\272U\256\342j\322\254pB1\353e\324\331\352M\356\270J\372\273\333\363m90~\02674\v\r\315z\252\353\330\207\036\031\326#\302$\336\371\305\210\305n\357ms\030u\367\317\357~\214\nu'\217\216\332\312\267.\026\330\342\302\200\ No. Time Source Destination Protocol Info 3592 76.611728 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3592 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.227190000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 76.611728000 seconds] Frame Number: 3592 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x886e (34926) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x69ef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2577313, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2577313 (relative sequence number) [Next sequence number: 2578681 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x73a2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593807 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \256\2651\3527\345\buU\332iW\340\256\273Z\255U\{\255~\\271k\240M\264\265Z\367i\326\222\364\b\252\265\177\207%\311\360CE\3756\271c\360\353\326\252\205\204\253\\354\301\337\364\t\351\326\265]\@ae\354\267\273\372\365C\30 No. Time Source Destination Protocol Info 3593 76.614146 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2566369 Win=87552 Len=0 TSV=60593807 TSER=987608870 Frame 3593 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.229608000 [Time delta from previous captured frame: 0.002418000 seconds] [Time delta from previous displayed frame: 0.002418000 seconds] [Time since reference or first frame: 76.614146000 seconds] Frame Number: 3593 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ae9 (19177) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3cc [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2566369, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2566369 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xdb35 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593807, TSecr 987608870 No. Time Source Destination Protocol Info 3594 76.614186 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3594 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.229648000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 76.614186000 seconds] Frame Number: 3594 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe069 (57449) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x11f4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2578681, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2578681 (relative sequence number) [Next sequence number: 2580049 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xba68 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593807 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3593] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \036dl\212^\362>DY\177\360EU\375\ba\031\312l\377\376\177\263@\211\212\335\222\264\347\326\333K\016\344\274\032\245\237\313\312\201a\354\326\000\202G\353\236r]\334\315Pb,1OI\3126\005\037\330\031\326\237\232Hzm\261KX\21 No. Time Source Destination Protocol Info 3595 76.614195 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3595 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.229657000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 76.614195000 seconds] Frame Number: 3595 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x457a (17786) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xace3 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2580049, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2580049 (relative sequence number) [Next sequence number: 2581417 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcf1c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593807 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \3656z~}\343\313\323}\357w\230\363\211\317\240wJ;a\260\236\245\375S\337\006\331\241\213j\354&\320O\021\205=AL\346\372\233\333\216u\v\252\235{\205\207\302!\006\254\225\213\336\373\340\253)\255\004;\177"\375\202+\332\31 No. Time Source Destination Protocol Info 3596 76.614199 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3596 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.229661000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 76.614199000 seconds] Frame Number: 3596 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x274c (10060) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcb11 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2581417, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2581417 (relative sequence number) [Next sequence number: 2582785 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9f74 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593807 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \264\367\272_\241\214\022<\307\367\257\377M\364\321\3343\204\373\033\376\277\277\333\247#\364\350\253\363\320{\336gT\245z\327\005=\226\234\275\235\rU\v\252\274l!\265\353\244l\263\255\333o\350\212\235\t\260E\223h\332\3 No. Time Source Destination Protocol Info 3597 76.618919 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2569105 Win=87552 Len=0 TSV=60593808 TSER=987608870 Frame 3597 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.234381000 [Time delta from previous captured frame: 0.004720000 seconds] [Time delta from previous displayed frame: 0.004720000 seconds] [Time since reference or first frame: 76.618919000 seconds] Frame Number: 3597 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aea (19178) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3cb [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2569105, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2569105 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd084 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593808, TSecr 987608870 No. Time Source Destination Protocol Info 3598 76.618965 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3598 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.234427000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 76.618965000 seconds] Frame Number: 3598 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4a13 (18963) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa84a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2582785, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2582785 (relative sequence number) [Next sequence number: 2584153 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4cb8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593808 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3597] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: <\301Z\372\360\305j\273i\273\324}f\234\332\355#\356n\2342\336\374\200\305\355\367g\205\363\302\026\3514\256`\332\306/\234\323\350\006\265X\274___\377_\301\a[\300\227\246\213\274\233\260\352\251C\257UQ|\231\353\276o\23 No. Time Source Destination Protocol Info 3599 76.618975 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3599 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.234437000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 76.618975000 seconds] Frame Number: 3599 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x063b (1595) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xec22 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2584153, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2584153 (relative sequence number) [Next sequence number: 2585521 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x45d6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593808 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \323\257\325*\277Z\267\325l\315}P\346\244\234\222\341\211\aM\0057\367z O1\251\223}[\357}Z\271\262\363~\373\377\247V\000G\367t\345G2Z[^\334\311\254_\345\001hQU\225\315\372\225\363\315\260\331\346\366j\225[f\371\023\31 No. Time Source Destination Protocol Info 3600 76.620339 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2571841 Win=87552 Len=0 TSV=60593808 TSER=987608871 Frame 3600 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.235801000 [Time delta from previous captured frame: 0.001364000 seconds] [Time delta from previous displayed frame: 0.001364000 seconds] [Time since reference or first frame: 76.620339000 seconds] Frame Number: 3600 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aeb (19179) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ca [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2571841, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2571841 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc5d3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593808, TSecr 987608871 No. Time Source Destination Protocol Info 3601 76.620362 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3601 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.235824000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 76.620362000 seconds] Frame Number: 3601 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x482c (18476) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xaa31 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2585521, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2585521 (relative sequence number) [Next sequence number: 2586889 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8046 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593808 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3600] [The RTT to ACK the segment was: 0.000023000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: g<\267E\377\337KK~. \037\367c\231\214\331$wUX\216\326)\352/\367\247\202\030\036\226\t\267\364\377\363o\033\r\340wTs\275k\00656\255~\2716\304g\365\307X'\252\350\235\177y\374\237^\252\275U\002\235\357\326\225V\250\270\0 No. Time Source Destination Protocol Info 3602 76.620370 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3602 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.235832000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.620370000 seconds] Frame Number: 3602 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbf3b (48955) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3322 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2586889, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2586889 (relative sequence number) [Next sequence number: 2588257 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc87d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593808 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \270\3216\357_\246\235k\37693\320\224-\316\315\335\337M\275\267\355\354\366lz\362\365x\336\334,\341\367\aT\030\234C\201O\321\272\024\300!d\332\255\337\377\306\325\377\223\304\035\301\311\343\365\233"xD\034\250\333\201 No. Time Source Destination Protocol Info 3603 76.688516 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2573209 Win=87552 Len=0 TSV=60593816 TSER=987608872 Frame 3603 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.303978000 [Time delta from previous captured frame: 0.068146000 seconds] [Time delta from previous displayed frame: 0.068146000 seconds] [Time since reference or first frame: 76.688516000 seconds] Frame Number: 3603 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aec (19180) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3c9 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2573209, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2573209 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc072 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593816, TSecr 987608872 No. Time Source Destination Protocol Info 3604 76.688564 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3604 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.304026000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 76.688564000 seconds] Frame Number: 3604 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x324d (12877) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc010 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2588257, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2588257 (relative sequence number) [Next sequence number: 2589625 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8907 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608875, TSecr 60593816 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3603] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \275I+M*\301d\376\320\267\036\356K\210y\314\371\374?\374[j^\373\317\332\242\b\327\214w\370F\200R\203q\330\352\354\341\342\244\003X\346\033\203(\025]6\264\272\343\237\345\207\016\260\236|\336\376\277ty\370\210.v\365\22 No. Time Source Destination Protocol Info 3605 76.858807 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2575945 Win=87552 Len=0 TSV=60593820 TSER=987608875 Frame 3605 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.474269000 [Time delta from previous captured frame: 0.170243000 seconds] [Time delta from previous displayed frame: 0.170243000 seconds] [Time since reference or first frame: 76.858807000 seconds] Frame Number: 3605 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aed (19181) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3c8 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2575945, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2575945 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb5bb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593820, TSecr 987608875 No. Time Source Destination Protocol Info 3606 76.858849 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3606 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.474311000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 76.858849000 seconds] Frame Number: 3606 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4115 (16661) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb148 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2589625, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2589625 (relative sequence number) [Next sequence number: 2590993 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x529d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608877, TSecr 60593820 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3605] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \212'\023\240\365\204\302\247\017\006\237*u\tqVN\2510\264\034\344\303\256\252k|\226\265\252\337SUr\341lH\f\005|\260\357F\341\354\vw\234\3410\310G\034\315\335\242\017\235\304\344P!\312\364\306d\337\215\242\347\000\251\ No. Time Source Destination Protocol Info 3607 76.858857 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3607 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.474319000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 76.858857000 seconds] Frame Number: 3607 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9657 (38487) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5c06 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2590993, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2590993 (relative sequence number) [Next sequence number: 2592361 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x761c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608877, TSecr 60593820 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: w.\253\316\302{\336\265\333\004q\237u\033{\270Bn\262\355\323J\367\314Od\253N\a\357\266\313&\0228\270\000\000\001\210!\000\341\341\t\005\306,\020\360V$\327\263|$$)wj|ft\256\357\353\2323\252T\256\357\212\323{\346\031\37 No. Time Source Destination Protocol Info 3608 76.859739 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593826 TSER=987608875 Frame 3608 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.475201000 [Time delta from previous captured frame: 0.000882000 seconds] [Time delta from previous displayed frame: 0.000882000 seconds] [Time since reference or first frame: 76.859739000 seconds] Frame Number: 3608 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aee (19182) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3c7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xab05 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593826, TSecr 987608875 No. Time Source Destination Protocol Info 3609 76.859753 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3609 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.475215000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 76.859753000 seconds] Frame Number: 3609 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8d43 (36163) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x651a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2592361, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2592361 (relative sequence number) [Next sequence number: 2593729 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x35a0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608877, TSecr 60593826 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3608] [The RTT to ACK the segment was: 0.000014000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \221t4#\255u'U\370\223\n\264{YU\366\022\354uj\341\300\227~5\370\354\312\272\250\252\252\340\247\025\257G\351%\207\302\374>\027\341\320\371x\272\360\217\235j}\370-&\357\365\253\200\000\000\001\237!\000 \336\020\220\f\0 No. Time Source Destination Protocol Info 3610 76.859759 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3610 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.475221000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 76.859759000 seconds] Frame Number: 3610 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2917 (10519) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc946 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2593729, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2593729 (relative sequence number) [Next sequence number: 2595097 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2e24 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608877, TSecr 60593826 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000K* X.0S\n\032B\017\353\324\302#\244b\253\324\316\345sl\312p\276\351\256WS\225AE6\237\273XD\315\255o\330\261\324\310\031\344\352\264`\314\214\204\246Rm\0321\256\334\020\351\246\360S\224e\337n\275\313\002\340\243W\0 No. Time Source Destination Protocol Info 3611 76.860549 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#1] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593829 TSER=987608875 SLE=2582785 SRE=2584153 Frame 3611 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.476011000 [Time delta from previous captured frame: 0.000790000 seconds] [Time delta from previous displayed frame: 0.000790000 seconds] [Time since reference or first frame: 76.860549000 seconds] Frame Number: 3611 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4aef (19183) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ba [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xedb2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593829, TSecr 987608875 NOP NOP SACK: 2582785-2584153 left edge = 2582785 (relative) right edge = 2584153 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3612 76.869375 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#2] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593832 TSER=987608875 SLE=2582785 SRE=2585521 Frame 3612 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.484837000 [Time delta from previous captured frame: 0.008826000 seconds] [Time delta from previous displayed frame: 0.008826000 seconds] [Time since reference or first frame: 76.869375000 seconds] Frame Number: 3612 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af0 (19184) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b9 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe857 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593832, TSecr 987608875 NOP NOP SACK: 2582785-2585521 left edge = 2582785 (relative) right edge = 2585521 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#2)] [Message: Duplicate ACK (#2)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3613 76.869411 89.223.234.248 x.x.x.x FTP-DATA [TCP Fast Retransmission] FTP Data: 1368 bytes Frame 3613 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.484873000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 76.869411000 seconds] Frame Number: 3613 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8f3f (36671) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x631e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2578681, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2578681 (relative sequence number) [Next sequence number: 2580049 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x90 (ACK, CWR) 1... .... = Congestion Window Reduced (CWR): Set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb9cd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608877, TSecr 60593832 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3611] [The RTT to ACK the segment was: 0.008862000 seconds] [Number of bytes in flight: 16416] [TCP Analysis Flags] [This frame is a (suspected) fast retransmission] [Expert Info (Warn/Sequence): Fast retransmission (suspected)] [Message: Fast retransmission (suspected)] [Severity level: Warn] [Group: Sequence] [This frame is a (suspected) retransmission] FTP Data [truncated] FTP Data: \036dl\212^\362>DY\177\360EU\375\ba\031\312l\377\376\177\263@\211\212\335\222\264\347\326\333K\016\344\274\032\245\237\313\312\201a\354\326\000\202G\353\236r]\334\315Pb,1OI\3126\005\037\330\031\326\237\232Hzm\261KX\21 No. Time Source Destination Protocol Info 3614 76.928465 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#3] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593835 TSER=987608875 SLE=2582785 SRE=2586889 Frame 3614 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.543927000 [Time delta from previous captured frame: 0.059054000 seconds] [Time delta from previous displayed frame: 0.059054000 seconds] [Time since reference or first frame: 76.928465000 seconds] Frame Number: 3614 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af1 (19185) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b8 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe2fc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593835, TSecr 987608875 NOP NOP SACK: 2582785-2586889 left edge = 2582785 (relative) right edge = 2586889 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#3)] [Message: Duplicate ACK (#3)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3615 76.929288 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#4] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593838 TSER=987608875 SLE=2582785 SRE=2588257 Frame 3615 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.544750000 [Time delta from previous captured frame: 0.000823000 seconds] [Time delta from previous displayed frame: 0.000823000 seconds] [Time since reference or first frame: 76.929288000 seconds] Frame Number: 3615 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af2 (19186) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xdda1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593838, TSecr 987608875 NOP NOP SACK: 2582785-2588257 left edge = 2582785 (relative) right edge = 2588257 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#4)] [Message: Duplicate ACK (#4)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3616 76.948754 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#5] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593841 TSER=987608875 SLE=2582785 SRE=2589625 Frame 3616 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.564216000 [Time delta from previous captured frame: 0.019466000 seconds] [Time delta from previous displayed frame: 0.019466000 seconds] [Time since reference or first frame: 76.948754000 seconds] Frame Number: 3616 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af3 (19187) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b6 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd846 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593841, TSecr 987608875 NOP NOP SACK: 2582785-2589625 left edge = 2582785 (relative) right edge = 2589625 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 5] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#5)] [Message: Duplicate ACK (#5)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3617 76.948788 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3617 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.564250000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 76.948788000 seconds] Frame Number: 3617 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4c57 (19543) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa606 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2580049, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2580049 (relative sequence number) [Next sequence number: 2581417 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcef7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608878, TSecr 60593841 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3614] [The RTT to ACK the segment was: 0.020323000 seconds] [Number of bytes in flight: 16416] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.089029000 seconds] [RTO based on delta from frame: 3610] FTP Data [truncated] FTP Data: \3656z~}\343\313\323}\357w\230\363\211\317\240wJ;a\260\236\245\375S\337\006\331\241\213j\354&\320O\021\205=AL\346\372\233\333\216u\v\252\235{\205\207\302!\006\254\225\213\336\373\340\253)\255\004;\177"\375\202+\332\31 No. Time Source Destination Protocol Info 3618 76.978628 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#6] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593844 TSER=987608875 SLE=2582785 SRE=2590993 Frame 3618 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.594090000 [Time delta from previous captured frame: 0.029840000 seconds] [Time delta from previous displayed frame: 0.029840000 seconds] [Time since reference or first frame: 76.978628000 seconds] Frame Number: 3618 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af4 (19188) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b5 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd2eb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593844, TSecr 987608875 NOP NOP SACK: 2582785-2590993 left edge = 2582785 (relative) right edge = 2590993 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 6] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#6)] [Message: Duplicate ACK (#6)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3619 76.978659 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3619 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.594121000 [Time delta from previous captured frame: 0.000031000 seconds] [Time delta from previous displayed frame: 0.000031000 seconds] [Time since reference or first frame: 76.978659000 seconds] Frame Number: 3619 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4566 (17766) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xacf7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2581417, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2581417 (relative sequence number) [Next sequence number: 2582785 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9f4c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608878, TSecr 60593844 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3618] [The RTT to ACK the segment was: 0.000031000 seconds] [Number of bytes in flight: 16416] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.118900000 seconds] [RTO based on delta from frame: 3610] FTP Data [truncated] FTP Data: \264\367\272_\241\214\022<\307\367\257\377M\364\321\3343\204\373\033\376\277\277\333\247#\364\350\253\363\320{\336gT\245z\327\005=\226\234\275\235\rU\v\252\274l!\265\353\244l\263\255\333o\350\212\235\t\260E\223h\332\3 No. Time Source Destination Protocol Info 3620 77.008401 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#7] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593847 TSER=987608875 SLE=2582785 SRE=2592361 Frame 3620 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.623863000 [Time delta from previous captured frame: 0.029742000 seconds] [Time delta from previous displayed frame: 0.029742000 seconds] [Time since reference or first frame: 77.008401000 seconds] Frame Number: 3620 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af5 (19189) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b4 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xcd90 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593847, TSecr 987608875 NOP NOP SACK: 2582785-2592361 left edge = 2582785 (relative) right edge = 2592361 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 7] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#7)] [Message: Duplicate ACK (#7)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3621 77.008440 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3621 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.623902000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 77.008440000 seconds] Frame Number: 3621 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2719 (10009) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcb44 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2595097, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2595097 (relative sequence number) [Next sequence number: 2596465 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2148 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608879, TSecr 60593847 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3620] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \177\373\216\t\205*)\342;f\332\217\266\301\377IO~\316$5=\006\270\203\202\332b\274\337\345\305\216W:\036\275\b\363^\374\343\270W\310\301e3\370\030(\362 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593850 TSER=987608875 SLE=2582785 SRE=2593729 Frame 3622 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.653988000 [Time delta from previous captured frame: 0.030086000 seconds] [Time delta from previous displayed frame: 0.030086000 seconds] [Time since reference or first frame: 77.038526000 seconds] Frame Number: 3622 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af6 (19190) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b3 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc835 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593850, TSecr 987608875 NOP NOP SACK: 2582785-2593729 left edge = 2582785 (relative) right edge = 2593729 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 8] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#8)] [Message: Duplicate ACK (#8)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3623 77.038568 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3623 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.654030000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 77.038568000 seconds] Frame Number: 3623 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe25c (57948) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1001 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2596465, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2596465 (relative sequence number) [Next sequence number: 2597833 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7172 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608879, TSecr 60593850 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3622] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \271\267r\3762\\177\017x;\005\263a\277r\355{\320!\335\\365\342\tw\3631]\263\345\357\266\373\257\256RpQ\226/^'\375\342xgS\035_\356\357\355T\344\367\321\343}sU5\226\265\026\327\271\310\b\357\177] [}\355?.\230(\245\255\3 No. Time Source Destination Protocol Info 3624 77.088470 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3608#9] 38691 > 52904 [ACK] Seq=1 Ack=2578681 Win=87552 Len=0 TSV=60593853 TSER=987608875 SLE=2582785 SRE=2595097 Frame 3624 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.703932000 [Time delta from previous captured frame: 0.049902000 seconds] [Time delta from previous displayed frame: 0.049902000 seconds] [Time since reference or first frame: 77.088470000 seconds] Frame Number: 3624 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af7 (19191) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b2 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2578681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2578681 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc2da [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593853, TSecr 987608875 NOP NOP SACK: 2582785-2595097 left edge = 2582785 (relative) right edge = 2595097 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 9] [Duplicate to the ACK in frame: 3608] [Expert Info (Note/Sequence): Duplicate ACK (#9)] [Message: Duplicate ACK (#9)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3625 77.088514 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3625 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.703976000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 77.088514000 seconds] Frame Number: 3625 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6331 (25393) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8f2c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2597833, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2597833 (relative sequence number) [Next sequence number: 2599201 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xefc7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608879, TSecr 60593853 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3624] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3626 77.098357 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2580049 Win=86208 Len=0 TSV=60593856 TSER=987608877 SLE=2582785 SRE=2595097 Frame 3626 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.713819000 [Time delta from previous captured frame: 0.009843000 seconds] [Time delta from previous displayed frame: 0.009843000 seconds] [Time since reference or first frame: 77.098357000 seconds] Frame Number: 3626 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af8 (19192) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b1 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2580049, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2580049 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 86208 (scaled) Checksum: 0xbd92 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593856, TSecr 987608877 NOP NOP SACK: 2582785-2595097 left edge = 2582785 (relative) right edge = 2595097 (relative) No. Time Source Destination Protocol Info 3627 77.098392 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3627 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.713854000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 77.098392000 seconds] Frame Number: 3627 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x382c (14380) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xba31 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2599201, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2599201 (relative sequence number) [Next sequence number: 2600569 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xea6c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608879, TSecr 60593856 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3626] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3628 77.128642 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2581417 Win=84864 Len=0 TSV=60593859 TSER=987608878 SLE=2582785 SRE=2595097 Frame 3628 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:30.744104000 [Time delta from previous captured frame: 0.030250000 seconds] [Time delta from previous displayed frame: 0.030250000 seconds] [Time since reference or first frame: 77.128642000 seconds] Frame Number: 3628 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4af9 (19193) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b0 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2581417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2581417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 84864 (scaled) Checksum: 0xb84b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60593859, TSecr 987608878 NOP NOP SACK: 2582785-2595097 left edge = 2582785 (relative) right edge = 2595097 (relative) No. Time Source Destination Protocol Info 3629 77.128675 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3629 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.744137000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 77.128675000 seconds] Frame Number: 3629 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5f75 (24437) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x92e8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2600569, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2600569 (relative sequence number) [Next sequence number: 2601937 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6b08 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608880, TSecr 60593859 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3628] [The RTT to ACK the segment was: 0.000033000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3630 77.158695 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2595097 Win=80000 Len=0 TSV=60593862 TSER=987608878 Frame 3630 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.774157000 [Time delta from previous captured frame: 0.030020000 seconds] [Time delta from previous displayed frame: 0.030020000 seconds] [Time since reference or first frame: 77.158695000 seconds] Frame Number: 3630 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4afa (19194) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3bb [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2595097, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2595097 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 80000 (scaled) Checksum: 0x6b34 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593862, TSecr 987608878 No. Time Source Destination Protocol Info 3631 77.158748 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3631 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.774210000 [Time delta from previous captured frame: 0.000053000 seconds] [Time delta from previous displayed frame: 0.000053000 seconds] [Time since reference or first frame: 77.158748000 seconds] Frame Number: 3631 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0970 (2416) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe8ed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2601937, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2601937 (relative sequence number) [Next sequence number: 2603305 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x00e3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608880, TSecr 60593862 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3630] [The RTT to ACK the segment was: 0.000053000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \200o\037S\316,6>\003\232ge>A\252T\003Z;\213\035\337\374\243\237\036\r\r:EB\370@f\347\264\233%\031\342@\303M\020\367\215Z\311)\223Z\213\005\317 \364\353\330\251\033p\002\255\254\202\331\322}\365\202\363\273\230\206>\2 No. Time Source Destination Protocol Info 3632 77.159215 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3632 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.774677000 [Time delta from previous captured frame: 0.000467000 seconds] [Time delta from previous displayed frame: 0.000467000 seconds] [Time since reference or first frame: 77.159215000 seconds] Frame Number: 3632 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x322e (12846) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc02f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2603305, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2603305 (relative sequence number) [Next sequence number: 2604673 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x98cd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608880, TSecr 60593862 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \323\324u_T[e\246GlW\f\026K\017N\231\2546\225\357\347SU\237\004\227\036\023\236gM\020\311\216M\307\253\006a2V\222S\313\t\320\374G!\f\0245\232\231\bf\002\225\337\021RJ\214\230T\224\250\267\rK\205\354\030\222\343u8\353! No. Time Source Destination Protocol Info 3633 77.189669 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2596465 Win=87552 Len=0 TSV=60593865 TSER=987608879 Frame 3633 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.805131000 [Time delta from previous captured frame: 0.030454000 seconds] [Time delta from previous displayed frame: 0.030454000 seconds] [Time since reference or first frame: 77.189669000 seconds] Frame Number: 3633 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4afb (19195) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ba [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2596465, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2596465 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6562 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593865, TSecr 987608879 No. Time Source Destination Protocol Info 3634 77.189714 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3634 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.805176000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 77.189714000 seconds] Frame Number: 3634 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3a56 (14934) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb807 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2604673, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2604673 (relative sequence number) [Next sequence number: 2606041 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x966a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608880, TSecr 60593865 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3633] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \205 52904 [ACK] Seq=1 Ack=2597833 Win=87552 Len=0 TSV=60593868 TSER=987608879 Frame 3635 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.864849000 [Time delta from previous captured frame: 0.059673000 seconds] [Time delta from previous displayed frame: 0.059673000 seconds] [Time since reference or first frame: 77.249387000 seconds] Frame Number: 3635 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4afc (19196) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b9 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2597833, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2597833 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6007 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593868, TSecr 987608879 No. Time Source Destination Protocol Info 3636 77.249434 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3636 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.864896000 [Time delta from previous captured frame: 0.000047000 seconds] [Time delta from previous displayed frame: 0.000047000 seconds] [Time since reference or first frame: 77.249434000 seconds] Frame Number: 3636 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfb1d (64285) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf73f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2606041, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2606041 (relative sequence number) [Next sequence number: 2607409 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa227 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608881, TSecr 60593868 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3635] [The RTT to ACK the segment was: 0.000047000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \223jNR\252\221\253\245z\023b\340\240$l\320\031m\247|\263\324!,\334\332;/\233\204kx\2579\032\v\237\220f\226\326\276\177\312\362\023wW\370\330\262\273Ju\333:\\33567r\315\216\256\306\v\236\f9\005?4t\222z\3224\254\244'\3 No. Time Source Destination Protocol Info 3637 77.250135 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2599201 Win=87552 Len=0 TSV=60593871 TSER=987608879 Frame 3637 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.865597000 [Time delta from previous captured frame: 0.000701000 seconds] [Time delta from previous displayed frame: 0.000701000 seconds] [Time since reference or first frame: 77.250135000 seconds] Frame Number: 3637 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4afd (19197) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b8 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2599201, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2599201 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5aac [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593871, TSecr 987608879 No. Time Source Destination Protocol Info 3638 77.250152 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3638 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.865614000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 77.250152000 seconds] Frame Number: 3638 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7508 (29960) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7d55 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2607409, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2607409 (relative sequence number) [Next sequence number: 2608777 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xca4b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608881, TSecr 60593871 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3637] [The RTT to ACK the segment was: 0.000017000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3639 77.278502 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2600569 Win=87552 Len=0 TSV=60593874 TSER=987608879 Frame 3639 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.893964000 [Time delta from previous captured frame: 0.028350000 seconds] [Time delta from previous displayed frame: 0.028350000 seconds] [Time since reference or first frame: 77.278502000 seconds] Frame Number: 3639 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4afe (19198) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2600569, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2600569 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5551 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593874, TSecr 987608879 No. Time Source Destination Protocol Info 3640 77.278561 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3640 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.894023000 [Time delta from previous captured frame: 0.000059000 seconds] [Time delta from previous displayed frame: 0.000059000 seconds] [Time since reference or first frame: 77.278561000 seconds] Frame Number: 3640 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8f19 (36633) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6344 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2608777, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2608777 (relative sequence number) [Next sequence number: 2610145 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3559 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608881, TSecr 60593874 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3639] [The RTT to ACK the segment was: 0.000059000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3641 77.278573 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3641 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.894035000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 77.278573000 seconds] Frame Number: 3641 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0420 (1056) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xee3d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2610145, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2610145 (relative sequence number) [Next sequence number: 2611513 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8612 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608881, TSecr 60593874 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: D\342\356\v\320\271\276\t\356\373\277\226\314\301$\370\377j@[\274\274V\377`\000\000\000\220\001\000p\2520\330.2\220\265y\244\273\365{\210%\337\272=v\233\364\357O\n(\2351\273\202\r\304\355\225zU\333]\026\t;F\307\322t\2 No. Time Source Destination Protocol Info 3642 77.308335 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2601937 Win=87552 Len=0 TSV=60593877 TSER=987608880 Frame 3642 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.923797000 [Time delta from previous captured frame: 0.029762000 seconds] [Time delta from previous displayed frame: 0.029762000 seconds] [Time since reference or first frame: 77.308335000 seconds] Frame Number: 3642 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4aff (19199) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b6 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2601937, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2601937 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4ff5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593877, TSecr 987608880 No. Time Source Destination Protocol Info 3643 77.308376 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3643 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.923838000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 77.308376000 seconds] Frame Number: 3643 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3157 (12631) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc106 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2611513, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2611513 (relative sequence number) [Next sequence number: 2612881 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa4ac [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608882, TSecr 60593877 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3642] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \375b\276\263;\263hM@\b\215Ca\355\264\263\316\a\225R\221\345\342\351\323w\226\266|fy\366\333\341Y{\267\323\333Z\362^\020\002H\231\376\307y\377\276\377\377K\375\370!\017\214\275\336\356U.\356\356}\2106T\340\330tE\227v3 No. Time Source Destination Protocol Info 3644 77.368560 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2603305 Win=87552 Len=0 TSV=60593880 TSER=987608880 Frame 3644 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.984022000 [Time delta from previous captured frame: 0.060184000 seconds] [Time delta from previous displayed frame: 0.060184000 seconds] [Time since reference or first frame: 77.368560000 seconds] Frame Number: 3644 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b00 (19200) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b5 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2603305, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2603305 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4a9a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593880, TSecr 987608880 No. Time Source Destination Protocol Info 3645 77.368603 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3645 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.984065000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 77.368603000 seconds] Frame Number: 3645 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4c49 (19529) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa614 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2612881, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2612881 (relative sequence number) [Next sequence number: 2614249 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0b8f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608882, TSecr 60593880 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3644] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \003\002\357|P\376\027\024L\016<\262\211/Bk\263\307\205\342\016E\370L\036\256\270\225\312@[Z\244[\245\277\306V\024T\341\243w\371\356?\024\276\250\277\305b\324\371T\271\220\230\254Wt\237\305\210\021w\025\335\245\254\02 No. Time Source Destination Protocol Info 3646 77.369358 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2604673 Win=87552 Len=0 TSV=60593883 TSER=987608880 Frame 3646 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:30.984820000 [Time delta from previous captured frame: 0.000755000 seconds] [Time delta from previous displayed frame: 0.000755000 seconds] [Time since reference or first frame: 77.369358000 seconds] Frame Number: 3646 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b01 (19201) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b4 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2604673, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2604673 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x453f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593883, TSecr 987608880 No. Time Source Destination Protocol Info 3647 77.369372 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3647 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:30.984834000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 77.369372000 seconds] Frame Number: 3647 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2242 (8770) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd01b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2614249, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2614249 (relative sequence number) [Next sequence number: 2615617 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2c09 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608882, TSecr 60593883 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3646] [The RTT to ACK the segment was: 0.000014000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: rYs\343\302"\344\225\305x\037\352\353\360Q{\2509\356#^\273\216\233\226\315\337\367y\361\024\354(\257\020\177>\224\372D\270\235\357/\276 \275\v\354\\220\240s\306\222\357\362p\241;`\216\357\327\031\005\235\336\356\357\2 No. Time Source Destination Protocol Info 3648 77.398420 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2606041 Win=87552 Len=0 TSV=60593886 TSER=987608880 Frame 3648 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.013882000 [Time delta from previous captured frame: 0.029048000 seconds] [Time delta from previous displayed frame: 0.029048000 seconds] [Time since reference or first frame: 77.398420000 seconds] Frame Number: 3648 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b02 (19202) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b3 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2606041, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2606041 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3fe4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593886, TSecr 987608880 No. Time Source Destination Protocol Info 3649 77.398461 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3649 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.013923000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 77.398461000 seconds] Frame Number: 3649 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5559 (21849) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9d04 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2615617, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2615617 (relative sequence number) [Next sequence number: 2616985 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd95b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608882, TSecr 60593886 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3648] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \334\302.\223\356\357\v\272LbH$j\247Y\005\036\b\r?S\376\220\222\336\361\n>\024]\275e\200\000\000\000\352\001\000\226\251\005`\270\312\030\025&\367\315{\272u\261F\021\227\334\266\357\262,\206,\242\255\253\323\251\274e\ No. Time Source Destination Protocol Info 3650 77.428544 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2607409 Win=87552 Len=0 TSV=60593889 TSER=987608881 Frame 3650 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.044006000 [Time delta from previous captured frame: 0.030083000 seconds] [Time delta from previous displayed frame: 0.030083000 seconds] [Time since reference or first frame: 77.428544000 seconds] Frame Number: 3650 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b03 (19203) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b2 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2607409, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2607409 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3a88 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593889, TSecr 987608881 No. Time Source Destination Protocol Info 3651 77.428584 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3651 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.044046000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 77.428584000 seconds] Frame Number: 3651 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4a43 (19011) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa81a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2616985, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2616985 (relative sequence number) [Next sequence number: 2618353 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3ef7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608883, TSecr 60593889 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3650] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \3026\314\373\356^\360\246\f\246\276\232\177\376o\205\315\025\212\355f(\212\252\300\375)\0202\306\271\273pUv\000D\004\220\000*T\223$\221\316\273#q\017n9\306\205\304uZ\257\004g\340\267\337\377\377\372\375k\377\374!\005 No. Time Source Destination Protocol Info 3652 77.458268 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2608777 Win=87552 Len=0 TSV=60593892 TSER=987608881 Frame 3652 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.073730000 [Time delta from previous captured frame: 0.029684000 seconds] [Time delta from previous displayed frame: 0.029684000 seconds] [Time since reference or first frame: 77.458268000 seconds] Frame Number: 3652 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b04 (19204) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b1 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2608777, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2608777 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x352d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593892, TSecr 987608881 No. Time Source Destination Protocol Info 3653 77.458307 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3653 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.073769000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 77.458307000 seconds] Frame Number: 3653 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9f53 (40787) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x530a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2618353, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2618353 (relative sequence number) [Next sequence number: 2619721 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xea52 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608883, TSecr 60593892 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3652] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \214\021\023\2410\266zA\026\213\217\317PU\n\217_\275\252M\247\037\305\016\212\365Q\225\236\345"\341o\304\337\367\353T\257\340\212\367\275l\021\327|\273\204i\242\277\033\305\253\351\202\035\277\225pQ\325;\276S\v\375%\2 No. Time Source Destination Protocol Info 3654 77.530385 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2610145 Win=87552 Len=0 TSV=60593895 TSER=987608881 Frame 3654 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.145847000 [Time delta from previous captured frame: 0.072078000 seconds] [Time delta from previous displayed frame: 0.072078000 seconds] [Time since reference or first frame: 77.530385000 seconds] Frame Number: 3654 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b05 (19205) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3b0 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2610145, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2610145 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2fd2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593895, TSecr 987608881 No. Time Source Destination Protocol Info 3655 77.530431 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3655 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.145893000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 77.530431000 seconds] Frame Number: 3655 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2023 (8227) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd23a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2619721, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2619721 (relative sequence number) [Next sequence number: 2621089 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb3c2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608884, TSecr 60593895 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3654] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 27360] FTP Data [truncated] FTP Data: \232\241\357\351\026=\024e\346\303flR\351\264\333K\367\b\365I\317\211\366\352\226\330\313Pi\374\253v\352[\327U\370\212q%\335\364\326\2524}Nu\227\v\231\327}A7ww\\\214\025kt\2567\212\365}\373\214\237\337,\330\223/3-\271 No. Time Source Destination Protocol Info 3656 77.531287 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2611513 Win=87552 Len=0 TSV=60593898 TSER=987608881 Frame 3656 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.146749000 [Time delta from previous captured frame: 0.000856000 seconds] [Time delta from previous displayed frame: 0.000856000 seconds] [Time since reference or first frame: 77.531287000 seconds] Frame Number: 3656 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b06 (19206) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3af [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2611513, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2611513 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2a77 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593898, TSecr 987608881 No. Time Source Destination Protocol Info 3657 77.531311 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3657 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.146773000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.000024000 seconds] [Time since reference or first frame: 77.531311000 seconds] Frame Number: 3657 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5766 (22374) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9af7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2621089, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2621089 (relative sequence number) [Next sequence number: 2622457 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6596 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608884, TSecr 60593898 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3656] [The RTT to ACK the segment was: 0.000024000 seconds] [Number of bytes in flight: 28728] FTP Data [truncated] FTP Data: \212L\031f\347\207\333\271\340y\341\364[^\243\261\247\323\341\266Y\247\377m{\377x\016\034\315!\205\242\a\353\025\255\273\375Fi\346\223\342O&Vr\244\rOsZ\276\332\325w\370\320\360\322\210=G\237-\367~\235\364\245`0?\217\2 No. Time Source Destination Protocol Info 3658 77.531319 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3658 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.146781000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 77.531319000 seconds] Frame Number: 3658 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5626 (22054) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9c37 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2622457, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2622457 (relative sequence number) [Next sequence number: 2623825 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x743c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608884, TSecr 60593898 [SEQ/ACK analysis] [Number of bytes in flight: 30096] FTP Data [truncated] FTP Data: \365t\021\276x\364J\232\202\254\276\364\376\233t\305\0234\373\004\375%\325\302\n\022\330f\317\247\351\377\217\230\001\234\325R\245.j\264\3049\v+\024\267\255M\231(\210\n\b\235\371\272g\2149\251\227\006\227?\301\333+A\2 No. Time Source Destination Protocol Info 3659 77.609207 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2614249 Win=87552 Len=0 TSV=60593904 TSER=987608882 Frame 3659 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.224669000 [Time delta from previous captured frame: 0.077888000 seconds] [Time delta from previous displayed frame: 0.077888000 seconds] [Time since reference or first frame: 77.609207000 seconds] Frame Number: 3659 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b07 (19207) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ae [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2614249, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2614249 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x1fc0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593904, TSecr 987608882 No. Time Source Destination Protocol Info 3660 77.609251 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3660 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.224713000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 77.609251000 seconds] Frame Number: 3660 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd030 (53296) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x222d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2623825, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2623825 (relative sequence number) [Next sequence number: 2625193 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe03c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608885, TSecr 60593904 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3659] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \251+#\177\345D\250\345\3655\270\b( 52904 [ACK] Seq=1 Ack=2616985 Win=87552 Len=0 TSV=60593910 TSER=987608882 Frame 3662 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.253930000 [Time delta from previous captured frame: 0.029209000 seconds] [Time delta from previous displayed frame: 0.029209000 seconds] [Time since reference or first frame: 77.638468000 seconds] Frame Number: 3662 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b08 (19208) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ad [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2616985, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2616985 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x150a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593910, TSecr 987608882 No. Time Source Destination Protocol Info 3663 77.638519 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3663 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.253981000 [Time delta from previous captured frame: 0.000051000 seconds] [Time delta from previous displayed frame: 0.000051000 seconds] [Time since reference or first frame: 77.638519000 seconds] Frame Number: 3663 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa224 (41508) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5039 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2626561, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2626561 (relative sequence number) [Next sequence number: 2627929 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7df1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608885, TSecr 60593910 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3662] [The RTT to ACK the segment was: 0.000051000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \330\223\317\376[\f\306\373?\352\263\032\361\350\330a\017\343\307\307WnG\000\b/8z\023\274k[\030\202\255\323\242O<"\270\274_\370\374\325\026\\203\245\362\315kO\017\250\307\377\252\227\302u\375\311\211\032\037i\357.~!\3 No. Time Source Destination Protocol Info 3664 77.638528 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3664 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.253990000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 77.638528000 seconds] Frame Number: 3664 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8506 (34054) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6d57 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2627929, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2627929 (relative sequence number) [Next sequence number: 2629297 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd0ae [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608885, TSecr 60593910 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \aW\302\331\321\214A/\361(\200\377N\357>\240\361\376\342\353mk\364k)\377\022\327\236\232*\225p\264]u\027\330\204\360\b\331L@z\236\2354\377z7\357\177\006\204\036.+\020\342}\341AZG9\027n7q?\254O\311\207\374\304\222M\301 No. Time Source Destination Protocol Info 3665 77.728501 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2619721 Win=87552 Len=0 TSV=60593916 TSER=987608883 Frame 3665 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.343963000 [Time delta from previous captured frame: 0.089973000 seconds] [Time delta from previous displayed frame: 0.089973000 seconds] [Time since reference or first frame: 77.728501000 seconds] Frame Number: 3665 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b09 (19209) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ac [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2619721, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2619721 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0a53 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593916, TSecr 987608883 No. Time Source Destination Protocol Info 3666 77.728539 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3666 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.344001000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 77.728539000 seconds] Frame Number: 3666 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x106c (4204) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe1f1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2629297, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2629297 (relative sequence number) [Next sequence number: 2630665 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x041d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608886, TSecr 60593916 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3665] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \366\375]\355W\205\025\363A\237\303\266T\354/\251x\276;\033W}\362\237\236\251\034\227\250\274\330.\027\254\365_q\252\030U\341\370\004<\335y}\334@\367\322.]\304\233\373\234\017\360\242\242\261^+\333\273\273\277\377o\32 No. Time Source Destination Protocol Info 3667 77.728545 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3667 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.344007000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 77.728545000 seconds] Frame Number: 3667 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa312 (41746) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4f4b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2630665, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2630665 (relative sequence number) [Next sequence number: 2632033 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x821f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608886, TSecr 60593916 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: %\331[\267\327\206\265)\307\304\3529\036\242\347\327\212\353\365UZ\255\3376M\335\213\351bZ3\315+SF*\364\v\367OV\240\3030\2222\233\343\274s\361\336\360\221H\211\334\262\r\365\326\247\303p\261\3065\020c\027\246\330\217g No. Time Source Destination Protocol Info 3668 77.758694 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2622457 Win=87552 Len=0 TSV=60593922 TSER=987608884 Frame 3668 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.374156000 [Time delta from previous captured frame: 0.030149000 seconds] [Time delta from previous displayed frame: 0.030149000 seconds] [Time since reference or first frame: 77.758694000 seconds] Frame Number: 3668 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0a (19210) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3ab [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2622457, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2622457 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xff9b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593922, TSecr 987608884 No. Time Source Destination Protocol Info 3669 77.758744 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3669 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.374206000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 77.758744000 seconds] Frame Number: 3669 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8231 (33329) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x702c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2632033, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2632033 (relative sequence number) [Next sequence number: 2633401 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xbcc8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608886, TSecr 60593922 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3668] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \023\302Q[\033\256\251\3452\245\016G\255B8*z\325C \225_\230\301H|Tv\222\253\023\331]K\a\024\031\375j\370\000\000\002"!\000\226\341\t\005\306`N\006\204\305\337\377\021\252\325k\217\v\016\255T\P\325E\325y\207\f\213\213\ No. Time Source Destination Protocol Info 3670 77.758754 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3670 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.374216000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 77.758754000 seconds] Frame Number: 3670 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfd3c (64828) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf520 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2633401, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2633401 (relative sequence number) [Next sequence number: 2634769 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd2dd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608886, TSecr 60593922 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \332\211\363\276\337\245\356\325N\177)*\276}m[\235^\215\317\3272%\337\347\351\002K\273\373\231sEwn*\365\005\376\fw7\320\373\336\321\362\361\017\264&c\337&oo\263o\025\226\216\275\311\027\254g\313m\037d,\236\377v`O+\023 No. Time Source Destination Protocol Info 3671 77.818771 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2625193 Win=87552 Len=0 TSV=60593928 TSER=987608884 Frame 3671 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.434233000 [Time delta from previous captured frame: 0.060017000 seconds] [Time delta from previous displayed frame: 0.060017000 seconds] [Time since reference or first frame: 77.818771000 seconds] Frame Number: 3671 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0b (19211) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3aa [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2625193, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2625193 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf4e5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593928, TSecr 987608884 No. Time Source Destination Protocol Info 3672 77.818821 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3672 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.434283000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 77.818821000 seconds] Frame Number: 3672 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x762c (30252) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7c31 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2634769, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2634769 (relative sequence number) [Next sequence number: 2636137 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0a97 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608887, TSecr 60593928 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3671] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \362\242\345V\253\222\033\v\a\a\311\305\\247\307\023/\373T^\374\267m\253P\206\207i\026\t\266\246\202[\314\r\224\2163c\351\313\264\251\320g'\314Y\363\374/\317K\355+\263\374q#\222\331{i\335\366\271\243\365\251z\255\337\ No. Time Source Destination Protocol Info 3673 77.818831 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3673 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.434293000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 77.818831000 seconds] Frame Number: 3673 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7b34 (31540) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7729 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2636137, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2636137 (relative sequence number) [Next sequence number: 2637505 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x59d4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608887, TSecr 60593928 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3674 77.818836 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3674 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.434298000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 77.818836000 seconds] Frame Number: 3674 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd45a (54362) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1e03 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2637505, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2637505 (relative sequence number) [Next sequence number: 2638873 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x185b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608887, TSecr 60593928 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3675 77.878671 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2627929 Win=87552 Len=0 TSV=60593934 TSER=987608885 Frame 3675 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.494133000 [Time delta from previous captured frame: 0.059835000 seconds] [Time delta from previous displayed frame: 0.059835000 seconds] [Time since reference or first frame: 77.878671000 seconds] Frame Number: 3675 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0c (19212) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a9 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2627929, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2627929 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xea2e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593934, TSecr 987608885 No. Time Source Destination Protocol Info 3676 77.878716 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3676 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.494178000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 77.878716000 seconds] Frame Number: 3676 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xea05 (59909) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0858 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2638873, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2638873 (relative sequence number) [Next sequence number: 2640241 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xeaf2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608887, TSecr 60593934 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3675] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \271\210\334\251\232e{&::\244\263ja\243bS5zj\232\375G.\031\222f`\3257\230d&.h\213\340\006sY\021O9dl\2355\231\247\001\333\267\204\244q\037\244\370\322\001H\031NDVb\004\243\2676\244\244e\272\225Was\005}\204\252\022_\336 No. Time Source Destination Protocol Info 3677 77.878724 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3677 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.494186000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 77.878724000 seconds] Frame Number: 3677 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcb43 (52035) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x271a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2640241, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2640241 (relative sequence number) [Next sequence number: 2641609 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x23e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608887, TSecr 60593934 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: #\200!\f\024-\246\231\bc\240\201C\277\215d\275\335\031Zl3\242+\250/\000\021yF\306%\005\022h\022-\303\320t\316\366\325\225\344V\033\224\244\361\306@3\310O\023\002\361\r\346\021B\302fs\334\241\2118\303\020\b\260iJ\377\3 No. Time Source Destination Protocol Info 3678 77.938924 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2630665 Win=87552 Len=0 TSV=60593940 TSER=987608885 Frame 3678 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.554386000 [Time delta from previous captured frame: 0.060200000 seconds] [Time delta from previous displayed frame: 0.060200000 seconds] [Time since reference or first frame: 77.938924000 seconds] Frame Number: 3678 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0d (19213) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a8 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2630665, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2630665 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xdf78 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593940, TSecr 987608885 No. Time Source Destination Protocol Info 3679 77.938978 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3679 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.554440000 [Time delta from previous captured frame: 0.000054000 seconds] [Time delta from previous displayed frame: 0.000054000 seconds] [Time since reference or first frame: 77.938978000 seconds] Frame Number: 3679 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9506 (38150) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5d57 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2641609, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2641609 (relative sequence number) [Next sequence number: 2642977 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x37bb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608888, TSecr 60593940 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3678] [The RTT to ACK the segment was: 0.000054000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \271t\315\351\265:\340KA\367\354\006\222\245\241\016\236}9\260\335J\035\216\333\027^\244vSP\255\262\271\236\336\334\230\325Z\211\264\bJu\037\2753m'\000\2464\231:\vV\333\244=9[\026\344\252N\337>T\201\265&\2321\274\231\ No. Time Source Destination Protocol Info 3680 77.938987 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3680 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.554449000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 77.938987000 seconds] Frame Number: 3680 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3a07 (14855) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb856 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2642977, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2642977 (relative sequence number) [Next sequence number: 2644345 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x278b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608888, TSecr 60593940 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \251\277\215\373\253\236\026\206\272]\302ev;nT\335\3465MY\265\362w\271\325/}g\240\211\205\333o\265\304\267\267\256\3633\223J,\2022\347i\022\2418\231\302\362\243\320}a\326\025[\353\213\211\344d\315\022\306\361\311*\315 No. Time Source Destination Protocol Info 3681 77.998580 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2633401 Win=87552 Len=0 TSV=60593946 TSER=987608886 Frame 3681 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.614042000 [Time delta from previous captured frame: 0.059593000 seconds] [Time delta from previous displayed frame: 0.059593000 seconds] [Time since reference or first frame: 77.998580000 seconds] Frame Number: 3681 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0e (19214) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a7 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2633401, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2633401 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd4c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593946, TSecr 987608886 No. Time Source Destination Protocol Info 3682 77.998629 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3682 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.614091000 [Time delta from previous captured frame: 0.000049000 seconds] [Time delta from previous displayed frame: 0.000049000 seconds] [Time since reference or first frame: 77.998629000 seconds] Frame Number: 3682 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5607 (22023) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9c56 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2644345, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2644345 (relative sequence number) [Next sequence number: 2645713 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x39b1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608888, TSecr 60593946 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3681] [The RTT to ACK the segment was: 0.000049000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3683 77.998635 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3683 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.614097000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 77.998635000 seconds] Frame Number: 3683 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x683f (26687) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8a1e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2645713, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2645713 (relative sequence number) [Next sequence number: 2647081 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xedd9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608888, TSecr 60593946 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3684 78.098508 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2636137 Win=87552 Len=0 TSV=60593952 TSER=987608886 Frame 3684 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.713970000 [Time delta from previous captured frame: 0.099873000 seconds] [Time delta from previous displayed frame: 0.099873000 seconds] [Time since reference or first frame: 78.098508000 seconds] Frame Number: 3684 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b0f (19215) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a6 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2636137, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2636137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xca0b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593952, TSecr 987608886 No. Time Source Destination Protocol Info 3685 78.098550 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3685 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.714012000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 78.098550000 seconds] Frame Number: 3685 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4b01 (19201) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa75c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2647081, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2647081 (relative sequence number) [Next sequence number: 2648449 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0084 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608889, TSecr 60593952 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3684] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \334b\341\220\342\367h\020or\376\231\373\354\373\331zq[\372)\256\357\b\307\204\272\223\252\343\003\274\343\305kZ\327\032\020\352j\252\256,@\272\250\270\276._\236\021\356\242\034\025\223\212\323mUy\202\231XW\342\214\25 No. Time Source Destination Protocol Info 3686 78.098558 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3686 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.714020000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 78.098558000 seconds] Frame Number: 3686 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7178 (29048) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x80e5 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2648449, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2648449 (relative sequence number) [Next sequence number: 2649817 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0894 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608889, TSecr 60593952 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \273\337\311\346\354x!\273\365\340\357\245\377\377\021\304cz\366?\221\177\277(\345w\267{\276\327B\375\232\371\263\032\370\206[F\317\213w\177\237\231z\004\333\336_z\363\022\357\257\\333\212\337\304^\365_E\343\233\275\3 No. Time Source Destination Protocol Info 3687 78.118350 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2638873 Win=87552 Len=0 TSV=60593958 TSER=987608887 Frame 3687 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.733812000 [Time delta from previous captured frame: 0.019792000 seconds] [Time delta from previous displayed frame: 0.019792000 seconds] [Time since reference or first frame: 78.118350000 seconds] Frame Number: 3687 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b10 (19216) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a5 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2638873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2638873 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xbf54 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593958, TSecr 987608887 No. Time Source Destination Protocol Info 3688 78.118400 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3688 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.733862000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 78.118400000 seconds] Frame Number: 3688 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x471e (18206) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xab3f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2649817, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2649817 (relative sequence number) [Next sequence number: 2651185 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7ecb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608890, TSecr 60593958 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3687] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: -\357#c\211w\350[\267\232\367\267\223{\271\272\252\253\221\262o{B\267\255m-\304H\322\335\356K}\264:\240\000\000\000\202\001\000]\3520\330.2\304\352[\277b\004l\357d\\226\232\245n\265\031Z\353RM\313\217s]\352\273F\335\2 No. Time Source Destination Protocol Info 3689 78.118407 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3689 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.733869000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 78.118407000 seconds] Frame Number: 3689 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe22e (57902) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x102f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2651185, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2651185 (relative sequence number) [Next sequence number: 2652553 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7da6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608890, TSecr 60593958 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \375\337\rU\337\a\036\377\377\375\177\217\036\257\316\020\005\225\334\275\313\354\270\376\330iC\026\026\342\206\233x\207\216\021\334{6\363n\274\301\237U\0255k\321\226\270\237e\004W\275\235\234!\275\252W\305b\037\213\0 No. Time Source Destination Protocol Info 3690 78.118419 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3690 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.733881000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 78.118419000 seconds] Frame Number: 3690 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x755e (30046) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7cff [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2652553, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2652553 (relative sequence number) [Next sequence number: 2653921 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1c6b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608890, TSecr 60593958 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \213\272\301Z\273\027\314\376}\177/\350\200\206\367\325a9\360Wb\272\220wu\256\244\227\370\000\000\001B!\000 \3361\220\f\020\023\331}\255q`K\360&\177\224\376\271K\315\346/+7\2114\312(OM\315\237\351k\212\367\377\370\201 No. Time Source Destination Protocol Info 3691 78.208633 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2641609 Win=87552 Len=0 TSV=60593964 TSER=987608887 Frame 3691 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.824095000 [Time delta from previous captured frame: 0.090214000 seconds] [Time delta from previous displayed frame: 0.090214000 seconds] [Time since reference or first frame: 78.208633000 seconds] Frame Number: 3691 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b11 (19217) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a4 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2641609, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2641609 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb49e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593964, TSecr 987608887 No. Time Source Destination Protocol Info 3692 78.208679 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3692 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.824141000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 78.208679000 seconds] Frame Number: 3692 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x535a (21338) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9f03 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2653921, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2653921 (relative sequence number) [Next sequence number: 2655289 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf53c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608891, TSecr 60593964 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3691] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \354\346\300\000\000\000\277\001\000 \332\220V\v\214LI)\257-\336\345b\f\255D\211:\334\263\210-\346g\307$/q\033!\025)\264`\236\351\335\256\321%f6\357l\257\273\302\356\355\230\206\225Cze\213\273\357km=\336!\017\017\330\ No. Time Source Destination Protocol Info 3693 78.208687 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3693 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.824149000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 78.208687000 seconds] Frame Number: 3693 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4772 (18290) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xaaeb [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2655289, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2655289 (relative sequence number) [Next sequence number: 2656657 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x64f7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608891, TSecr 60593964 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \326\261\234W\207\353\3775\346-\337RIu\245\230$[\273\277\005\035\034\021wv:?#Ys>+\324V8\023\370Gj\365TO\361\025Z\315\317\251\363\307\370\345Qk\233\306\370e\253\361_\025\331|\353/B\267=n\335\371>\t7\274\\346\346\206oz\ No. Time Source Destination Protocol Info 3694 78.238392 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2644345 Win=87552 Len=0 TSV=60593970 TSER=987608888 Frame 3694 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.853854000 [Time delta from previous captured frame: 0.029705000 seconds] [Time delta from previous displayed frame: 0.029705000 seconds] [Time since reference or first frame: 78.238392000 seconds] Frame Number: 3694 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b12 (19218) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a3 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2644345, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2644345 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa9e7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593970, TSecr 987608888 No. Time Source Destination Protocol Info 3695 78.238444 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3695 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.853906000 [Time delta from previous captured frame: 0.000052000 seconds] [Time delta from previous displayed frame: 0.000052000 seconds] [Time since reference or first frame: 78.238444000 seconds] Frame Number: 3695 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8b29 (35625) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6734 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2656657, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2656657 (relative sequence number) [Next sequence number: 2658025 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf628 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608891, TSecr 60593970 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3694] [The RTT to ACK the segment was: 0.000052000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \256\262\347\320\341\364\244\333\275\021 \367\276\332\250\032\212\252/ET\344\316\215\305[U\234V\210jG\246$l\036\036s\017\n\216\322`p\210jZ\302\272\372\321U:\364\363\372\356\264\000\260\251\226\326&;\216ol\3006k3\315\3 No. Time Source Destination Protocol Info 3696 78.238453 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3696 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.853915000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 78.238453000 seconds] Frame Number: 3696 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd86e (55406) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x19ef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2658025, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2658025 (relative sequence number) [Next sequence number: 2659393 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x544f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608891, TSecr 60593970 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: )e\027\21220z\314\216\326\376H\240'\325"l\313\024\002\220b\273Z\320\345\213\033;\240\2334\221Z\305Q#[\263\355E\035"H\341|'S,\245Qb'<\354\276\267[\254V\335\336\355\335b\262\343\265l\200\a\207\362+\254\301y\303\213\351\ No. Time Source Destination Protocol Info 3697 78.369174 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2645713 Win=87552 Len=0 TSV=60593978 TSER=987608888 Frame 3697 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:31.984636000 [Time delta from previous captured frame: 0.130721000 seconds] [Time delta from previous displayed frame: 0.130721000 seconds] [Time since reference or first frame: 78.369174000 seconds] Frame Number: 3697 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b13 (19219) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a2 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2645713, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2645713 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa487 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60593978, TSecr 987608888 No. Time Source Destination Protocol Info 3698 78.369214 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3698 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:31.984676000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 78.369214000 seconds] Frame Number: 3698 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5131 (20785) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa12c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2659393, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2659393 (relative sequence number) [Next sequence number: 2660761 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1ca0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608892, TSecr 60593978 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3697] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \316l\362V\357\223\227\276\371\377_\023\332\374\000\000\006J%\000\341\270 !q\237\377\370"\212\a\307|\370\257\327\336\357O\371dCr\326\375\345\370q\340\364\r@\2765T\314n\325\361P\362\034\235\334G\r\@\363\234\016Pj8E\347 No. Time Source Destination Protocol Info 3699 78.558541 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2648449 Win=87552 Len=0 TSV=60594002 TSER=987608888 Frame 3699 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.174003000 [Time delta from previous captured frame: 0.189327000 seconds] [Time delta from previous displayed frame: 0.189327000 seconds] [Time since reference or first frame: 78.558541000 seconds] Frame Number: 3699 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b14 (19220) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a1 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2648449, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2648449 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x99bf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594002, TSecr 987608888 No. Time Source Destination Protocol Info 3700 78.558580 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3700 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.174042000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 78.558580000 seconds] Frame Number: 3700 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8e35 (36405) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6428 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2660761, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2660761 (relative sequence number) [Next sequence number: 2662129 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9666 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594002 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3699] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \342\266\357\036\003\362\324(\257}\273\273\276\373\273\305\v\370v"!)=_I\305b\262\346\341Eo|?\377\366Y\377\277w\177\322(\326\a`\220UY\377\267\367\204G\257d\315\242;\337xt\255<{f\307$ey\352\177\3239"\024\005\354\257\350 No. Time Source Destination Protocol Info 3701 78.558587 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3701 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.174049000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 78.558587000 seconds] Frame Number: 3701 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0d4e (3406) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe50f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2662129, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2662129 (relative sequence number) [Next sequence number: 2663497 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe496 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594002 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \200\325\221\006\325\325:\343\313\031~\027\256K}!\347\206\2276{d\341U\274\263\214\275&\371.y\b\300U\374\177\360\237\273\367\2717}\274\273\276]\313\214\240\360kmo\275\340\265\250\237\335\330\347\343/N\341\354\356\245\2 No. Time Source Destination Protocol Info 3702 78.560422 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2651185 Win=87552 Len=0 TSV=60594003 TSER=987608889 Frame 3702 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.175884000 [Time delta from previous captured frame: 0.001835000 seconds] [Time delta from previous displayed frame: 0.001835000 seconds] [Time since reference or first frame: 78.560422000 seconds] Frame Number: 3702 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b15 (19221) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb3a0 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2651185, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2651185 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8f0d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594003, TSecr 987608889 No. Time Source Destination Protocol Info 3703 78.560461 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3703 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.175923000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 78.560461000 seconds] Frame Number: 3703 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2526 (9510) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcd37 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2663497, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2663497 (relative sequence number) [Next sequence number: 2664865 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc1c8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594003 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3702] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \240\365}|~\263\252\vaZ\275\227\205\000z\374\177\256\232\235V>CfS\361\322\246r\fj}\247\325\261M/\372\362\216\276\261<\304m\a\370\317\227\272Txq\034\372\232~\232}<\024\215I\316\260+\325)\323H\341\351E\332.\0348\331\026 No. Time Source Destination Protocol Info 3704 78.560470 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3704 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.175932000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 78.560470000 seconds] Frame Number: 3704 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x303c (12348) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc221 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2664865, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2664865 (relative sequence number) [Next sequence number: 2666233 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe086 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594003 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \222\216C\223\221_%.\345\343*\337\354;\312\272\Rm\3550\210U\367\277c\331\257\326\360\221 \262\334\037\376\367\277\323'\275\3522b\263\354\203}\t\265\224\235]e\364\000\251\344\215[\360^\036\267|G\223\3420\2145\316V\344B No. Time Source Destination Protocol Info 3705 78.570904 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2653921 Win=87552 Len=0 TSV=60594003 TSER=987608890 Frame 3705 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.186366000 [Time delta from previous captured frame: 0.010434000 seconds] [Time delta from previous displayed frame: 0.010434000 seconds] [Time since reference or first frame: 78.570904000 seconds] Frame Number: 3705 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b16 (19222) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2653921, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2653921 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x845c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594003, TSecr 987608890 No. Time Source Destination Protocol Info 3706 78.570943 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3706 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.186405000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 78.570943000 seconds] Frame Number: 3706 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x447d (17533) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xade0 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2666233, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2666233 (relative sequence number) [Next sequence number: 2667601 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x97fd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594003 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3705] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \333<\017+\251\234\250\263z\212\244\246`\335\326/E,%lX\t\311\361\005\227\356\330\271\263\2350\\377M\204\217\026\362(\376-\213w\303\360\b\002\241\376\275KO\b\025ps\226;m\374\024\240\3319\362\326\367m\336\373}\270\235\0 No. Time Source Destination Protocol Info 3707 78.570950 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3707 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.186412000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 78.570950000 seconds] Frame Number: 3707 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4d39 (19769) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa524 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2667601, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2667601 (relative sequence number) [Next sequence number: 2668969 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0b8e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594003 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \307\334\202\036\252\271\f\270U\305k\025\332\236\v\035\365\353\360\307\364\b\243\262WQh\376\201M\231B\262Y\221{w\275y\235bt\254uH\275\026\265\342"kVDS\337R\353_r\354\254+\200\000\000\000\370!\001/\204$\027\030+\004\36 No. Time Source Destination Protocol Info 3708 78.570953 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3708 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.186415000 [Time delta from previous captured frame: 0.000003000 seconds] [Time delta from previous displayed frame: 0.000003000 seconds] [Time since reference or first frame: 78.570953000 seconds] Frame Number: 3708 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb104 (45316) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4159 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2668969, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2668969 (relative sequence number) [Next sequence number: 2670337 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x970e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594003 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: sF\V+qY(9\n\327\320Q\270\254V\357dWG\263\210\257jox\274?5\272\217\235\214\273\226\337?\273\345\267q^F\020\355\253\270\255\337|CZ\261$\270\232\023S\v\253\336\207\335\315\231h\223\367rHNT\b\245\331\237\021y\270\276\356\ No. Time Source Destination Protocol Info 3709 78.572052 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2656657 Win=87552 Len=0 TSV=60594004 TSER=987608891 Frame 3709 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.187514000 [Time delta from previous captured frame: 0.001099000 seconds] [Time delta from previous displayed frame: 0.001099000 seconds] [Time since reference or first frame: 78.572052000 seconds] Frame Number: 3709 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b17 (19223) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2656657, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2656657 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x79aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594004, TSecr 987608891 No. Time Source Destination Protocol Info 3710 78.572079 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3710 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.187541000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 78.572079000 seconds] Frame Number: 3710 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1e03 (7683) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd45a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2670337, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2670337 (relative sequence number) [Next sequence number: 2671705 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe883 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594004 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3709] [The RTT to ACK the segment was: 0.000027000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3711 78.572083 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3711 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.187545000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 78.572083000 seconds] Frame Number: 3711 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc53a (50490) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2d23 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2671705, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2671705 (relative sequence number) [Next sequence number: 2673073 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd229 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608894, TSecr 60594004 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: :\355{\367\254\270\370\277\373\2576ir\366vs\232~\372\344\316\311v\220\321~\222Y:\257\033A\262\307L\366\202fY\026\t\235Z&\324sJW\363\267\224\313;>C_\200\253\235\220/\303\027\312p?\021\300!\f\024\025\236\233a\244@\330\2 No. Time Source Destination Protocol Info 3712 78.798908 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2659393 Win=87552 Len=0 TSV=60594026 TSER=987608891 Frame 3712 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.414370000 [Time delta from previous captured frame: 0.226825000 seconds] [Time delta from previous displayed frame: 0.226825000 seconds] [Time since reference or first frame: 78.798908000 seconds] Frame Number: 3712 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b18 (19224) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2659393, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2659393 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6ee4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594026, TSecr 987608891 No. Time Source Destination Protocol Info 3713 78.798958 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3713 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.414420000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 78.798958000 seconds] Frame Number: 3713 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfe17 (65047) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf445 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2673073, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2673073 (relative sequence number) [Next sequence number: 2674441 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8aa8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608896, TSecr 60594026 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3712] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \027D\226\372N\r\344\326\004%\217\211\315\026\241\225\220\036\221Bl\273TA\275\\025\224y\247J\212\200\272vhYF\240\326g\026\234\341\345:f\362\f^\a\250\`\332\332\257\321[\001yw\003iYJ\340\3343X\214T^\t`\3614@\036\022\261 No. Time Source Destination Protocol Info 3714 78.798968 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3714 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.414430000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 78.798968000 seconds] Frame Number: 3714 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5f31 (24369) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x932c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2674441, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2674441 (relative sequence number) [Next sequence number: 2675809 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd2bf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608896, TSecr 60594026 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \333!\254\031\366o\366\322GlN#\307\267\322\253\245#\302\336$X\311\331\341uJ\313EU\271\371>\253\306/Q\216\233>\252\276e\200\242\243}\370\033?B\307\321q\235\345s\377\2377V\245'\006\363p\273\221\032\315\303\217\243\247~e No. Time Source Destination Protocol Info 3715 78.800094 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2662129 Win=87552 Len=0 TSV=60594027 TSER=987608892 Frame 3715 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.415556000 [Time delta from previous captured frame: 0.001126000 seconds] [Time delta from previous displayed frame: 0.001126000 seconds] [Time since reference or first frame: 78.800094000 seconds] Frame Number: 3715 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b19 (19225) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2662129, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2662129 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6432 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594027, TSecr 987608892 No. Time Source Destination Protocol Info 3716 78.800119 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3716 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.415581000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 78.800119000 seconds] Frame Number: 3716 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa624 (42532) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4c39 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2675809, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2675809 (relative sequence number) [Next sequence number: 2677177 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9042 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608896, TSecr 60594027 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3715] [The RTT to ACK the segment was: 0.000025000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: jY_\2268\332*\017\021\327G~\224\n:\351;\250\267+\006\212\3575\032|I\226\375\366\206\005^\220\301:\037\210\340!\f\024\025\276\224\301\240\301\230d S\370\253\325\222\372\322\254\224\205k~RB\216\301Ky\257\257z\0231\330\2 No. Time Source Destination Protocol Info 3717 78.800134 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3717 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.415596000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 78.800134000 seconds] Frame Number: 3717 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xef1c (61212) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0341 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2677177, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2677177 (relative sequence number) [Next sequence number: 2678545 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb917 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608896, TSecr 60594027 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3718 78.810877 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2664865 Win=87552 Len=0 TSV=60594027 TSER=987608894 Frame 3718 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.426339000 [Time delta from previous captured frame: 0.010743000 seconds] [Time delta from previous displayed frame: 0.010743000 seconds] [Time since reference or first frame: 78.810877000 seconds] Frame Number: 3718 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1a (19226) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2664865, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2664865 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5980 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594027, TSecr 987608894 No. Time Source Destination Protocol Info 3719 78.810919 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3719 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.426381000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 78.810919000 seconds] Frame Number: 3719 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8b3f (35647) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x671e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2678545, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2678545 (relative sequence number) [Next sequence number: 2679913 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xabf1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594027 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3718] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3720 78.810928 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3720 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.426390000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 78.810928000 seconds] Frame Number: 3720 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc06f (49263) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x31ee [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2679913, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2679913 (relative sequence number) [Next sequence number: 2681281 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc182 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594027 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \375\3144V$\030GV]\373c\355\313Y8\352\347\372jN\237\226^\246\325\000\000\001\230!\001/\210D\027\030'\257x\303]\360\224H\276qC*lF\313\354\030\362\2152\341\0333\r\236\303\001\301=\237\t\253\344}\006\207j\265]k\304\005A\ No. Time Source Destination Protocol Info 3721 78.816870 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2667601 Win=87552 Len=0 TSV=60594028 TSER=987608894 Frame 3721 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.432332000 [Time delta from previous captured frame: 0.005942000 seconds] [Time delta from previous displayed frame: 0.005942000 seconds] [Time since reference or first frame: 78.816870000 seconds] Frame Number: 3721 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1b (19227) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb39a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2667601, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2667601 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4ecf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594028, TSecr 987608894 No. Time Source Destination Protocol Info 3722 78.816912 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3722 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.432374000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 78.816912000 seconds] Frame Number: 3722 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xed7c (60796) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x04e1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2681281, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2681281 (relative sequence number) [Next sequence number: 2682649 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1dad [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594028 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3721] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \367\367I\337~\311\275\372%\356\336{\305~C\204;\273\357\313\340\000\000\001\255!\000K8\204Aq\2035\302A\036\374w\213\021\331\0017w{\273\363\325\372\364\371\177\343\fZn\227\v\265~\026\376\242\303<>\021%\305n\3618L\262\0 No. Time Source Destination Protocol Info 3723 78.816920 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3723 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.432382000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 78.816920000 seconds] Frame Number: 3723 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x261d (9757) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcc40 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2682649, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2682649 (relative sequence number) [Next sequence number: 2684017 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x961f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594028 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \342\273-\212\334o\3116\2361\f\226\305e\261X\254V+\020\322-\321\226\313\236XR+\025\277\vU\332v\343p\370[.\203_\205vUq0\245\357ww\252+\006\177;\304\016\327\335\030)\273\273\273\273\2756n\340\326kO\2730#\235\215\277x$\2 No. Time Source Destination Protocol Info 3724 78.848487 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2670337 Win=87552 Len=0 TSV=60594031 TSER=987608894 Frame 3724 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.463949000 [Time delta from previous captured frame: 0.031567000 seconds] [Time delta from previous displayed frame: 0.031567000 seconds] [Time since reference or first frame: 78.848487000 seconds] Frame Number: 3724 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1c (19228) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb399 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2670337, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2670337 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x441c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594031, TSecr 987608894 No. Time Source Destination Protocol Info 3725 78.848530 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3725 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.463992000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 78.848530000 seconds] Frame Number: 3725 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2b19 (11033) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc744 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2684017, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2684017 (relative sequence number) [Next sequence number: 2685385 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfdec [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594031 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3724] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \255h\217\223\273\337\240R\025\320ta\267w\260&\203\361\025U\252\367\017\004\342\342\365\335\354\032\207\334\231=\203\024\b\253\255l\025\3017UU\352\233Y\nF\266Tk\357u\t\304]\032n\351e\202\216\357\244\356i5\255$\254\224 No. Time Source Destination Protocol Info 3726 78.848536 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3726 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.463998000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 78.848536000 seconds] Frame Number: 3726 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd460 (54368) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1dfd [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2685385, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2685385 (relative sequence number) [Next sequence number: 2686753 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1559 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594031 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \352`\260\035\220~\021\r\002\355i\326e7\277\334\b\036\377^\377\377\376\t\337\b\206\0014\314\333\312\274\311=\377\021\ba\336\027\035\302\261\232\325\305\032b\215\342\216\342\261X\243\306{\017\002\216\242\353\021\376\34 No. Time Source Destination Protocol Info 3727 78.848540 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3727 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.464002000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 78.848540000 seconds] Frame Number: 3727 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcd4f (52559) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x250e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2686753, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2686753 (relative sequence number) [Next sequence number: 2688121 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd6e7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608897, TSecr 60594031 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: 0\317O8\353$V=\023\301\335\n\326#$&\364J}4\037\333\363\r\005R{\021\373\273\273\212\334V\2236a\006\242\000\374=\177\261 \206\356\357/0&\270\254\267V\351?\026\202y/J\357\214a\035\322\335\356\376e\321o\315\371\a\223\266_ No. Time Source Destination Protocol Info 3728 78.909122 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2673073 Win=87552 Len=0 TSV=60594037 TSER=987608894 Frame 3728 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.524584000 [Time delta from previous captured frame: 0.060582000 seconds] [Time delta from previous displayed frame: 0.060582000 seconds] [Time since reference or first frame: 78.909122000 seconds] Frame Number: 3728 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1d (19229) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb398 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2673073, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2673073 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3966 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594037, TSecr 987608894 No. Time Source Destination Protocol Info 3729 78.909166 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3729 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.524628000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 78.909166000 seconds] Frame Number: 3729 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3d7a (15738) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb4e3 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2688121, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2688121 (relative sequence number) [Next sequence number: 2689489 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfeac [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608898, TSecr 60594037 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3728] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \212\035w\334W\025\264\322\254NB1\031\2100\246_\377\323\361\023\203\037\257w%\337\310\024\372\345\3219Nz\355/\271j\375\f\355\210\273\335\357\304\v\341\022\002M\342\034\356 x~\367\266\232\314\231'\267\327\364\337So.n/\ No. Time Source Destination Protocol Info 3730 78.909175 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3730 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.524637000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 78.909175000 seconds] Frame Number: 3730 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4a0b (18955) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa852 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2689489, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2689489 (relative sequence number) [Next sequence number: 2690857 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3a41 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608898, TSecr 60594037 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: (\372\365\345\260\221j\022\325\367\276\262\335\032\357\251\267\275]@\000\000\000\250\001\000K*AX.0[ c"\026b\312\276[\276d\217$\227~\341j \034A\310\362\341v\210\366\035\t\016\207 \2043\v7\037\307O\352o\376\236K\277d\tJ No. Time Source Destination Protocol Info 3731 79.088989 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2675809 Win=87552 Len=0 TSV=60594043 TSER=987608896 Frame 3731 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.704451000 [Time delta from previous captured frame: 0.179814000 seconds] [Time delta from previous displayed frame: 0.179814000 seconds] [Time since reference or first frame: 79.088989000 seconds] Frame Number: 3731 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1e (19230) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb397 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2675809, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2675809 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2eae [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594043, TSecr 987608896 No. Time Source Destination Protocol Info 3732 79.089037 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3732 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.704499000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 79.089037000 seconds] Frame Number: 3732 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7954 (31060) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7909 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2690857, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2690857 (relative sequence number) [Next sequence number: 2692225 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc28a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594043 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3731] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \2052\340\2078\317yyl\367\216`\265\224-K\030\221\347\000\003\205\001\?!\202\223\310k\314\324\247\212\332\226\017\n\226;\267`\377\234<\260\031`\303\240\002\231\231\330\220SV\266:?\275\273\373\356\361\030W\263<\337\331\ No. Time Source Destination Protocol Info 3733 79.089047 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3733 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.704509000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 79.089047000 seconds] Frame Number: 3733 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x312d (12589) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc130 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2692225, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2692225 (relative sequence number) [Next sequence number: 2693593 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8962 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594043 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \327\273\332\273\336\273\202ZW\336+\257\227w\316\340W\350p5\3618E\314\301\215zLH\353\275\356\357w\341p\247\a%\351\004/{\276\357\344\232\356\357\232N=\351\3343\315\215+M\177\357\236\332\023\215\233wk\262\337%\357\344\0 No. Time Source Destination Protocol Info 3734 79.090630 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2678545 Win=87552 Len=0 TSV=60594049 TSER=987608896 Frame 3734 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.706092000 [Time delta from previous captured frame: 0.001583000 seconds] [Time delta from previous displayed frame: 0.001583000 seconds] [Time since reference or first frame: 79.090630000 seconds] Frame Number: 3734 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b1f (19231) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb396 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2678545, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2678545 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x23f8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594049, TSecr 987608896 No. Time Source Destination Protocol Info 3735 79.090652 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3735 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.706114000 [Time delta from previous captured frame: 0.000022000 seconds] [Time delta from previous displayed frame: 0.000022000 seconds] [Time since reference or first frame: 79.090652000 seconds] Frame Number: 3735 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1358 (4952) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdf05 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2693593, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2693593 (relative sequence number) [Next sequence number: 2694961 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4ca1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594049 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3734] [The RTT to ACK the segment was: 0.000022000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \361D\242\321F\253g\255\273\213e\263PRb\350\330r1*qD\017\022\3438C\324'\252\335\251{C8R\321\325\265^;#\257M\253I\273\377\3638\332\016\265\254V\267Yz\334\330\257\253\025\254C\213\020\365\210z\305f\305}|\373\364\234\333 No. Time Source Destination Protocol Info 3736 79.090659 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3736 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.706121000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 79.090659000 seconds] Frame Number: 3736 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdb2d (56109) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1730 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2694961, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2694961 (relative sequence number) [Next sequence number: 2696329 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x233c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594049 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: y\301\301\233\303\362x\373H\311\037\355\235\235m+R\271\232_\326\035\204\272\000\032\274N\021{t\313\210p\273\275K\271^]\313\221L\031\241\240zmd\373\243\313\037c\267\f\026\2206\351\321\307\351\220W\004\254\242:\327\377\ No. Time Source Destination Protocol Info 3737 79.091926 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2681281 Win=87552 Len=0 TSV=60594055 TSER=987608897 Frame 3737 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.707388000 [Time delta from previous captured frame: 0.001267000 seconds] [Time delta from previous displayed frame: 0.001267000 seconds] [Time since reference or first frame: 79.091926000 seconds] Frame Number: 3737 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b20 (19232) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb395 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2681281, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2681281 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x1941 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594055, TSecr 987608897 No. Time Source Destination Protocol Info 3738 79.091947 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3738 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.707409000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 79.091947000 seconds] Frame Number: 3738 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2565 (9573) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xccf8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2696329, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2696329 (relative sequence number) [Next sequence number: 2697697 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa981 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594055 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3737] [The RTT to ACK the segment was: 0.000021000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \370"\212\a\307k\305g\375{\274\275\340\310\320xl\326'\271\353{\210x\360?\o\002\346j/\376\034\314\340\037\336d\362\a\226I\371g\000= \3638\360x\\017\375\331\272c\nw\025\303\363\t&\004\te\t\256\377g\203~\271\321\003\323\ No. Time Source Destination Protocol Info 3739 79.091954 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3739 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.707416000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 79.091954000 seconds] Frame Number: 3739 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7370 (29552) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7eed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2697697, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2697697 (relative sequence number) [Next sequence number: 2699065 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0f6b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608899, TSecr 60594055 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: $\350!\371z|.\356\377\017Al\036\361,\037\345\364h\241\031m\341L"={\373\377\372\321\221a\236\222OlC\211\225"m;\371\276\275\026HA\016\256\277\253td\025\265\365\r\371W\312\210\eY\033\236\273\244\315P\275\270\317\356l\300 No. Time Source Destination Protocol Info 3740 79.148555 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2684017 Win=87552 Len=0 TSV=60594061 TSER=987608897 Frame 3740 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.764017000 [Time delta from previous captured frame: 0.056601000 seconds] [Time delta from previous displayed frame: 0.056601000 seconds] [Time since reference or first frame: 79.148555000 seconds] Frame Number: 3740 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b21 (19233) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb394 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2684017, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2684017 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0e8b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594061, TSecr 987608897 No. Time Source Destination Protocol Info 3741 79.148604 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3741 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.764066000 [Time delta from previous captured frame: 0.000049000 seconds] [Time delta from previous displayed frame: 0.000049000 seconds] [Time since reference or first frame: 79.148604000 seconds] Frame Number: 3741 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xce65 (52837) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x23f8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2699065, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2699065 (relative sequence number) [Next sequence number: 2700433 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5c24 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608900, TSecr 60594061 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3740] [The RTT to ACK the segment was: 0.000049000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: V\207H\274>\032\336~\327\022\256\340Y\367\255H\270\207\036\356\366 \036\374\342k\026J\264\351\230\364\336\367\227\237\217T\354\355\261\212\3537A\230\272\377\237\323?a^\275:p\361\220\230u@\232D\306\262\316\271\375Wd\37 No. Time Source Destination Protocol Info 3742 79.148612 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3742 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.764074000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 79.148612000 seconds] Frame Number: 3742 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5c2e (23598) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x962f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2700433, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2700433 (relative sequence number) [Next sequence number: 2701801 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5381 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608900, TSecr 60594061 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: '\330\213\371Y\017\036\343\210\301\333\365q\035\343\360\022\265\247\257M?\3775^\025\032\231\320{\256\253\3538\251V\201\035\365~q[\024\313\252\305e\332zw\265\254C\205\357W\316\276\276M\3028!\243\254\377\376\260ok0v\301 No. Time Source Destination Protocol Info 3743 79.248724 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2686753 Win=87552 Len=0 TSV=60594067 TSER=987608897 Frame 3743 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.864186000 [Time delta from previous captured frame: 0.100112000 seconds] [Time delta from previous displayed frame: 0.100112000 seconds] [Time since reference or first frame: 79.248724000 seconds] Frame Number: 3743 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b22 (19234) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb393 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2686753, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2686753 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x03d5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594067, TSecr 987608897 No. Time Source Destination Protocol Info 3744 79.248768 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3744 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.864230000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 79.248768000 seconds] Frame Number: 3744 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9f79 (40825) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x52e4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2701801, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2701801 (relative sequence number) [Next sequence number: 2703169 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x095d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608901, TSecr 60594067 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3743] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \2554\372\365\203a\020]\214\373\343\236J\255\243\346\\304m'm\236\333q\301\216\355(^\271G\267&\246\323\322\335\336\215!\266\337\315\004?\r\000X\333r\262\375k\266~\223\342\362R\264"t\365\307/\333\377\346\3757\352\306U\3 No. Time Source Destination Protocol Info 3745 79.248777 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3745 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.864239000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 79.248777000 seconds] Frame Number: 3745 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x437b (17275) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xaee2 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2703169, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2703169 (relative sequence number) [Next sequence number: 2704537 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfbab [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608901, TSecr 60594067 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \212\362\365[\253\276*\261\372\324\352\227\275\367K\313\2275\230\255z\237\313\265i\335V\375*\327\252\327\353\237\237)-\332\360j 52904 [ACK] Seq=1 Ack=2689489 Win=87552 Len=0 TSV=60594073 TSER=987608897 Frame 3747 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.884028000 [Time delta from previous captured frame: 0.019785000 seconds] [Time delta from previous displayed frame: 0.019785000 seconds] [Time since reference or first frame: 79.268566000 seconds] Frame Number: 3747 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b23 (19235) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb392 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2689489, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2689489 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf91e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594073, TSecr 987608897 No. Time Source Destination Protocol Info 3748 79.268611 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3748 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.884073000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 79.268611000 seconds] Frame Number: 3748 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfe75 (65141) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf3e7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2705905, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2705905 (relative sequence number) [Next sequence number: 2707273 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x48ac [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608901, TSecr 60594073 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3747] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3749 79.268619 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3749 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.884081000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 79.268619000 seconds] Frame Number: 3749 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5975 (22901) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x98e8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2707273, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2707273 (relative sequence number) [Next sequence number: 2708641 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd313 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608901, TSecr 60594073 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3750 79.328458 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2692225 Win=87552 Len=0 TSV=60594079 TSER=987608898 Frame 3750 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:32.943920000 [Time delta from previous captured frame: 0.059839000 seconds] [Time delta from previous displayed frame: 0.059839000 seconds] [Time since reference or first frame: 79.328458000 seconds] Frame Number: 3750 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b24 (19236) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb391 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2692225, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2692225 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xee67 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594079, TSecr 987608898 No. Time Source Destination Protocol Info 3751 79.328507 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3751 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.943969000 [Time delta from previous captured frame: 0.000049000 seconds] [Time delta from previous displayed frame: 0.000049000 seconds] [Time since reference or first frame: 79.328507000 seconds] Frame Number: 3751 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5800 (22528) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9a5d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2708641, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2708641 (relative sequence number) [Next sequence number: 2710009 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3c64 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608902, TSecr 60594079 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3750] [The RTT to ACK the segment was: 0.000049000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: PQ\225\357H\265f\024\362\275\335\363\005\004\035{\313t\325\251\356kv\324\033,\v-\273\017\204g\003\204\253\303\004j\263R\356\257w\234U=\376\215\254\221\303\261\267n\rV\305\207`&\337]\306\326\022#;c\202~M\r\321\253\260V No. Time Source Destination Protocol Info 3752 79.328515 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3752 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:32.943977000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 79.328515000 seconds] Frame Number: 3752 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3830 (14384) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xba2d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2710009, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2710009 (relative sequence number) [Next sequence number: 2711377 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6e49 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608902, TSecr 60594079 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: -9l\224\263J\351@\374G!\f\0245\232\215a\251\261\b@\247\267\232u\335I%{\361*\327+RQ\002\225\230\000e\211\305\320\034\241\243>\305a\310S\370\252v\346\370\351\351/`\355\303o\261\372\334\373\030\035\346;\277\307\275cC\t]\ No. Time Source Destination Protocol Info 3753 79.518732 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594098 TSER=987608899 Frame 3753 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.134194000 [Time delta from previous captured frame: 0.190217000 seconds] [Time delta from previous displayed frame: 0.190217000 seconds] [Time since reference or first frame: 79.518732000 seconds] Frame Number: 3753 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b25 (19237) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb390 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe3a3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594098, TSecr 987608899 No. Time Source Destination Protocol Info 3754 79.518774 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3754 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.134236000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 79.518774000 seconds] Frame Number: 3754 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf265 (62053) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xfff7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2711377, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2711377 (relative sequence number) [Next sequence number: 2712745 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6a2b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608904, TSecr 60594098 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3753] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \230\n\a1*8\265\361\251\247\247\230[^-m\035\372\031W5\004\v\207\264\265\222$\260\325o\340\277\243\307\005\240E\021*\233\207\204\373c/u6\3365.0",m\231\017G\210\320\224T?\356\370\337\003\320u\237F\325^$\257G\364\257J6#) No. Time Source Destination Protocol Info 3755 79.518782 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3755 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.134244000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 79.518782000 seconds] Frame Number: 3755 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb008 (45064) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4255 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2712745, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2712745 (relative sequence number) [Next sequence number: 2714113 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1ce4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608904, TSecr 60594098 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: llc\366<\254\264\326\234|\365\346\263\243\361Ok\342\231Y{\306R<\3126\266\r\271\000\206C#\0056\2365\216\331\335A\366\254Y\365_\273b\216\0265\374n\216\305\350\214\246\361\226qLi+\273\274\\371\364\262\211\365d\v\201\021\ No. Time Source Destination Protocol Info 3756 79.519902 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#1] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594098 TSER=987608899 SLE=2699065 SRE=2700433 Frame 3756 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.135364000 [Time delta from previous captured frame: 0.001120000 seconds] [Time delta from previous displayed frame: 0.001120000 seconds] [Time since reference or first frame: 79.519902000 seconds] Frame Number: 3756 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b26 (19238) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb383 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x99e0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594098, TSecr 987608899 NOP NOP SACK: 2699065-2700433 left edge = 2699065 (relative) right edge = 2700433 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3757 79.520799 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#2] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594099 TSER=987608899 SLE=2699065 SRE=2701801 Frame 3757 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.136261000 [Time delta from previous captured frame: 0.000897000 seconds] [Time delta from previous displayed frame: 0.000897000 seconds] [Time since reference or first frame: 79.520799000 seconds] Frame Number: 3757 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b27 (19239) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb382 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9487 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594099, TSecr 987608899 NOP NOP SACK: 2699065-2701801 left edge = 2699065 (relative) right edge = 2701801 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#2)] [Message: Duplicate ACK (#2)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3758 79.520827 89.223.234.248 x.x.x.x FTP-DATA [TCP Fast Retransmission] FTP Data: 1368 bytes Frame 3758 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.136289000 [Time delta from previous captured frame: 0.000028000 seconds] [Time delta from previous displayed frame: 0.000028000 seconds] [Time since reference or first frame: 79.520827000 seconds] Frame Number: 3758 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7d74 (32116) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x74e9 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2694961, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2694961 (relative sequence number) [Next sequence number: 2696329 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x90 (ACK, CWR) 1... .... = Congestion Window Reduced (CWR): Set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2285 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608904, TSecr 60594099 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3756] [The RTT to ACK the segment was: 0.000925000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) fast retransmission] [Expert Info (Warn/Sequence): Fast retransmission (suspected)] [Message: Fast retransmission (suspected)] [Severity level: Warn] [Group: Sequence] [This frame is a (suspected) retransmission] FTP Data [truncated] FTP Data: y\301\301\233\303\362x\373H\311\037\355\235\235m+R\271\232_\326\035\204\272\000\032\274N\021{t\313\210p\273\275K\271^]\313\221L\031\241\240zmd\373\243\313\037c\267\f\026\2206\351\321\307\351\220W\004\254\242:\327\377\ No. Time Source Destination Protocol Info 3759 79.526538 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#3] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594099 TSER=987608899 SLE=2699065 SRE=2703169 Frame 3759 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.142000000 [Time delta from previous captured frame: 0.005711000 seconds] [Time delta from previous displayed frame: 0.005711000 seconds] [Time since reference or first frame: 79.526538000 seconds] Frame Number: 3759 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b28 (19240) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb381 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8f2f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594099, TSecr 987608899 NOP NOP SACK: 2699065-2703169 left edge = 2699065 (relative) right edge = 2703169 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#3)] [Message: Duplicate ACK (#3)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3760 79.529571 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#4] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594099 TSER=987608899 SLE=2699065 SRE=2704537 Frame 3760 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.145033000 [Time delta from previous captured frame: 0.003033000 seconds] [Time delta from previous displayed frame: 0.003033000 seconds] [Time since reference or first frame: 79.529571000 seconds] Frame Number: 3760 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b29 (19241) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb380 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x89d7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594099, TSecr 987608899 NOP NOP SACK: 2699065-2704537 left edge = 2699065 (relative) right edge = 2704537 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#4)] [Message: Duplicate ACK (#4)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3761 79.549518 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#5] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594101 TSER=987608899 SLE=2699065 SRE=2705905 Frame 3761 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.164980000 [Time delta from previous captured frame: 0.019947000 seconds] [Time delta from previous displayed frame: 0.019947000 seconds] [Time since reference or first frame: 79.549518000 seconds] Frame Number: 3761 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2a (19242) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x847d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594101, TSecr 987608899 NOP NOP SACK: 2699065-2705905 left edge = 2699065 (relative) right edge = 2705905 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 5] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#5)] [Message: Duplicate ACK (#5)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3762 79.578481 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#6] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594104 TSER=987608899 SLE=2699065 SRE=2707273 Frame 3762 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.193943000 [Time delta from previous captured frame: 0.028963000 seconds] [Time delta from previous displayed frame: 0.028963000 seconds] [Time since reference or first frame: 79.578481000 seconds] Frame Number: 3762 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2b (19243) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7f22 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594104, TSecr 987608899 NOP NOP SACK: 2699065-2707273 left edge = 2699065 (relative) right edge = 2707273 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 6] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#6)] [Message: Duplicate ACK (#6)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3763 79.578519 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3763 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.193981000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 79.578519000 seconds] Frame Number: 3763 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd15d (53597) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2100 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2696329, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2696329 (relative sequence number) [Next sequence number: 2697697 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa94b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608904, TSecr 60594104 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3759] [The RTT to ACK the segment was: 0.051981000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.059737000 seconds] [RTO based on delta from frame: 3755] FTP Data [truncated] FTP Data: \370"\212\a\307k\305g\375{\274\275\340\310\320xl\326'\271\353{\210x\360?\o\002\346j/\376\034\314\340\037\336d\362\a\226I\371g\000= \3638\360x\\017\375\331\272c\nw\025\303\363\t&\004\te\t\256\377g\203~\271\321\003\323\ No. Time Source Destination Protocol Info 3764 79.648745 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#7] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594107 TSER=987608899 SLE=2699065 SRE=2708641 Frame 3764 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.264207000 [Time delta from previous captured frame: 0.070226000 seconds] [Time delta from previous displayed frame: 0.070226000 seconds] [Time since reference or first frame: 79.648745000 seconds] Frame Number: 3764 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2c (19244) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x79c7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594107, TSecr 987608899 NOP NOP SACK: 2699065-2708641 left edge = 2699065 (relative) right edge = 2708641 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 7] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#7)] [Message: Duplicate ACK (#7)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3765 79.648777 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3765 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.264239000 [Time delta from previous captured frame: 0.000032000 seconds] [Time delta from previous displayed frame: 0.000032000 seconds] [Time since reference or first frame: 79.648777000 seconds] Frame Number: 3765 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x261e (9758) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcc3f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2697697, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2697697 (relative sequence number) [Next sequence number: 2699065 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0f31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608905, TSecr 60594107 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3764] [The RTT to ACK the segment was: 0.000032000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.129995000 seconds] [RTO based on delta from frame: 3755] FTP Data [truncated] FTP Data: $\350!\371z|.\356\377\017Al\036\361,\037\345\364h\241\031m\341L"={\373\377\372\321\221a\236\222OlC\211\225"m;\371\276\275\026HA\016\256\277\253td\025\265\365\r\371W\312\210\eY\033\236\273\244\315P\275\270\317\356l\300 No. Time Source Destination Protocol Info 3766 79.649559 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#8] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594110 TSER=987608899 SLE=2699065 SRE=2710009 Frame 3766 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.265021000 [Time delta from previous captured frame: 0.000782000 seconds] [Time delta from previous displayed frame: 0.000782000 seconds] [Time since reference or first frame: 79.649559000 seconds] Frame Number: 3766 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2d (19245) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x746c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594110, TSecr 987608899 NOP NOP SACK: 2699065-2710009 left edge = 2699065 (relative) right edge = 2710009 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 8] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#8)] [Message: Duplicate ACK (#8)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3767 79.649577 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3767 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.265039000 [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 79.649577000 seconds] Frame Number: 3767 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0a70 (2672) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe7ed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2714113, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2714113 (relative sequence number) [Next sequence number: 2715481 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2873 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608905, TSecr 60594110 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3766] [The RTT to ACK the segment was: 0.000018000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3768 79.668605 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#9] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594113 TSER=987608899 SLE=2699065 SRE=2711377 Frame 3768 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.284067000 [Time delta from previous captured frame: 0.019028000 seconds] [Time delta from previous displayed frame: 0.019028000 seconds] [Time since reference or first frame: 79.668605000 seconds] Frame Number: 3768 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2e (19246) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6f11 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594113, TSecr 987608899 NOP NOP SACK: 2699065-2711377 left edge = 2699065 (relative) right edge = 2711377 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 9] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#9)] [Message: Duplicate ACK (#9)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3769 79.668634 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3769 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.284096000 [Time delta from previous captured frame: 0.000029000 seconds] [Time delta from previous displayed frame: 0.000029000 seconds] [Time since reference or first frame: 79.668634000 seconds] Frame Number: 3769 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdb61 (56161) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x16fc [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2715481, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2715481 (relative sequence number) [Next sequence number: 2716849 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9ed4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608905, TSecr 60594113 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3768] [The RTT to ACK the segment was: 0.000029000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3770 79.698478 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#10] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594116 TSER=987608899 SLE=2699065 SRE=2712745 Frame 3770 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.313940000 [Time delta from previous captured frame: 0.029844000 seconds] [Time delta from previous displayed frame: 0.029844000 seconds] [Time since reference or first frame: 79.698478000 seconds] Frame Number: 3770 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b2f (19247) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x69b6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594116, TSecr 987608899 NOP NOP SACK: 2699065-2712745 left edge = 2699065 (relative) right edge = 2712745 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 10] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#10)] [Message: Duplicate ACK (#10)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3771 79.698512 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3771 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.313974000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 79.698512000 seconds] Frame Number: 3771 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdd78 (56696) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x14e5 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2716849, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2716849 (relative sequence number) [Next sequence number: 2718217 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc6b2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608905, TSecr 60594116 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3770] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \255\336\372\350\257[\363\372\343b#\206_w\2375\t\WzW\230s\3375\270\276\to\227\021\374\0270Qj\354\326\256p\370'\031t\235\322W\342\261\f\035\352\2\036\035\025\276\357\325.&\262\343\201\200+\213\325;\337\036L\370\237\377 No. Time Source Destination Protocol Info 3772 79.728849 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3753#11] 38691 > 52904 [ACK] Seq=1 Ack=2694961 Win=87552 Len=0 TSV=60594119 TSER=987608899 SLE=2699065 SRE=2714113 Frame 3772 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.344311000 [Time delta from previous captured frame: 0.030337000 seconds] [Time delta from previous displayed frame: 0.030337000 seconds] [Time since reference or first frame: 79.728849000 seconds] Frame Number: 3772 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b30 (19248) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb379 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2694961, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2694961 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x645b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594119, TSecr 987608899 NOP NOP SACK: 2699065-2714113 left edge = 2699065 (relative) right edge = 2714113 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 11] [Duplicate to the ACK in frame: 3753] [Expert Info (Note/Sequence): Duplicate ACK (#11)] [Message: Duplicate ACK (#11)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3773 79.728892 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3773 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.344354000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 79.728892000 seconds] Frame Number: 3773 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9c7d (40061) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x55e0 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2718217, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2718217 (relative sequence number) [Next sequence number: 2719585 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf7aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608906, TSecr 60594119 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3772] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \216\3738pH\230\2261X\240\305\006[,b\214Q\354XS\210\001\300\260\373,b\214\261\223\000\250\254\266p\003C\200p\367\006\260tw\306B\240,U\251`\313\034\254\230X1A\226\0001@b\262\330\255\361#A5g\350\225\317\217\256 \030\213 No. Time Source Destination Protocol Info 3774 79.758536 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2696329 Win=86208 Len=0 TSV=60594122 TSER=987608904 SLE=2699065 SRE=2714113 Frame 3774 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.373998000 [Time delta from previous captured frame: 0.029644000 seconds] [Time delta from previous displayed frame: 0.029644000 seconds] [Time since reference or first frame: 79.758536000 seconds] Frame Number: 3774 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b31 (19249) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb378 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2696329, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2696329 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 86208 (scaled) Checksum: 0x5f10 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594122, TSecr 987608904 NOP NOP SACK: 2699065-2714113 left edge = 2699065 (relative) right edge = 2714113 (relative) No. Time Source Destination Protocol Info 3775 79.758579 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3775 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.374041000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 79.758579000 seconds] Frame Number: 3775 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe81b (59419) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0a42 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2719585, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2719585 (relative sequence number) [Next sequence number: 2720953 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7d95 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608906, TSecr 60594122 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3774] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: _\022\314\201\0252}\372\326\317\204\306F\220w/?\331\252\370AD\021Me'\2714\335\367w\357\tj\272\256A\3470a\345\371\230\202\233Hv\362\334\253-\311\v\262\301\025\337v\356.\000\000\001s\001\000\341\250\201`\270\303\270si\2 No. Time Source Destination Protocol Info 3776 79.788599 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2697697 Win=84864 Len=0 TSV=60594125 TSER=987608904 SLE=2699065 SRE=2714113 Frame 3776 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:33.404061000 [Time delta from previous captured frame: 0.030020000 seconds] [Time delta from previous displayed frame: 0.030020000 seconds] [Time since reference or first frame: 79.788599000 seconds] Frame Number: 3776 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b32 (19250) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb377 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2697697, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2697697 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 84864 (scaled) Checksum: 0x59ca [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594125, TSecr 987608904 NOP NOP SACK: 2699065-2714113 left edge = 2699065 (relative) right edge = 2714113 (relative) No. Time Source Destination Protocol Info 3777 79.788643 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3777 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.404105000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 79.788643000 seconds] Frame Number: 3777 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0e4d (3661) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe410 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2720953, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2720953 (relative sequence number) [Next sequence number: 2722321 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc502 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608906, TSecr 60594125 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3776] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \v"\031\027\211,bi\320\211\324\237\231\210\035\2254\023\031\214J\312\327"\353\22670\366u^\207\305\305\352.\252\272\256R\210\252\252\255q\271\024\366#\340O\377\377\377\377\377\177\256"\253\252\363\353\021\342 52904 [ACK] Seq=1 Ack=2714113 Win=77312 Len=0 TSV=60594128 TSER=987608905 Frame 3778 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.433952000 [Time delta from previous captured frame: 0.029847000 seconds] [Time delta from previous displayed frame: 0.029847000 seconds] [Time since reference or first frame: 79.818490000 seconds] Frame Number: 3778 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b33 (19251) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb382 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2714113, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2714113 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 77312 (scaled) Checksum: 0x994f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594128, TSecr 987608905 No. Time Source Destination Protocol Info 3779 79.818544 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3779 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.434006000 [Time delta from previous captured frame: 0.000054000 seconds] [Time delta from previous displayed frame: 0.000054000 seconds] [Time since reference or first frame: 79.818544000 seconds] Frame Number: 3779 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6479 (25721) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8de4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2722321, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2722321 (relative sequence number) [Next sequence number: 2723689 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8ee2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608907, TSecr 60594128 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3778] [The RTT to ACK the segment was: 0.000054000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: /\325W\022pI\211\370\273?\021\327\245\353\336\016\274\037x\0278\203\204+\272g\366\325W\303\376\201=UUUW\271\030\232\261\255k\211P\251k\214a-\355]\337<\023sd\230L)\006\373\211\0222\177=\332\336\252\252\270\303\002|O\25 No. Time Source Destination Protocol Info 3780 79.818551 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3780 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.434013000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 79.818551000 seconds] Frame Number: 3780 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x652c (25900) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8d31 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2723689, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2723689 (relative sequence number) [Next sequence number: 2725057 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6b85 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608907, TSecr 60594128 [SEQ/ACK analysis] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \340\226\212\253\250\274\\305\363\v\325WU\305\260Y\315\305\305\332\317\363\271K\272\214\342\353>\254\351\0271\246\204\232\227\3602\377\377\377\377\377\370\025\273\273f\305\365\377U\356$\300\252\252\265\327U\357?\020\2 No. Time Source Destination Protocol Info 3781 79.848492 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2715481 Win=87552 Len=0 TSV=60594131 TSER=987608905 Frame 3781 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.463954000 [Time delta from previous captured frame: 0.029941000 seconds] [Time delta from previous displayed frame: 0.029941000 seconds] [Time since reference or first frame: 79.848492000 seconds] Frame Number: 3781 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b34 (19252) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb381 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2715481, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2715481 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9354 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594131, TSecr 987608905 No. Time Source Destination Protocol Info 3782 79.848534 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3782 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.463996000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 79.848534000 seconds] Frame Number: 3782 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xac0a (44042) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4653 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2725057, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2725057 (relative sequence number) [Next sequence number: 2726425 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x397b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608907, TSecr 60594131 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3781] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \315\243\230\021\326\276\311\305\360[\342\272\257\261\334D\234\027_~\\313!o\263W\330H\304 !p[\275\371\277\231\b\2018*/s\250\022\335\354\245\341F<\334\233\337\031U\\337T\333\267M(\000\000\000\327\001\000\226\250\303`\2 No. Time Source Destination Protocol Info 3783 79.878475 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2716849 Win=87552 Len=0 TSV=60594134 TSER=987608905 Frame 3783 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.493937000 [Time delta from previous captured frame: 0.029941000 seconds] [Time delta from previous displayed frame: 0.029941000 seconds] [Time since reference or first frame: 79.878475000 seconds] Frame Number: 3783 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b35 (19253) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb380 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2716849, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2716849 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8df9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594134, TSecr 987608905 No. Time Source Destination Protocol Info 3784 79.878515 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3784 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.493977000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 79.878515000 seconds] Frame Number: 3784 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x142d (5165) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xde30 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2726425, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2726425 (relative sequence number) [Next sequence number: 2727793 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x12b5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608907, TSecr 60594134 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3783] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \357\327\376\006?\377\370\215bw\340>\327\261\0367\266#\304x\217\021\274G\340i\377\377\304\001\260\025T\237\315\357{\327\020(\024\317\230\263\245\n\302\363\354?\370\202\332\r\245u\303\001\020\236Ut\325yV\271R\345\363Sm No. Time Source Destination Protocol Info 3785 79.908470 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2718217 Win=87552 Len=0 TSV=60594137 TSER=987608905 Frame 3785 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.523932000 [Time delta from previous captured frame: 0.029955000 seconds] [Time delta from previous displayed frame: 0.029955000 seconds] [Time since reference or first frame: 79.908470000 seconds] Frame Number: 3785 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b36 (19254) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2718217, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2718217 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x889e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594137, TSecr 987608905 No. Time Source Destination Protocol Info 3786 79.908507 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3786 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.523969000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 79.908507000 seconds] Frame Number: 3786 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xae1b (44571) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4442 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2727793, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2727793 (relative sequence number) [Next sequence number: 2729161 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3ec1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608908, TSecr 60594137 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3785] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: r\006\213\325|\332\327rn\275yq\330\316\311\314\023\361>3\375\311\255yKU\257JD\344\270\342\017\257&\005/\003\027\201\202\205i)\202\334\253\227y*\332\327\337w$g\307\317a\002k7\331\vx:>\272\233U\276\365_K.\222\327hEWZ\36 No. Time Source Destination Protocol Info 3787 79.938815 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2719585 Win=87552 Len=0 TSV=60594140 TSER=987608906 Frame 3787 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.554277000 [Time delta from previous captured frame: 0.030308000 seconds] [Time delta from previous displayed frame: 0.030308000 seconds] [Time since reference or first frame: 79.938815000 seconds] Frame Number: 3787 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b37 (19255) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2719585, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2719585 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8342 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594140, TSecr 987608906 No. Time Source Destination Protocol Info 3788 79.938856 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3788 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.554318000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 79.938856000 seconds] Frame Number: 3788 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xef4a (61258) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0313 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2729161, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2729161 (relative sequence number) [Next sequence number: 2730529 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdf93 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608908, TSecr 60594140 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3787] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: `\270\303\273\304h\323_wL\3139\303\022\257l8\021\021U\306\030\276\333\373)$a\221;\272v\b\365\[\222\332a\n\327Jzcw1\356\262\n\245\266i\232{DV\302\355\266F8\315\0160,\315\225\203\276`\300V\252\276[\031^\333%2m\f\357=y\1 No. Time Source Destination Protocol Info 3789 79.938865 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3789 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.554327000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 79.938865000 seconds] Frame Number: 3789 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7d49 (32073) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7514 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2730529, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2730529 (relative sequence number) [Next sequence number: 2731897 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3147 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608908, TSecr 60594140 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \357\304\213\335\357|\374\322\326_.\242\276Ij\252\270\206\024\336\355\353q\221\322+\270\227\356\020|\213\225\027\272\351|\233S\177\256\345\265K\342i4\366\217\vD?(\236OP\360\252\223S\344?$R\357\316\205\326\253{\343.\25 No. Time Source Destination Protocol Info 3790 79.968851 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2720953 Win=87552 Len=0 TSV=60594143 TSER=987608906 Frame 3790 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.584313000 [Time delta from previous captured frame: 0.029986000 seconds] [Time delta from previous displayed frame: 0.029986000 seconds] [Time since reference or first frame: 79.968851000 seconds] Frame Number: 3790 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b38 (19256) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2720953, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2720953 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7de7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594143, TSecr 987608906 No. Time Source Destination Protocol Info 3791 79.968890 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3791 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.584352000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 79.968890000 seconds] Frame Number: 3791 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xde61 (56929) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x13fc [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2731897, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2731897 (relative sequence number) [Next sequence number: 2733265 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4581 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608908, TSecr 60594143 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3790] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3792 79.998928 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2722321 Win=87552 Len=0 TSV=60594146 TSER=987608906 Frame 3792 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.614390000 [Time delta from previous captured frame: 0.030038000 seconds] [Time delta from previous displayed frame: 0.030038000 seconds] [Time since reference or first frame: 79.998928000 seconds] Frame Number: 3792 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b39 (19257) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2722321, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2722321 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x788c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594146, TSecr 987608906 No. Time Source Destination Protocol Info 3793 79.998964 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3793 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.614426000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 79.998964000 seconds] Frame Number: 3793 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xde19 (56857) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1444 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2733265, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2733265 (relative sequence number) [Next sequence number: 2734633 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x640f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608908, TSecr 60594146 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3792] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \017\340\227V\236-q\030v\371f\026J\277k\354\177\205;\216\332yG\247\373\206\275\265\265/\003\332V\213\231\317\322mEn\364\3422=\257\006\f\314-\351\255f\232\230s\263\t\332\223Fu\vV\240e\3521\220\324Z\261\246o\257\264 \23 No. Time Source Destination Protocol Info 3794 80.028821 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2723689 Win=87552 Len=0 TSV=60594149 TSER=987608907 Frame 3794 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.644283000 [Time delta from previous captured frame: 0.029857000 seconds] [Time delta from previous displayed frame: 0.029857000 seconds] [Time since reference or first frame: 80.028821000 seconds] Frame Number: 3794 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3a (19258) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2723689, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2723689 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7330 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594149, TSecr 987608907 No. Time Source Destination Protocol Info 3795 80.028855 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3795 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.644317000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 80.028855000 seconds] Frame Number: 3795 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9821 (38945) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5a3c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2734633, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2734633 (relative sequence number) [Next sequence number: 2736001 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1790 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608909, TSecr 60594149 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3794] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: +"\232V\361#\266/x\235=\251\031/M\2003l\311s\241\361}\033\226\366\347\327\255\236K\356\vf\030\v\016C\236\237\250\373\266\337\252\374u\031}\003\356\265|n\357\231q\354\234t\305\331\315}NH\323\300\316\356Rx\005|G8\275r\2 No. Time Source Destination Protocol Info 3796 80.058533 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2725057 Win=87552 Len=0 TSV=60594152 TSER=987608907 Frame 3796 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.673995000 [Time delta from previous captured frame: 0.029678000 seconds] [Time delta from previous displayed frame: 0.029678000 seconds] [Time since reference or first frame: 80.058533000 seconds] Frame Number: 3796 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3b (19259) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb37a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2725057, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2725057 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6dd5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594152, TSecr 987608907 No. Time Source Destination Protocol Info 3797 80.058569 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3797 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.674031000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 80.058569000 seconds] Frame Number: 3797 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbe04 (48644) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3459 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2736001, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2736001 (relative sequence number) [Next sequence number: 2737369 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x727f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608909, TSecr 60594152 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3796] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \355H-P\242\t\315$K,\315\251\212I\342\256\000\315\2436\346k\305\222\371@jp\244\274\325SRTb\321\204\235\325\226\216\204\352\371\021\202\343:\n\246\204&\222(G\363\005\311@\374G!\f\024=\236\250\303\201\260\320@\247J\352\ No. Time Source Destination Protocol Info 3798 80.088452 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2726425 Win=87552 Len=0 TSV=60594155 TSER=987608907 Frame 3798 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.703914000 [Time delta from previous captured frame: 0.029883000 seconds] [Time delta from previous displayed frame: 0.029883000 seconds] [Time since reference or first frame: 80.088452000 seconds] Frame Number: 3798 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3c (19260) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb379 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2726425, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2726425 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x687a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594155, TSecr 987608907 No. Time Source Destination Protocol Info 3799 80.088496 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3799 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.703958000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 80.088496000 seconds] Frame Number: 3799 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa25b (41563) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5002 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2737369, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2737369 (relative sequence number) [Next sequence number: 2738737 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4470 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608909, TSecr 60594155 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3798] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \3466w\243I\237\031\354B\253t\205k\302\377\2033@\224\254\2413aU\304\314P\215%2\312\3010\022\027\2434\367\327#&*5F\220%'T\232!\200vb\205\0222.+kBL\203\264\240Cz59\325\360\224CO\331\224#\023v\360/\3335]\221\245d\212Bj\1 No. Time Source Destination Protocol Info 3800 80.118369 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2727793 Win=87552 Len=0 TSV=60594158 TSER=987608907 Frame 3800 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.733831000 [Time delta from previous captured frame: 0.029873000 seconds] [Time delta from previous displayed frame: 0.029873000 seconds] [Time since reference or first frame: 80.118369000 seconds] Frame Number: 3800 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3d (19261) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb378 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2727793, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2727793 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x631f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594158, TSecr 987608907 No. Time Source Destination Protocol Info 3801 80.118416 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3801 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.733878000 [Time delta from previous captured frame: 0.000047000 seconds] [Time delta from previous displayed frame: 0.000047000 seconds] [Time since reference or first frame: 80.118416000 seconds] Frame Number: 3801 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfe0f (65039) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf44d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2738737, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2738737 (relative sequence number) [Next sequence number: 2740105 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc80d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608910, TSecr 60594158 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3800] [The RTT to ACK the segment was: 0.000047000 seconds] [Number of bytes in flight: 27360] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3802 80.148386 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2729161 Win=87552 Len=0 TSV=60594161 TSER=987608908 Frame 3802 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.763848000 [Time delta from previous captured frame: 0.029970000 seconds] [Time delta from previous displayed frame: 0.029970000 seconds] [Time since reference or first frame: 80.148386000 seconds] Frame Number: 3802 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3e (19262) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb377 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2729161, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2729161 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5dc3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594161, TSecr 987608908 No. Time Source Destination Protocol Info 3803 80.148427 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3803 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.763889000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 80.148427000 seconds] Frame Number: 3803 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x961e (38430) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5c3f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2740105, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2740105 (relative sequence number) [Next sequence number: 2741473 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x64b2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608910, TSecr 60594161 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3802] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 28728] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3804 80.178408 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2730529 Win=87552 Len=0 TSV=60594164 TSER=987608908 Frame 3804 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.793870000 [Time delta from previous captured frame: 0.029981000 seconds] [Time delta from previous displayed frame: 0.029981000 seconds] [Time since reference or first frame: 80.178408000 seconds] Frame Number: 3804 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b3f (19263) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb376 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2730529, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2730529 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5868 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594164, TSecr 987608908 No. Time Source Destination Protocol Info 3805 80.178445 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3805 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.793907000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 80.178445000 seconds] Frame Number: 3805 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6838 (26680) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8a25 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2741473, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2741473 (relative sequence number) [Next sequence number: 2742841 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9b98 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608910, TSecr 60594164 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3804] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 30096] FTP Data [truncated] FTP Data: /<\312\027KF;\207\336\247\201\253\334\205l\024^+wJ\362m4\nO>d=\367q,.f\023\224\321r\306h\b\237\255\233\275\262f\252\345\267\305n\377\370{{\236\375\373\211Y\277.+j!\307\210yqYVW\227w\277\377\311\337^\374(\255\334\r\243 No. Time Source Destination Protocol Info 3806 80.238434 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2733265 Win=87552 Len=0 TSV=60594170 TSER=987608908 Frame 3806 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.853896000 [Time delta from previous captured frame: 0.059989000 seconds] [Time delta from previous displayed frame: 0.059989000 seconds] [Time since reference or first frame: 80.238434000 seconds] Frame Number: 3806 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b40 (19264) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb375 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2733265, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2733265 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4db2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594170, TSecr 987608908 No. Time Source Destination Protocol Info 3807 80.238484 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3807 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.853946000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 80.238484000 seconds] Frame Number: 3807 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc449 (50249) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2e14 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2742841, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2742841 (relative sequence number) [Next sequence number: 2744209 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0e74 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608911, TSecr 60594170 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3806] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \375\346\310\207\036\367n\037c\315\266@\376S\372\255\337\276\241%\032L\357\377\255kC<\317?Lw\275<}zA\320\256/\227\357 \003?Vt\246\027\322v\323zX\274x\3276\360O\277U\312S\263|8)\327\177\347)\251\2310\t\346\260\265\351\ No. Time Source Destination Protocol Info 3808 80.238494 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3808 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.853956000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 80.238494000 seconds] Frame Number: 3808 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf123 (61731) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x013a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2744209, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2744209 (relative sequence number) [Next sequence number: 2745577 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xeef1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608911, TSecr 60594170 [SEQ/ACK analysis] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \247\t\240\245Hn\364\336m\267n\306V m\305\304\341\211\333O\267+\037\n\225\346~\332\276\356+\177/\205\025\306\314\\263!qbw\332\304=\305\357yOY\242,\204\234\036\206\244\202\267\201\251w\245\370\270\251\002\a\353\230\202 No. Time Source Destination Protocol Info 3809 80.238499 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3809 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.853961000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 80.238499000 seconds] Frame Number: 3809 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xac40 (44096) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x461d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2745577, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2745577 (relative sequence number) [Next sequence number: 2746945 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd68d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608911, TSecr 60594170 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: c\256\351\337\025\334\326^E\263~\024\362\371|C\354W\313\017\330)\273\333\367\366E\t3\3337i\003\034O\002\365l\236\257<\tH*H\0033=\bC\325\277\311\337\247\246\231 52904 [ACK] Seq=1 Ack=2736001 Win=87552 Len=0 TSV=60594176 TSER=987608908 Frame 3810 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.914003000 [Time delta from previous captured frame: 0.060042000 seconds] [Time delta from previous displayed frame: 0.060042000 seconds] [Time since reference or first frame: 80.298541000 seconds] Frame Number: 3810 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b41 (19265) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb374 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2736001, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2736001 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x42fc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594176, TSecr 987608908 No. Time Source Destination Protocol Info 3811 80.298578 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3811 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.914040000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 80.298578000 seconds] Frame Number: 3811 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5a7f (23167) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x97de [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2746945, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2746945 (relative sequence number) [Next sequence number: 2748313 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2ae4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608911, TSecr 60594176 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3810] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \337J\223\345D6ct$\321c.!\305\357\216\344\307F\345M\345\321c\237\345\374\315 \211XI7iyu\254\315\355+\275r\266\237\303\373\r\311\032\265+\223\352\335\310\316\317\213\305\346v\352\366\236\3427{\302\017A\\031l\226\032\17 No. Time Source Destination Protocol Info 3812 80.298585 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3812 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.914047000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 80.298585000 seconds] Frame Number: 3812 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf921 (63777) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf93b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2748313, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2748313 (relative sequence number) [Next sequence number: 2749681 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8d63 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608911, TSecr 60594176 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: d\202\272\344\nhQH"\v\347\374\305\027\331\240\366|\317\213&\343\377&\032\244\027w\245\377\343\325\v\335\370B\312\177*\301\302\033\v\377\371t~\034\031\317\375\276\321\265\342\022\b\374u3\377\367\205\233\235\276\320\346 No. Time Source Destination Protocol Info 3813 80.358554 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2738737 Win=87552 Len=0 TSV=60594182 TSER=987608909 Frame 3813 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:33.974016000 [Time delta from previous captured frame: 0.059969000 seconds] [Time delta from previous displayed frame: 0.059969000 seconds] [Time since reference or first frame: 80.358554000 seconds] Frame Number: 3813 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b42 (19266) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb373 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2738737, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2738737 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3845 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594182, TSecr 987608909 No. Time Source Destination Protocol Info 3814 80.358598 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3814 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.974060000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 80.358598000 seconds] Frame Number: 3814 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf47b (62587) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xfde1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2749681, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2749681 (relative sequence number) [Next sequence number: 2751049 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb63a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608912, TSecr 60594182 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3813] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \025\361\246\241?0\252\276\\324\222\271b\352\341r\036\365_U\336J\365\226%\217*\231\274*t7\224j8\312\250p\002\016\343J\234\325\020\376\2243\375kN:\276\364\235#f._\265*\021\226\333x3\230\345\363\005Z\226\263\357]\372Vg\ No. Time Source Destination Protocol Info 3815 80.358606 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3815 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:33.974068000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 80.358606000 seconds] Frame Number: 3815 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x650a (25866) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8d53 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2751049, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2751049 (relative sequence number) [Next sequence number: 2752417 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xbcc2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608912, TSecr 60594182 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \331\262r\221\317\372\331\254\356Hn\022\336\373d\344\246n\253\213\024\023\255m\327\320$\252\355\3020\215"gn\352\376\307\027\222\337\016\216\317\324"'\305\324P~\262\325U\242\340\000\000\001_!\000\341\341\t\005\306\0323 No. Time Source Destination Protocol Info 3816 80.418442 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2741473 Win=87552 Len=0 TSV=60594188 TSER=987608910 Frame 3816 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.033904000 [Time delta from previous captured frame: 0.059836000 seconds] [Time delta from previous displayed frame: 0.059836000 seconds] [Time since reference or first frame: 80.418442000 seconds] Frame Number: 3816 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b43 (19267) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb372 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2741473, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2741473 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2d8e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594188, TSecr 987608910 No. Time Source Destination Protocol Info 3817 80.418481 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3817 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.033943000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 80.418481000 seconds] Frame Number: 3817 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcc69 (52329) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x25f4 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2752417, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2752417 (relative sequence number) [Next sequence number: 2753785 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2fd4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608913, TSecr 60594188 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3816] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: #\214\177/\021w{\245\314\270\255s\257\260\374\275\371\224\352*\265\372\342\251]\364\261\335\027\230V\2525_\367\277\253Qo\227\027\220\026\327iwn3\325z\177Z^\345$\232\027\345\314w\316\274\357\236\256\255\233\264\035\200 No. Time Source Destination Protocol Info 3818 80.418488 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3818 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.033950000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 80.418488000 seconds] Frame Number: 3818 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2a52 (10834) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc80b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2753785, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2753785 (relative sequence number) [Next sequence number: 2755153 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x47f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608913, TSecr 60594188 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: t\235\335\357\330&\246\373\275\330\347\033\312\027\345\037\025B\273\2539\234%^,p\373\336N[\217\253\326\351\370\234\377\273\277\022ew\022@G}\373\330\253\212\367\177\261\226\3555zi\Ww\345|\357\266\b\356\333\273\273r\341 No. Time Source Destination Protocol Info 3819 80.478690 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2744209 Win=87552 Len=0 TSV=60594194 TSER=987608910 Frame 3819 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.094152000 [Time delta from previous captured frame: 0.060202000 seconds] [Time delta from previous displayed frame: 0.060202000 seconds] [Time since reference or first frame: 80.478690000 seconds] Frame Number: 3819 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b44 (19268) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb371 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2744209, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2744209 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x22d8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594194, TSecr 987608910 No. Time Source Destination Protocol Info 3820 80.478729 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3820 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.094191000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 80.478729000 seconds] Frame Number: 3820 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6a15 (27157) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8848 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2755153, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2755153 (relative sequence number) [Next sequence number: 2756521 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x80f5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608913, TSecr 60594194 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3819] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: st\271\336\265\341\221}\313\227\177\n\373^\363\305W\233UX\375\276\332\306\352\275%\223\221.\227\250\375\211\334\275\3546\215;\2762"\356\374\250V+\276\342.\3554\366\232\315\037\253\244\272\265^\021\327_x\374\372\341\37 No. Time Source Destination Protocol Info 3821 80.478735 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3821 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.094197000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 80.478735000 seconds] Frame Number: 3821 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x861b (34331) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6c42 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2756521, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2756521 (relative sequence number) [Next sequence number: 2757889 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xecbf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608913, TSecr 60594194 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: j\vm?oz\355\204\371\377\227\341\230+\273\275\366\351\270\255\345\3617{\273\273\252\004b7w;7X\257\203!\222\256\337g\252\037\205a\256\336\333X\025n\Wu>\034\0243\223\324\266\016\3355\370L\270\253W9\3479\v\026g\265\217\23 No. Time Source Destination Protocol Info 3822 80.538795 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2746945 Win=87552 Len=0 TSV=60594200 TSER=987608911 Frame 3822 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.154257000 [Time delta from previous captured frame: 0.060060000 seconds] [Time delta from previous displayed frame: 0.060060000 seconds] [Time since reference or first frame: 80.538795000 seconds] Frame Number: 3822 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b45 (19269) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb370 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2746945, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2746945 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x1821 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594200, TSecr 987608911 No. Time Source Destination Protocol Info 3823 80.538846 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3823 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.154308000 [Time delta from previous captured frame: 0.000051000 seconds] [Time delta from previous displayed frame: 0.000051000 seconds] [Time since reference or first frame: 80.538846000 seconds] Frame Number: 3823 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9e67 (40551) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x53f6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2757889, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2757889 (relative sequence number) [Next sequence number: 2759257 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x17f3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608914, TSecr 60594200 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3822] [The RTT to ACK the segment was: 0.000051000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \325\302\311TQ\027\335\335\304\271\262\210\271i\313F\275\261\031\3107\237<\221\027\267i\317\236\216\355Uu\366\020\311\217w{\277\237\341\025\356\b\377'U\310r\356\376\204R\\330\325t\306jl\2311t\2276,F\035\027\203\253\03 No. Time Source Destination Protocol Info 3824 80.538865 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3824 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.154327000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 80.538865000 seconds] Frame Number: 3824 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdf63 (57187) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x12fa [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2759257, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2759257 (relative sequence number) [Next sequence number: 2760625 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x36c7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608914, TSecr 60594200 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \227U\314*\213\335\356h\367\322\\000\000\000\262\001\000 \332\220V\v\214\264"i{\272H\234\265\2554\351r3\212\320\256\307\210\324\3718B\022iuf\255e\022\3217\025\270\215\206B\0231}\001\b=$\025\335\365\272Y\261p\251x\2565 No. Time Source Destination Protocol Info 3825 80.538879 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3825 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.154341000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 80.538879000 seconds] Frame Number: 3825 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3100 (12544) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc15d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2760625, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2760625 (relative sequence number) [Next sequence number: 2761993 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x981a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608914, TSecr 60594200 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3826 80.608624 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2749681 Win=87552 Len=0 TSV=60594206 TSER=987608911 Frame 3826 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.224086000 [Time delta from previous captured frame: 0.069745000 seconds] [Time delta from previous displayed frame: 0.069745000 seconds] [Time since reference or first frame: 80.608624000 seconds] Frame Number: 3826 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b46 (19270) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2749681, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2749681 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0d6b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594206, TSecr 987608911 No. Time Source Destination Protocol Info 3827 80.608672 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3827 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.224134000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 80.608672000 seconds] Frame Number: 3827 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x334d (13133) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbf10 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2761993, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2761993 (relative sequence number) [Next sequence number: 2763361 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1801 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608915, TSecr 60594206 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3826] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \b\367Lq\272t\305JB\370\367S\243\326\344*\301\303\033q_n\246cA\340Nx't\245\221|\327\207\204\255\242\363R~k\243\262\250P\322\020\300\311-\254^a\fK\273Wb\275\313\035E\023\373\205\315\261\3474d\332E\262\310&\031\034s\al\ No. Time Source Destination Protocol Info 3828 80.608681 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3828 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.224143000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 80.608681000 seconds] Frame Number: 3828 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x755d (30045) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7d00 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2763361, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2763361 (relative sequence number) [Next sequence number: 2764729 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9d4b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608915, TSecr 60594206 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \226\377\265yf)\nr\220\020\350'K\004v\254\303\267\247\306\362\033/g\325z\333\314\272\334\220%V;\217\305\375\347\350\030\330\375\216=\343\351u]C\22205r-\201B\006\342\fc\020\346\236#]\337>\n\313(\231>\332B\353o\221\236\ No. Time Source Destination Protocol Info 3829 80.658708 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2752417 Win=87552 Len=0 TSV=60594212 TSER=987608912 Frame 3829 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.274170000 [Time delta from previous captured frame: 0.050027000 seconds] [Time delta from previous displayed frame: 0.050027000 seconds] [Time since reference or first frame: 80.658708000 seconds] Frame Number: 3829 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b47 (19271) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2752417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2752417 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x02b4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594212, TSecr 987608912 No. Time Source Destination Protocol Info 3830 80.658756 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3830 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.274218000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 80.658756000 seconds] Frame Number: 3830 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1b56 (6998) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd707 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2764729, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2764729 (relative sequence number) [Next sequence number: 2766097 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc870 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608915, TSecr 60594212 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3829] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \201|\026\275\020\021\031\321N]\025\235\363\370\362\034k\004g\366\003\275\274\330t^o\332L9\231\265:\225\223\276\033u\330F\314\274.\322\253\203~(I\327YJe\211]\tn\3169#5\275\307z\347|+\220o\t\310\v\003o,\346u\004\243@\3 No. Time Source Destination Protocol Info 3831 80.658765 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3831 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.274227000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 80.658765000 seconds] Frame Number: 3831 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9b44 (39748) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5719 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2766097, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2766097 (relative sequence number) [Next sequence number: 2767465 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa9c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608915, TSecr 60594212 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: J\340\365\223]1!1\231\b\275\225.\023Zt\rG\224\361\256\257\207\203\204\371dVx'\247\347\020\265\333c\274\375\216\300\260*18\037\210\340!\f\024%\216\241\b@\301\b,T\b$\361s\225\356yo\337\210mj\244N7\244\363/ \032\301\245\ No. Time Source Destination Protocol Info 3832 80.728900 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2753785 Win=87552 Len=0 TSV=60594220 TSER=987608913 Frame 3832 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.344362000 [Time delta from previous captured frame: 0.070135000 seconds] [Time delta from previous displayed frame: 0.070135000 seconds] [Time since reference or first frame: 80.728900000 seconds] Frame Number: 3832 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b48 (19272) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2753785, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2753785 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xfd52 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594220, TSecr 987608913 No. Time Source Destination Protocol Info 3833 80.728942 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3833 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.344404000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 80.728942000 seconds] Frame Number: 3833 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe02c (57388) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1231 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2767465, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2767465 (relative sequence number) [Next sequence number: 2768833 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5791 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608916, TSecr 60594220 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3832] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3834 80.958714 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2756521 Win=87552 Len=0 TSV=60594242 TSER=987608913 Frame 3834 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.574176000 [Time delta from previous captured frame: 0.229772000 seconds] [Time delta from previous displayed frame: 0.229772000 seconds] [Time since reference or first frame: 80.958714000 seconds] Frame Number: 3834 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b49 (19273) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2756521, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2756521 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf28c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594242, TSecr 987608913 No. Time Source Destination Protocol Info 3835 80.958758 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3835 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.574220000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 80.958758000 seconds] Frame Number: 3835 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6b77 (27511) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x86e6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2768833, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2768833 (relative sequence number) [Next sequence number: 2770201 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x478a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594242 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3834] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3836 80.958767 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3836 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.574229000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 80.958767000 seconds] Frame Number: 3836 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x201d (8221) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd240 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2770201, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2770201 (relative sequence number) [Next sequence number: 2771569 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2685 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594242 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \363\317_\315\265\242kW+^\345}\023\213\304~\331\244\375\332W9\210.\253\246\\364\252\346\214\265\377s\343\274UXs\315\332\255/z\345#\264\\264\261^@I\325`\351M\034\245\363\305k\304\365j\264\275,\362n\375\027\262\324\000\ No. Time Source Destination Protocol Info 3837 80.959620 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2759257 Win=87552 Len=0 TSV=60594243 TSER=987608913 Frame 3837 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.575082000 [Time delta from previous captured frame: 0.000853000 seconds] [Time delta from previous displayed frame: 0.000853000 seconds] [Time since reference or first frame: 80.959620000 seconds] Frame Number: 3837 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4a (19274) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2759257, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2759257 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe7db [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594243, TSecr 987608913 No. Time Source Destination Protocol Info 3838 80.959639 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3838 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.575101000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 80.959639000 seconds] Frame Number: 3838 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2b11 (11025) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc74c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2771569, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2771569 (relative sequence number) [Next sequence number: 2772937 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x99ba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594243 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3837] [The RTT to ACK the segment was: 0.000019000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \251\317[\213\356en\345\313\022\354\025"@\324\261\373\212\337\327\031_\027\226\355\263N\332\273\315\302\365\362\375t\372m\361\341\341&\250\257x^\255\324\356\365>\2719^.\337\346\314=\003Q\304\027\035/\037&\357\373\233\ No. Time Source Destination Protocol Info 3839 80.959648 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3839 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.575110000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 80.959648000 seconds] Frame Number: 3839 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xed1e (60702) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x053f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2772937, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2772937 (relative sequence number) [Next sequence number: 2774305 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa4df [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594243 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: Y\c7\270+\323\t\000/\347\207\335Z77\346\363{[\211\261\a\330^\274\330\3301\377\331\261KV!\353\025\227U\252\350\221\003\313\271TW\265\273Z\336\204h\001QN\303\217]\020\361A\226$\a\236r\266\322\216\a\245\2647\370\254W~\35 No. Time Source Destination Protocol Info 3840 80.959654 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3840 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.575116000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 80.959654000 seconds] Frame Number: 3840 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa151 (41297) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x510c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2774305, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2774305 (relative sequence number) [Next sequence number: 2775673 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8dba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594243 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \324\331\372U\035\030\035A\204[RiZ\000\323\r\321\302\335j`\\024\345\000\020\231A\002\216\2131i\345\274\321\224\326x"\222m\267%:"\a\244h\224cxF\372R\\246~\377\020\227\2067`\307\242\f\276;\357\372t9\206R\024\030\325z\37 No. Time Source Destination Protocol Info 3841 80.969140 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2761993 Win=87552 Len=0 TSV=60594243 TSER=987608914 Frame 3841 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.584602000 [Time delta from previous captured frame: 0.009486000 seconds] [Time delta from previous displayed frame: 0.009486000 seconds] [Time since reference or first frame: 80.969140000 seconds] Frame Number: 3841 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4b (19275) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb36a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2761993, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2761993 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xdd2a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594243, TSecr 987608914 No. Time Source Destination Protocol Info 3842 80.969200 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3842 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.584662000 [Time delta from previous captured frame: 0.000060000 seconds] [Time delta from previous displayed frame: 0.000060000 seconds] [Time since reference or first frame: 80.969200000 seconds] Frame Number: 3842 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcb30 (52016) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x272d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2775673, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2775673 (relative sequence number) [Next sequence number: 2777041 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8151 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594243 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3841] [The RTT to ACK the segment was: 0.000060000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \257\241D\0015\037d\0005\217\200ym\027\310.\036'\\177nF\314\362|\241L2\204\353\345\376\377\254m\350~|T\275\370\256\375B\230\000\212\2279\222\277\376\365\334\0347\372\371\371\276\3738\301\200\243\352\352\256U*\245\016\ No. Time Source Destination Protocol Info 3843 80.969211 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3843 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.584673000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 80.969211000 seconds] Frame Number: 3843 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1c39 (7225) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd624 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2777041, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2777041 (relative sequence number) [Next sequence number: 2778409 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa5b7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594243 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: s\234\334\344\036\322I'\037M>5]Ge\255k!Z\337\3367\345\177\346\035\2221h4\371\277\305WP\250\277w\355+K\266\210\313\373\214\233\365\334\271Q\0167\023-\302\202\244\200\251o\025\245[\223\273\355b\037Q\337\005q\320p\342\26 No. Time Source Destination Protocol Info 3844 80.979956 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2764729 Win=87552 Len=0 TSV=60594244 TSER=987608915 Frame 3844 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.595418000 [Time delta from previous captured frame: 0.010745000 seconds] [Time delta from previous displayed frame: 0.010745000 seconds] [Time since reference or first frame: 80.979956000 seconds] Frame Number: 3844 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4c (19276) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb369 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2764729, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2764729 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd278 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594244, TSecr 987608915 No. Time Source Destination Protocol Info 3845 80.979993 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3845 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.595455000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 80.979993000 seconds] Frame Number: 3845 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2177 (8567) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd0e6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2778409, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2778409 (relative sequence number) [Next sequence number: 2779777 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xbc7b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594244 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3844] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \276+\275\177\2233m\352p\003\313\035\246+\020\375\377/G\3736\320O\356s\333\373{\367\335\370v.\315\352+\aoY\020=?\275\327^\334\022\307\247\rm\367\006\210\214kM\371a\334Y\260\203 \022|\345\227kXo,`\350\027\305o\207\312\ No. Time Source Destination Protocol Info 3846 80.980002 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3846 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.595464000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 80.980002000 seconds] Frame Number: 3846 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe62e (58926) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0c2f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2779777, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2779777 (relative sequence number) [Next sequence number: 2781145 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x97e3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594244 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: ]\304q>\313\247\0203;\376sRt\214\323\300\362\377_Jdu\377\343\256\nu\373\307\237\n\373+\305\336\0352\317S\370\277\377\307 52904 [ACK] Seq=1 Ack=2767465 Win=87552 Len=0 TSV=60594245 TSER=987608915 Frame 3847 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.604627000 [Time delta from previous captured frame: 0.009163000 seconds] [Time delta from previous displayed frame: 0.009163000 seconds] [Time since reference or first frame: 80.989165000 seconds] Frame Number: 3847 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4d (19277) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb368 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2767465, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2767465 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc7c7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594245, TSecr 987608915 No. Time Source Destination Protocol Info 3848 80.989203 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3848 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.604665000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 80.989203000 seconds] Frame Number: 3848 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf210 (61968) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x004d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2781145, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2781145 (relative sequence number) [Next sequence number: 2782513 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x01cb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594245 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3847] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: (\212\256\253\377\361\035\306\361\032x\025\177\377\377\370V(`F\265+t\200\314j\f\326_\327\314(v.\311E\322\032eM\252\256\b\2102\210\370L\224n\242\351\352\253\3145u:\217\364\361\225M\374\347\022|\003\233U;\233q\361\276\3 No. Time Source Destination Protocol Info 3849 80.989211 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3849 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.604673000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 80.989211000 seconds] Frame Number: 3849 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf775 (63349) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xfae7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2782513, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2782513 (relative sequence number) [Next sequence number: 2783881 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7c4e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608918, TSecr 60594245 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \367 \217\301I3\354\3742\n\343B\373\006t@\254\222^E\206\356\214\n\305\222\201\310k\027a\365\213\211\254\037\005\266\355\251\375\274\276\272\3715Z\226\t\265\252\257\334\345\317\245?\340\246\261\267\203\213\224\212z\245 No. Time Source Destination Protocol Info 3850 81.058691 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2770201 Win=87552 Len=0 TSV=60594252 TSER=987608916 Frame 3850 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.674153000 [Time delta from previous captured frame: 0.069480000 seconds] [Time delta from previous displayed frame: 0.069480000 seconds] [Time since reference or first frame: 81.058691000 seconds] Frame Number: 3850 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4e (19278) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb367 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2770201, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2770201 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xbd0f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594252, TSecr 987608916 No. Time Source Destination Protocol Info 3851 81.058731 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3851 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.674193000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 81.058731000 seconds] Frame Number: 3851 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8810 (34832) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6a4d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2783881, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2783881 (relative sequence number) [Next sequence number: 2785249 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x08d9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608919, TSecr 60594252 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3850] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: w\275\357uL\314G3/^42\020\342\272\0252_\vx\257\234xB\367\212\334Q\237\336\370Lz\267dw\337p\237U\271}|Ag\315\361,TW\266\272\343\f3Cw\017\001A\214\034a\037\027Rq<\016\301.f&\244\347\353\234 No. Time Source Destination Protocol Info 3853 81.118488 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2772937 Win=87552 Len=0 TSV=60594258 TSER=987608918 Frame 3853 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.733950000 [Time delta from previous captured frame: 0.059748000 seconds] [Time delta from previous displayed frame: 0.059748000 seconds] [Time since reference or first frame: 81.118488000 seconds] Frame Number: 3853 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b4f (19279) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb366 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2772937, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2772937 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb257 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594258, TSecr 987608918 No. Time Source Destination Protocol Info 3854 81.118527 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3854 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.733989000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 81.118527000 seconds] Frame Number: 3854 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3842 (14402) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xba1b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2786617, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2786617 (relative sequence number) [Next sequence number: 2787985 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x50e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608920, TSecr 60594258 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3853] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \360{\377\3427\211\323\341\376$\022x\225\257]\277\362}\022\263\343\370#\273\365\362V\274\354\225_U\313\330$\2237\257\365\377\377\377\004\353\227\377Ae\005\237'\377\327\306\006\aE\323U\245uQu\360W\317\025\023\241}E\304 No. Time Source Destination Protocol Info 3855 81.118536 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3855 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.733998000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 81.118536000 seconds] Frame Number: 3855 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe554 (58708) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0d09 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2787985, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2787985 (relative sequence number) [Next sequence number: 2789353 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb343 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608920, TSecr 60594258 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \222\357\326\302\3652\366\027\036\vw\276\233\345L\v\235\234\020\361t\313L\331eSUj\334\220\212\237y/^\257,\235W&\222\255\204\220\2558\312\303\266\243F\340\341\225d\f\005\332\bS_U\212{\274\203\n\025\270\2163o \303_u^\30 No. Time Source Destination Protocol Info 3856 81.178463 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2775673 Win=87552 Len=0 TSV=60594264 TSER=987608918 Frame 3856 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.793925000 [Time delta from previous captured frame: 0.059927000 seconds] [Time delta from previous displayed frame: 0.059927000 seconds] [Time since reference or first frame: 81.178463000 seconds] Frame Number: 3856 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b50 (19280) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb365 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2775673, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2775673 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa7a1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594264, TSecr 987608918 No. Time Source Destination Protocol Info 3857 81.178515 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3857 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.793977000 [Time delta from previous captured frame: 0.000052000 seconds] [Time delta from previous displayed frame: 0.000052000 seconds] [Time since reference or first frame: 81.178515000 seconds] Frame Number: 3857 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x946b (37995) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5df2 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2789353, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2789353 (relative sequence number) [Next sequence number: 2790721 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9ae1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608920, TSecr 60594264 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3856] [The RTT to ACK the segment was: 0.000052000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \347\304w\355+O\354G.\025\254#\344\025/}j\236H,\263D\373\244\356\356\324\271"o\273\337\353\\303\304[\255\337\320\220E{\275r\260[\345\307v\323\277\026\301\025\023Us\235\002;\337\\246z\255k\r\324\031f\213\365\256\bz\255 No. Time Source Destination Protocol Info 3858 81.178529 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3858 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.793991000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 81.178529000 seconds] Frame Number: 3858 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2725 (10021) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcb38 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2790721, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2790721 (relative sequence number) [Next sequence number: 2792089 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x48f4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608920, TSecr 60594264 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \376\343\352\272\257Z\345\023\305.\314\272\355\202\030\257\305\322\025\211q\356\367&\b\026\273\ak\<=k\376\005\377\003\016+\005)\364h\240\267\022\230\264\350\252\365\333\bR\330\332\264\2763:\255T\332\246|\350\227\244\2 No. Time Source Destination Protocol Info 3859 81.178534 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3859 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.793996000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 81.178534000 seconds] Frame Number: 3859 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5827 (22567) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9a36 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2792089, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2792089 (relative sequence number) [Next sequence number: 2793457 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf730 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608920, TSecr 60594264 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3860 81.239158 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2778409 Win=87552 Len=0 TSV=60594270 TSER=987608918 Frame 3860 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.854620000 [Time delta from previous captured frame: 0.060624000 seconds] [Time delta from previous displayed frame: 0.060624000 seconds] [Time since reference or first frame: 81.239158000 seconds] Frame Number: 3860 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b51 (19281) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb364 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2778409, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2778409 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9ceb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594270, TSecr 987608918 No. Time Source Destination Protocol Info 3861 81.239203 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3861 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.854665000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 81.239203000 seconds] Frame Number: 3861 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa14e (41294) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x510f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2793457, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2793457 (relative sequence number) [Next sequence number: 2794825 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x73af [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608921, TSecr 60594270 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3860] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000!\f\0245>\307\006@\300\230P4\033\rB\tM\222-G\253\235\271M6\341\253$\342[\002)\237\222\217\005\345=\203p~\247\266oW\n\246sZ\255~\206\345d\263\306\320\363\ No. Time Source Destination Protocol Info 3862 81.239215 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3862 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.854677000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 81.239215000 seconds] Frame Number: 3862 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdd18 (56600) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1545 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2794825, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2794825 (relative sequence number) [Next sequence number: 2796193 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x603c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608921, TSecr 60594270 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \243\303!\320\211\241A,\262\246\255s\257\210\304\222\206ci\303"r(\260\251O$\325\371\263\n|\f>\315\020\316\266\365\256\231\236\036s:\236\330\354\302\r\021b\252h?\021\300!\f\024=\236\241\004a@\230\344\020K\361\235\200\2 No. Time Source Destination Protocol Info 3863 81.298468 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2781145 Win=87552 Len=0 TSV=60594276 TSER=987608918 Frame 3863 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:34.913930000 [Time delta from previous captured frame: 0.059253000 seconds] [Time delta from previous displayed frame: 0.059253000 seconds] [Time since reference or first frame: 81.298468000 seconds] Frame Number: 3863 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b52 (19282) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb363 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2781145, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2781145 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9235 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594276, TSecr 987608918 No. Time Source Destination Protocol Info 3864 81.298506 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3864 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.913968000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 81.298506000 seconds] Frame Number: 3864 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1308 (4872) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdf55 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2796193, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2796193 (relative sequence number) [Next sequence number: 2797561 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x34b4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608921, TSecr 60594276 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3863] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: .\002\310}\353\365\006b\252T\357f\375\235\200\361l\b\335\335\321a\326\025\033r\363u\232\352\230\326\233\231\bj_\202q\273\200hUn\314\275\331[\351\373\266C\235\227\253f\203qC\2725O]X\256\306]\303\035B\252#\251\314\257\0 No. Time Source Destination Protocol Info 3865 *REF* 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3865 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:34.913977000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.000000000 seconds] [This is a Time Reference frame] Frame Number: 3865 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xef2a (61226) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0333 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2797561, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2797561 (relative sequence number) [Next sequence number: 2798929 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xce83 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608921, TSecr 60594276 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \232Zn\233\244\r:}\334\373\334I?t\326=\264\310t\373\271\332\233\350\246\236\371\020\002\374Y\034+n\217\\204T\031\314\247-8\036\361\345\353\321]\276\211\202\313\200\221\vI\v\017\3467\241\235\203\261\260\261J\224\234\23 No. Time Source Destination Protocol Info 3866 0.112479 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2783881 Win=87552 Len=0 TSV=60594282 TSER=987608918 Frame 3866 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.026456000 [Time delta from previous captured frame: 0.112479000 seconds] [Time delta from previous displayed frame: 0.112479000 seconds] [Time since reference or first frame: 0.112479000 seconds] Frame Number: 3866 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b53 (19283) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb362 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2783881, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2783881 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x877f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594282, TSecr 987608918 No. Time Source Destination Protocol Info 3867 0.112519 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3867 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.026496000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 0.112519000 seconds] Frame Number: 3867 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3d35 (15669) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb528 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2798929, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2798929 (relative sequence number) [Next sequence number: 2800297 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2469 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594282 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3866] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \361\320\242\336~\035\361\245\037a*$\203\a\2665\354\315\361tWa\202\241\251'\303\361\034!\f\024e\341\205\001b \330(0R[\230\036y\243\204\016\276z\032h\232\001\234"\323\t=\006\177\210v\3112N%\306_yV\204!\201A,\213\311\23 No. Time Source Destination Protocol Info 3868 0.112527 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3868 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.026504000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.112527000 seconds] Frame Number: 3868 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2714 (10004) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcb49 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2800297, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2800297 (relative sequence number) [Next sequence number: 2801665 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd70b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594282 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3869 0.121429 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2786617 Win=87552 Len=0 TSV=60594288 TSER=987608919 Frame 3869 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.035406000 [Time delta from previous captured frame: 0.008902000 seconds] [Time delta from previous displayed frame: 0.008902000 seconds] [Time since reference or first frame: 0.121429000 seconds] Frame Number: 3869 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b54 (19284) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb361 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2786617, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2786617 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7cc8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594288, TSecr 987608919 No. Time Source Destination Protocol Info 3870 0.121466 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3870 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.035443000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 0.121466000 seconds] Frame Number: 3870 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7438 (29752) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7e25 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2801665, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2801665 (relative sequence number) [Next sequence number: 2803033 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6c29 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594288 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3869] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\000\000D\001\251\005`\270\300\354\275T\0201%\330\362\354H\225\355\21196\311\213\026\331DQVw7j\274\272\243n\246\202\026s\365\251j\371;W\204+\320\203;\340\232V-\276+\325M{\354\304W\320\344\254\246W,\000\000\000K\00 No. Time Source Destination Protocol Info 3871 0.121474 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3871 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.035451000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.121474000 seconds] Frame Number: 3871 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1831 (6193) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xda2c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2803033, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2803033 (relative sequence number) [Next sequence number: 2804401 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x68f8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594288 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \N\346\313'\323\377\374\337\377\377\372\316\355\272\272\234\222\210\374\r\277\360\344\2029\356\256\355\370Ue\343\215\255VCn\356\343G\002\253\273\302\342\244\346\227+\271{\310]A\257IXv\204\347\221\177h\272j\352\334\207 No. Time Source Destination Protocol Info 3872 0.180103 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2789353 Win=87552 Len=0 TSV=60594294 TSER=987608920 Frame 3872 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.094080000 [Time delta from previous captured frame: 0.058629000 seconds] [Time delta from previous displayed frame: 0.058629000 seconds] [Time since reference or first frame: 0.180103000 seconds] Frame Number: 3872 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b55 (19285) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb360 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2789353, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2789353 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7211 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594294, TSecr 987608920 No. Time Source Destination Protocol Info 3873 0.180139 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3873 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.094116000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 0.180139000 seconds] Frame Number: 3873 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1b28 (6952) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd735 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2804401, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2804401 (relative sequence number) [Next sequence number: 2805769 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x273e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594294 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3872] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: G\202\307\t\337&\265\a#\367\207\304\264\266\230\377\345\376\b\266\370\355x\255\345\357\020\367\227\274V\360\242\201\345\357\025\237z\370y\177\207\267\336 z\335\365\272\351]\367\326\353u\326\345\346\375\\333\264\333\36 No. Time Source Destination Protocol Info 3874 0.180153 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3874 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.094130000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 0.180153000 seconds] Frame Number: 3874 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9e7a (40570) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x53e3 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2805769, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2805769 (relative sequence number) [Next sequence number: 2807137 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe6b5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608923, TSecr 60594294 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \210Y'\241\255L\237c&\205\353\214\030,\017\317\342\274\312\020k\230*\325;p>k=cm\016o\036\307\315\374@\260/m\2322\271\271{\037\005T\245M\333\033m\267\023\203V\367\363}z\352\273\216\301_-\320d\333\365\245\245%\302ES.A\2 No. Time Source Destination Protocol Info 3875 0.269960 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2792089 Win=87552 Len=0 TSV=60594300 TSER=987608920 Frame 3875 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.183937000 [Time delta from previous captured frame: 0.089807000 seconds] [Time delta from previous displayed frame: 0.089807000 seconds] [Time since reference or first frame: 0.269960000 seconds] Frame Number: 3875 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b56 (19286) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2792089, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2792089 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x675b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594300, TSecr 987608920 No. Time Source Destination Protocol Info 3876 0.269997 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3876 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.183974000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 0.269997000 seconds] Frame Number: 3876 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa038 (41016) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5225 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2807137, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2807137 (relative sequence number) [Next sequence number: 2808505 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0ed9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608924, TSecr 60594300 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3875] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \377\366&\t\373\3246\036\t\033\301\016%\227\365'=\267\277\275vy\330\357\227\025\211$C\353hv\366d\310\356!\310D\026p\242\327\301F\367$U\311\315\330\332\317\306b\246\351\325\306\325\322\277x\337\335$\356\350\314\220\325 No. Time Source Destination Protocol Info 3877 0.270004 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3877 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.183981000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 0.270004000 seconds] Frame Number: 3877 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8425 (33829) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6e38 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2808505, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2808505 (relative sequence number) [Next sequence number: 2809873 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6cea [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608924, TSecr 60594300 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \355\311\234m\356"\2671\r\252\253\000]x\272\327\335%7\230\203\343Y\b\245\t\336\352\037\371\272qka\025\321\022\021Y\027\234\356\353\353\025\223\256\371\377_}\367\244\366\236\024U\357\376\366''}{\345\300.\024>'\016\017\ No. Time Source Destination Protocol Info 3878 0.300070 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2794825 Win=87552 Len=0 TSV=60594306 TSER=987608920 Frame 3878 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.214047000 [Time delta from previous captured frame: 0.030066000 seconds] [Time delta from previous displayed frame: 0.030066000 seconds] [Time since reference or first frame: 0.300070000 seconds] Frame Number: 3878 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b57 (19287) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2794825, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2794825 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5ca5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594306, TSecr 987608920 No. Time Source Destination Protocol Info 3879 0.300112 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3879 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.214089000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 0.300112000 seconds] Frame Number: 3879 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf938 (63800) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf924 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2809873, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2809873 (relative sequence number) [Next sequence number: 2811241 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x35c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608924, TSecr 60594306 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3878] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \253\334\246\305\177\307y\366\216d|\275o\356"f%\023\222\230\032\023\252jdE\250v\306m_\231\244\177\033\234\322\347\355\332M|\331\231\360\237AL}w\227\235Do}\017\1777\324{\200\225\271\277\267\345\377\376\252u\327\2178\25 No. Time Source Destination Protocol Info 3880 0.300121 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3880 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.214098000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.300121000 seconds] Frame Number: 3880 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5e0e (24078) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x944f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2811241, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2811241 (relative sequence number) [Next sequence number: 2812609 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xae53 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608924, TSecr 60594306 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: B"p\301=]&\322\377?\377\n\373\277\t`@3\311\347\3631\3616"\234\267\342\177\327D\210\252\235c\305F\21155:\255j\212\264\022\264,C\245\320c\261\332\255\035\235W\373\252\306\031\205k<\266\3210\243\324K\377\037\354;\032\362 No. Time Source Destination Protocol Info 3881 0.300127 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3881 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.214104000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 0.300127000 seconds] Frame Number: 3881 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe60b (58891) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0c52 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2812609, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2812609 (relative sequence number) [Next sequence number: 2813977 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x038e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608924, TSecr 60594306 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \377\376XC\3738\036\a\v\336\3169M"\2651\372\272\353B+\337}nmjN\273\334\270\255\272o/\b\340\306L\375k\365\254;7\355\330N\356\367wl\271X\ta\020*8\375\376\367\324vU:\375\177\351\241\030\377\301e+\211\321\023\377\031\357\ No. Time Source Destination Protocol Info 3882 0.389964 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2797561 Win=87552 Len=0 TSV=60594312 TSER=987608921 Frame 3882 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.303941000 [Time delta from previous captured frame: 0.089837000 seconds] [Time delta from previous displayed frame: 0.089837000 seconds] [Time since reference or first frame: 0.389964000 seconds] Frame Number: 3882 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b58 (19288) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2797561, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2797561 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x51ee [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594312, TSecr 987608921 No. Time Source Destination Protocol Info 3883 0.390004 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3883 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.303981000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 0.390004000 seconds] Frame Number: 3883 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xaa7c (43644) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x47e1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2813977, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2813977 (relative sequence number) [Next sequence number: 2815345 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x12af [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608925, TSecr 60594312 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3882] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: ^\255\224z;0;\036\352M\272\255\001\307\340\377\363\256\251\353\377}\3676\215z~\035\324\237\001\\002;m\343\274\247\242\225\214\317\247\256\225\373\367\335\312\277Q\232\363\315)\351iw}/\325n1]]D\200\216\351-\342T\003]K\ No. Time Source Destination Protocol Info 3884 0.390013 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3884 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.303990000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.390013000 seconds] Frame Number: 3884 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1f67 (8039) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd2f6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2815345, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2815345 (relative sequence number) [Next sequence number: 2816713 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1320 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608925, TSecr 60594312 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \214\367\305{\335b\351\331\341\033\301L\331:\253\327\004[\335!\b\372\252\263\263-\335\033\314M\357\261a\035\336\352\367I\370\310\213\332kU\321\201M\304=d\267\273\277\0271\202;\336\351\356+\177\035{\357w\2771\235\357-\ No. Time Source Destination Protocol Info 3885 0.469999 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2798929 Win=87552 Len=0 TSV=60594320 TSER=987608921 Frame 3885 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.383976000 [Time delta from previous captured frame: 0.079986000 seconds] [Time delta from previous displayed frame: 0.079986000 seconds] [Time since reference or first frame: 0.469999000 seconds] Frame Number: 3885 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b59 (19289) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2798929, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2798929 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4c8e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594320, TSecr 987608921 No. Time Source Destination Protocol Info 3886 0.470057 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3886 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.384034000 [Time delta from previous captured frame: 0.000058000 seconds] [Time delta from previous displayed frame: 0.000058000 seconds] [Time since reference or first frame: 0.470057000 seconds] Frame Number: 3886 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd975 (55669) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x18e8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2816713, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2816713 (relative sequence number) [Next sequence number: 2818081 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa3cf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608926, TSecr 60594320 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3885] [The RTT to ACK the segment was: 0.000058000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \336\230\250jM\357In\020\334^\370\225=\327\bQ\352t\267\035Q=\334\373\245\266r\336\363\266}\221\334\026\335\273o~\243\240\000\000\000l\001\000\341\250\201`\270\303\245\2452\364\3163$d\374\022V\276\310\301\310\225*\210\ No. Time Source Destination Protocol Info 3887 0.660097 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2801665 Win=87552 Len=0 TSV=60594342 TSER=987608923 Frame 3887 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.574074000 [Time delta from previous captured frame: 0.190040000 seconds] [Time delta from previous displayed frame: 0.190040000 seconds] [Time since reference or first frame: 0.660097000 seconds] Frame Number: 3887 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b5a (19290) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2801665, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2801665 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x41c6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594342, TSecr 987608923 No. Time Source Destination Protocol Info 3888 0.660144 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3888 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.574121000 [Time delta from previous captured frame: 0.000047000 seconds] [Time delta from previous displayed frame: 0.000047000 seconds] [Time since reference or first frame: 0.660144000 seconds] Frame Number: 3888 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfc1b (64539) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf641 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2818081, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2818081 (relative sequence number) [Next sequence number: 2819449 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7fe6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608928, TSecr 60594342 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3887] [The RTT to ACK the segment was: 0.000047000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \003$\275\376\nm\q?\005SYn\3269I\246\034y\261\227LF%\3067\361.|\000\000\001\364!\000\226\342\021\005\306aX)\275\356+\212\336\367\342\001(\313\212\342\261X\255\336+\212\305b\214V$s\f\002\260Uq^+v\2053r\314C\203\223\312 No. Time Source Destination Protocol Info 3889 0.660154 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3889 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.574131000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 0.660154000 seconds] Frame Number: 3889 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4200 (16896) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb05d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2819449, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2819449 (relative sequence number) [Next sequence number: 2820817 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe104 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608928, TSecr 60594342 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \217/\255|\333\335\357\270"\275\273\327A\360\204\276\266\372\323\025qW\315\202\240\214\031\217\336\362\261C\304\374\202\267\216Q>\370\235\002\210Q\266Bn\265WZ\344\373\004<\376\316\302\023K\300\000\000\001\a!\000p\270\ No. Time Source Destination Protocol Info 3890 0.661247 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2804401 Win=87552 Len=0 TSV=60594343 TSER=987608923 Frame 3890 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.575224000 [Time delta from previous captured frame: 0.001093000 seconds] [Time delta from previous displayed frame: 0.001093000 seconds] [Time since reference or first frame: 0.661247000 seconds] Frame Number: 3890 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b5b (19291) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb35a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2804401, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2804401 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3715 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594343, TSecr 987608923 No. Time Source Destination Protocol Info 3891 0.661267 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3891 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.575244000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 0.661267000 seconds] Frame Number: 3891 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe744 (59204) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0b19 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2820817, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2820817 (relative sequence number) [Next sequence number: 2822185 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2965 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608928, TSecr 60594343 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3890] [The RTT to ACK the segment was: 0.000020000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \017\261s\322\277{\322\236\021_VJ@\200dxX\227\273\353T\027\322\216\016A\016\2572i\025k\033\243\215\312\207._\027jq>n\373\354\265x\330\000\000\000\251\001\000\341\250\303`\270\303\257e\351\372\326\306\231\315\272\\275\ No. Time Source Destination Protocol Info 3892 0.661276 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3892 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.575253000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 0.661276000 seconds] Frame Number: 3892 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5b56 (23382) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9707 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2822185, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2822185 (relative sequence number) [Next sequence number: 2823553 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2b61 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608928, TSecr 60594343 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \345\267\252\246VNt\v\267b\363\027\273*\307RJ69\n\253^\340:\251:\026\347\377,\207\360o]\tu\341\377\n\223\f,l\353\366\373\367\026\273\031\272\235\264-W#:M)hX\220w\251*\f8\026\303u\231V'\247\335~\223vG\261\310\245\036\2 No. Time Source Destination Protocol Info 3893 0.720016 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2807137 Win=87552 Len=0 TSV=60594343 TSER=987608923 Frame 3893 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.633993000 [Time delta from previous captured frame: 0.058740000 seconds] [Time delta from previous displayed frame: 0.058740000 seconds] [Time since reference or first frame: 0.720016000 seconds] Frame Number: 3893 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b5c (19292) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb359 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2807137, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2807137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2c65 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594343, TSecr 987608923 No. Time Source Destination Protocol Info 3894 0.720053 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3894 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.634030000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 0.720053000 seconds] Frame Number: 3894 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0a36 (2614) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe827 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2823553, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2823553 (relative sequence number) [Next sequence number: 2824921 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7a1f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608929, TSecr 60594343 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3893] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \347\220Pt\355\2134\034\2334\370\375pV\312\314\253tT#\313*\356\225\317+=|\032\3727^Ve.\022\334\222\347;.8\324\345\216\317xJ\235\3423_e\257\031\333\270\356\032\\221\033\002\317\325\357,\245\260"\344\314\032\003H\316G'\ No. Time Source Destination Protocol Info 3895 0.720061 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3895 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.634038000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 0.720061000 seconds] Frame Number: 3895 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb919 (47385) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3944 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2824921, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2824921 (relative sequence number) [Next sequence number: 2826289 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9353 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608929, TSecr 60594343 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: '\271\362\222&'\202<#2\372\254\006m\236\\352\263@\356\361w\210\257\302\366\272\304\242`\242\347Q\000\246\232\2318\251\371?5-\r\263L\351\272\254\021=\204\036\242\237b\2124\233\230!:\222\353SV\001\254]*K\213h\230W:\310\ No. Time Source Destination Protocol Info 3896 0.720785 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594344 TSER=987608924 Frame 3896 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.634762000 [Time delta from previous captured frame: 0.000724000 seconds] [Time delta from previous displayed frame: 0.000724000 seconds] [Time since reference or first frame: 0.720785000 seconds] Frame Number: 3896 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b5d (19293) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb358 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x21b3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594344, TSecr 987608924 No. Time Source Destination Protocol Info 3897 0.720797 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3897 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.634774000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 0.720797000 seconds] Frame Number: 3897 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8e2f (36399) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x642e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2826289, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2826289 (relative sequence number) [Next sequence number: 2827657 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x43b7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608929, TSecr 60594344 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3896] [The RTT to ACK the segment was: 0.000012000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \200\204\214\025:\037\210\340!\f\024\025\236\221e\2420\340ld\030%\363\356z\207\305\352\273\312U\343\332\313\342\327r5\254`\271\246\316\016A\240"\210<\252\332\372\326=\261b\206\005\355\344\vK\256\253Se\262_\205\354\033 No. Time Source Destination Protocol Info 3898 0.720803 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3898 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.634780000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 0.720803000 seconds] Frame Number: 3898 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd147 (53575) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2116 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2827657, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2827657 (relative sequence number) [Next sequence number: 2829025 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdc42 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608929, TSecr 60594344 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \243\300Jo\301>[a\212x\344'\035$\351eg\n\370d\001#\002\264/\304\224[\034oH\245\277\023\031:\217$T\223K\032Q\331%7U\255'\347\341\214\023\3121\177_{\323\307JV\255\315GFU\342\017d\324\315\345\232\332\254\256\024\304\242\ No. Time Source Destination Protocol Info 3899 0.722103 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#1] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594344 TSER=987608924 SLE=2813977 SRE=2815345 Frame 3899 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.636080000 [Time delta from previous captured frame: 0.001300000 seconds] [Time delta from previous displayed frame: 0.001300000 seconds] [Time since reference or first frame: 0.722103000 seconds] Frame Number: 3899 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b5e (19294) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb34b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x562c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594344, TSecr 987608924 NOP NOP SACK: 2813977-2815345 left edge = 2813977 (relative) right edge = 2815345 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3900 0.723497 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#2] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594346 TSER=987608924 SLE=2813977 SRE=2816713 Frame 3900 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.637474000 [Time delta from previous captured frame: 0.001394000 seconds] [Time delta from previous displayed frame: 0.001394000 seconds] [Time since reference or first frame: 0.723497000 seconds] Frame Number: 3900 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b5f (19295) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb34a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x50d2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594346, TSecr 987608924 NOP NOP SACK: 2813977-2816713 left edge = 2813977 (relative) right edge = 2816713 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#2)] [Message: Duplicate ACK (#2)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3901 0.723520 89.223.234.248 x.x.x.x FTP-DATA [TCP Fast Retransmission] FTP Data: 1368 bytes Frame 3901 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.637497000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 0.723520000 seconds] Frame Number: 3901 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9678 (38520) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5be5 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2809873, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2809873 (relative sequence number) [Next sequence number: 2811241 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x90 (ACK, CWR) 1... .... = Congestion Window Reduced (CWR): Set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3514 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608929, TSecr 60594346 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3899] [The RTT to ACK the segment was: 0.001417000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) fast retransmission] [Expert Info (Warn/Sequence): Fast retransmission (suspected)] [Message: Fast retransmission (suspected)] [Severity level: Warn] [Group: Sequence] [This frame is a (suspected) retransmission] FTP Data [truncated] FTP Data: \253\334\246\305\177\307y\366\216d|\275o\356"f%\023\222\230\032\023\252jdE\250v\306m_\231\244\177\033\234\322\347\355\332M|\331\231\360\237AL}w\227\235Do}\017\1777\324{\200\225\271\277\267\345\377\376\252u\327\2178\25 No. Time Source Destination Protocol Info 3902 0.739999 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#3] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594350 TSER=987608924 SLE=2813977 SRE=2818081 Frame 3902 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.653976000 [Time delta from previous captured frame: 0.016479000 seconds] [Time delta from previous displayed frame: 0.016479000 seconds] [Time since reference or first frame: 0.739999000 seconds] Frame Number: 3902 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b60 (19296) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb349 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4b76 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594350, TSecr 987608924 NOP NOP SACK: 2813977-2818081 left edge = 2813977 (relative) right edge = 2818081 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#3)] [Message: Duplicate ACK (#3)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3903 0.760148 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#4] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594352 TSER=987608924 SLE=2813977 SRE=2819449 Frame 3903 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.674125000 [Time delta from previous captured frame: 0.020149000 seconds] [Time delta from previous displayed frame: 0.020149000 seconds] [Time since reference or first frame: 0.760148000 seconds] Frame Number: 3903 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b61 (19297) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb348 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x461c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594352, TSecr 987608924 NOP NOP SACK: 2813977-2819449 left edge = 2813977 (relative) right edge = 2819449 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#4)] [Message: Duplicate ACK (#4)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3904 0.790152 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#5] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594355 TSER=987608924 SLE=2813977 SRE=2820817 Frame 3904 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.704129000 [Time delta from previous captured frame: 0.030004000 seconds] [Time delta from previous displayed frame: 0.030004000 seconds] [Time since reference or first frame: 0.790152000 seconds] Frame Number: 3904 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b62 (19298) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb347 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x40c1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594355, TSecr 987608924 NOP NOP SACK: 2813977-2820817 left edge = 2813977 (relative) right edge = 2820817 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 5] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#5)] [Message: Duplicate ACK (#5)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3905 0.820407 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#6] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594358 TSER=987608924 SLE=2813977 SRE=2822185 Frame 3905 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.734384000 [Time delta from previous captured frame: 0.030255000 seconds] [Time delta from previous displayed frame: 0.030255000 seconds] [Time since reference or first frame: 0.820407000 seconds] Frame Number: 3905 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b63 (19299) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb346 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x3b66 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594358, TSecr 987608924 NOP NOP SACK: 2813977-2822185 left edge = 2813977 (relative) right edge = 2822185 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 6] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#6)] [Message: Duplicate ACK (#6)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3906 0.820443 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3906 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.734420000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 0.820443000 seconds] Frame Number: 3906 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1e2b (7723) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd432 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2811241, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2811241 (relative sequence number) [Next sequence number: 2812609 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xae19 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608930, TSecr 60594358 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3902] [The RTT to ACK the segment was: 0.080444000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.099640000 seconds] [RTO based on delta from frame: 3898] FTP Data [truncated] FTP Data: B"p\301=]&\322\377?\377\n\373\277\t`@3\311\347\3631\3616"\234\267\342\177\327D\210\252\235c\305F\21155:\255j\212\264\022\264,C\245\320c\261\332\255\035\235W\373\252\306\031\205k<\266\3210\243\324K\377\037\354;\032\362 No. Time Source Destination Protocol Info 3907 0.960127 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#7] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594361 TSER=987608924 SLE=2813977 SRE=2823553 Frame 3907 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.874104000 [Time delta from previous captured frame: 0.139684000 seconds] [Time delta from previous displayed frame: 0.139684000 seconds] [Time since reference or first frame: 0.960127000 seconds] Frame Number: 3907 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b64 (19300) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb345 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x360b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594361, TSecr 987608924 NOP NOP SACK: 2813977-2823553 left edge = 2813977 (relative) right edge = 2823553 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 7] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#7)] [Message: Duplicate ACK (#7)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3908 0.960177 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 3908 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.874154000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 0.960177000 seconds] Frame Number: 3908 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x341e (13342) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbe3f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2812609, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2812609 (relative sequence number) [Next sequence number: 2813977 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0350 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608931, TSecr 60594361 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3907] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.239374000 seconds] [RTO based on delta from frame: 3898] FTP Data [truncated] FTP Data: \377\376XC\3738\036\a\v\336\3169M"\2651\372\272\353B+\337}nmjN\273\334\270\255\272o/\b\340\306L\375k\365\254;7\355\330N\356\367wl\271X\ta\020*8\375\376\367\324vU:\375\177\351\241\030\377\301e+\211\321\023\377\031\357\ No. Time Source Destination Protocol Info 3909 0.960961 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#8] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594364 TSER=987608924 SLE=2813977 SRE=2824921 Frame 3909 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.874938000 [Time delta from previous captured frame: 0.000784000 seconds] [Time delta from previous displayed frame: 0.000784000 seconds] [Time since reference or first frame: 0.960961000 seconds] Frame Number: 3909 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b65 (19301) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb344 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x30b0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594364, TSecr 987608924 NOP NOP SACK: 2813977-2824921 left edge = 2813977 (relative) right edge = 2824921 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 8] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#8)] [Message: Duplicate ACK (#8)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3910 0.960980 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3910 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.874957000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.000019000 seconds] [Time since reference or first frame: 0.960980000 seconds] Frame Number: 3910 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0153 (339) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf10a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2829025, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2829025 (relative sequence number) [Next sequence number: 2830393 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x744b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608931, TSecr 60594364 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3909] [The RTT to ACK the segment was: 0.000019000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3911 0.963655 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#9] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594367 TSER=987608924 SLE=2813977 SRE=2826289 Frame 3911 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.877632000 [Time delta from previous captured frame: 0.002675000 seconds] [Time delta from previous displayed frame: 0.002675000 seconds] [Time since reference or first frame: 0.963655000 seconds] Frame Number: 3911 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b66 (19302) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb343 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2b55 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594367, TSecr 987608924 NOP NOP SACK: 2813977-2826289 left edge = 2813977 (relative) right edge = 2826289 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 9] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#9)] [Message: Duplicate ACK (#9)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3912 0.963694 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3912 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.877671000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 0.963694000 seconds] Frame Number: 3912 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe159 (57689) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1104 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2830393, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2830393 (relative sequence number) [Next sequence number: 2831761 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3f72 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608931, TSecr 60594367 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3911] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: 4b\243c{\362\027\231s\377\333\377\377\327\377\377\377\nH\0326\357\307\v\b\311\225Dq\334\262?\221rg\250\310\2702\371\000G\347\214\005m4>\304\232\022\342[\370\310\254\337fU\270\257ww\303D\031fj'\216\210\001\?\225I\215gp No. Time Source Destination Protocol Info 3913 0.966849 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#10] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594370 TSER=987608924 SLE=2813977 SRE=2827657 Frame 3913 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.880826000 [Time delta from previous captured frame: 0.003155000 seconds] [Time delta from previous displayed frame: 0.003155000 seconds] [Time since reference or first frame: 0.966849000 seconds] Frame Number: 3913 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b67 (19303) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb342 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x25fa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594370, TSecr 987608924 NOP NOP SACK: 2813977-2827657 left edge = 2813977 (relative) right edge = 2827657 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 10] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#10)] [Message: Duplicate ACK (#10)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3914 0.966887 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3914 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.880864000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 0.966887000 seconds] Frame Number: 3914 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4d5c (19804) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa501 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2831761, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2831761 (relative sequence number) [Next sequence number: 2833129 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x04de [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608931, TSecr 60594370 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3913] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: ^[\256`\250\213\273\357~(\021\Q\270\255\3160\024\216\212\335\342\261F+>\tzB\203\025\366\024\2121]\270\257t\305\035\241X\207\275\334\345\204/v\217yn\305lo\025\350$>\356\370\030\265\302\345`YK\342\371APS\324o%\354\340\3 No. Time Source Destination Protocol Info 3915 0.980156 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 3896#11] 38691 > 52904 [ACK] Seq=1 Ack=2809873 Win=87552 Len=0 TSV=60594373 TSER=987608924 SLE=2813977 SRE=2829025 Frame 3915 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.894133000 [Time delta from previous captured frame: 0.013269000 seconds] [Time delta from previous displayed frame: 0.013269000 seconds] [Time since reference or first frame: 0.980156000 seconds] Frame Number: 3915 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b68 (19304) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb341 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2809873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2809873 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x209f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594373, TSecr 987608924 NOP NOP SACK: 2813977-2829025 left edge = 2813977 (relative) right edge = 2829025 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 11] [Duplicate to the ACK in frame: 3896] [Expert Info (Note/Sequence): Duplicate ACK (#11)] [Message: Duplicate ACK (#11)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3916 0.980196 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3916 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.894173000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 0.980196000 seconds] Frame Number: 3916 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x503d (20541) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa220 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2833129, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2833129 (relative sequence number) [Next sequence number: 2834497 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x69f5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608931, TSecr 60594373 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3915] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: 'K\177\374\303\377_\306l\036\253\025\254\271\233\361\374 \225\312A\373\364\237\256|\325\253\210\360\\025\b\246\326\365\356\361f\327\343\030\364\027\337\337\226ml\312\353\325\356\215K\337\327c\n\340k\310?\377\374h\f\30 No. Time Source Destination Protocol Info 3917 1.073394 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2811241 Win=86208 Len=0 TSV=60594376 TSER=987608929 SLE=2813977 SRE=2829025 Frame 3917 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.987371000 [Time delta from previous captured frame: 0.093198000 seconds] [Time delta from previous displayed frame: 0.093198000 seconds] [Time since reference or first frame: 1.073394000 seconds] Frame Number: 3917 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b69 (19305) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb340 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2811241, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2811241 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 86208 (scaled) Checksum: 0x1b54 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594376, TSecr 987608929 NOP NOP SACK: 2813977-2829025 left edge = 2813977 (relative) right edge = 2829025 (relative) No. Time Source Destination Protocol Info 3918 1.073430 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3918 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.987407000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 1.073430000 seconds] Frame Number: 3918 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1b65 (7013) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd6f8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2834497, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2834497 (relative sequence number) [Next sequence number: 2835865 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfb7f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594376 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3917] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: PQ\221\265T\323\305\b\262\036W\3567\226\252\270\212\216\3372l\327~\3759\353m?\323K\333\025\331\227\004\266M\204\273\315OiC=T\340\351\023~\224\026\332n\346\241\214\371B\025\352\275\356W\325p\246fO7\260\221Me\212\362\32 No. Time Source Destination Protocol Info 3919 1.073441 89.223.234.248 x.x.x.x TCP [TCP Dup ACK 3918#1] 52904 > 38691 [ACK] Seq=2835865 Ack=1 Win=230000 Len=0 TSV=987608932 TSER=60594376 Frame 3919 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.987418000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 1.073441000 seconds] Frame Number: 3919 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x615b (24923) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x965a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2835865, Ack: 1, Len: 0 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2835865 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x510c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594376 [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 3918] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3920 1.078105 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2812609 Win=84864 Len=0 TSV=60594380 TSER=987608930 SLE=2813977 SRE=2829025 Frame 3920 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:35.992082000 [Time delta from previous captured frame: 0.004664000 seconds] [Time delta from previous displayed frame: 0.004664000 seconds] [Time since reference or first frame: 1.078105000 seconds] Frame Number: 3920 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b6a (19306) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2812609, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2812609 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 84864 (scaled) Checksum: 0x160c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594380, TSecr 987608930 NOP NOP SACK: 2813977-2829025 left edge = 2813977 (relative) right edge = 2829025 (relative) No. Time Source Destination Protocol Info 3921 1.078143 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3921 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.992120000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 1.078143000 seconds] Frame Number: 3921 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xed63 (60771) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x04fa [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2835865, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2835865 (relative sequence number) [Next sequence number: 2837233 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xeba0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594380 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3920] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: M\357\303\3775\336\372\005@\236\345\357\336\357\360\205'/\266\362\336\355\337\312\t\371\3772\206\235\365\177\025\025\022\027\356\275\317sH\222\302\030!\025\340ny\v\004\376\2633\t\nGe\036\254\371\226\035!\234\221o\230\ No. Time Source Destination Protocol Info 3922 1.078155 89.223.234.248 x.x.x.x TCP [TCP Dup ACK 3921#1] 52904 > 38691 [ACK] Seq=2837233 Ack=1 Win=230000 Len=0 TSV=987608932 TSER=60594380 Frame 3922 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.992132000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 1.078155000 seconds] Frame Number: 3922 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xe746 (59206) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x106f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2837233, Ack: 1, Len: 0 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2837233 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4bb0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594380 [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 3921] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 3923 1.079575 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2829025 Win=77312 Len=0 TSV=60594383 TSER=987608931 Frame 3923 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:35.993552000 [Time delta from previous captured frame: 0.001420000 seconds] [Time delta from previous displayed frame: 0.001420000 seconds] [Time since reference or first frame: 1.079575000 seconds] Frame Number: 3923 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b6b (19307) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb34a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2829025, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2829025 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 77312 (scaled) Checksum: 0xd754 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594383, TSecr 987608931 No. Time Source Destination Protocol Info 3924 1.079600 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3924 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.993577000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.000025000 seconds] [Time since reference or first frame: 1.079600000 seconds] Frame Number: 3924 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x526f (21103) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9fee [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2837233, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2837233 (relative sequence number) [Next sequence number: 2838601 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd20c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594383 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3923] [The RTT to ACK the segment was: 0.000025000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: q\300H\0041/\335\374\n\301Ip\270%\307\341tS\251\272\271qI\221E\3768\r\001\t\316g\271\351>!\301\016q\200\256\225\246\222H\266+\305b\270\371\255/\357\363\332\326\225\357\334\302\230K\212\245\377\247\351\302\230@{\033O\2 No. Time Source Destination Protocol Info 3925 1.079608 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3925 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:35.993585000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 1.079608000 seconds] Frame Number: 3925 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x522e (21038) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa02f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2838601, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2838601 (relative sequence number) [Next sequence number: 2839969 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x37bb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594383 [SEQ/ACK analysis] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \231\316\177\274W\376\265>,\374\252+*\322\227\211\335\353\025\233\031^\227u\223K\272\335n\326\371\377_|\235\254\317jW}u\271\367\353\335\345\301;\367\340\222\263n[\335\335:\334\360\334\2702\243B\203\362c\304Pk\a\211B\3 No. Time Source Destination Protocol Info 3926 1.099812 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2830393 Win=87552 Len=0 TSV=60594386 TSER=987608931 Frame 3926 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.013789000 [Time delta from previous captured frame: 0.020204000 seconds] [Time delta from previous displayed frame: 0.020204000 seconds] [Time since reference or first frame: 1.099812000 seconds] Frame Number: 3926 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b6c (19308) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb349 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2830393, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2830393 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd159 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594386, TSecr 987608931 No. Time Source Destination Protocol Info 3927 1.099848 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3927 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.013825000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 1.099848000 seconds] Frame Number: 3927 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x622d (25133) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9030 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2839969, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2839969 (relative sequence number) [Next sequence number: 2841337 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x87e8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608932, TSecr 60594386 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3926] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \262.\023\001*L@:5@\337&\016\200\027\233p\240\256z\360\356KP\236q\264\n\247\236\036\017\277\003\315\312 \317\305\3056\332Q\177~<\246\206`\v\356\3354\323S\367\377\217p\276\tWK_\322w\274v9\377\377\340\212(\000\177\2167 No. Time Source Destination Protocol Info 3928 1.431425 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2831761 Win=87552 Len=0 TSV=60594414 TSER=987608931 Frame 3928 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.345402000 [Time delta from previous captured frame: 0.331577000 seconds] [Time delta from previous displayed frame: 0.331577000 seconds] [Time since reference or first frame: 1.431425000 seconds] Frame Number: 3928 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b6d (19309) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb348 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2831761, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2831761 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xcbe5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594414, TSecr 987608931 No. Time Source Destination Protocol Info 3929 1.431466 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3929 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.345443000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 1.431466000 seconds] Frame Number: 3929 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3954 (14676) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb909 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2841337, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2841337 (relative sequence number) [Next sequence number: 2842705 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8265 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594414 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3928] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: \317Q\340\252\241X\036\301.\342J\327\005\232[\302\365A\t\021\304j\227\365\361|]\262e\343\245\216\352\rR\225\330\215\375\266\343U\021\252\3412>\025*\314\212\375\335\253\025m\305\f\215\021\220\205.J\377\377\376\b\242\20 No. Time Source Destination Protocol Info 3930 1.432100 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2833129 Win=87552 Len=0 TSV=60594414 TSER=987608931 Frame 3930 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.346077000 [Time delta from previous captured frame: 0.000634000 seconds] [Time delta from previous displayed frame: 0.000634000 seconds] [Time since reference or first frame: 1.432100000 seconds] Frame Number: 3930 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b6e (19310) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb347 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2833129, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2833129 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc68d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594414, TSecr 987608931 No. Time Source Destination Protocol Info 3931 1.432115 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3931 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.346092000 [Time delta from previous captured frame: 0.000015000 seconds] [Time delta from previous displayed frame: 0.000015000 seconds] [Time since reference or first frame: 1.432115000 seconds] Frame Number: 3931 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd57f (54655) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1cde [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2842705, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2842705 (relative sequence number) [Next sequence number: 2844073 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5747 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594414 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3930] [The RTT to ACK the segment was: 0.000015000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \353wg\334\237\340\025,r\333\270\207\376\345\316\220'\376\016\345",_]+\216\344\337\212\370PU\337\214c{\343\362/\336\335\305b\034-\335\375\361\370\004\017]]\317\377\277\377Y\027\336\373\372}\363\347\307\237\ny\247\302; No. Time Source Destination Protocol Info 3932 1.432123 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3932 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.346100000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 1.432123000 seconds] Frame Number: 3932 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8d31 (36145) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x652c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2844073, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2844073 (relative sequence number) [Next sequence number: 2845441 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa424 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594414 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \205\227\206\303\207\312\336\332z~\036\377\\321'\375w\356$\320\214\2765\fE\230\274\016\204-\016\000\034T\203\v\023\tG\320\301;<\026\025R6\360\363:\202\365\210\347+\030\024[\253\223\255\226\356n=\004\022,\325\333*\215+ No. Time Source Destination Protocol Info 3933 1.433378 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2834497 Win=87552 Len=0 TSV=60594414 TSER=987608931 Frame 3933 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.347355000 [Time delta from previous captured frame: 0.001255000 seconds] [Time delta from previous displayed frame: 0.001255000 seconds] [Time since reference or first frame: 1.433378000 seconds] Frame Number: 3933 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b6f (19311) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb346 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2834497, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2834497 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc135 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594414, TSecr 987608931 No. Time Source Destination Protocol Info 3934 1.433392 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3934 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.347369000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 1.433392000 seconds] Frame Number: 3934 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6042 (24642) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x921b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2845441, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2845441 (relative sequence number) [Next sequence number: 2846809 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x406a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594414 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3933] [The RTT to ACK the segment was: 0.000014000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \370\214'\306\226\361\032\364\370#3\016\250\214\210\275\021\216\337\274!\207\267\177\377\366\377\325\210\227w\272\353u]E\325Z6s\371\250\334x\215|\330\324\330\223(\337\343q}\237]M\221>\243\210\271\374\235\245'\256\\366 No. Time Source Destination Protocol Info 3935 1.436914 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2835865 Win=87552 Len=0 TSV=60594415 TSER=987608932 Frame 3935 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.350891000 [Time delta from previous captured frame: 0.003522000 seconds] [Time delta from previous displayed frame: 0.003522000 seconds] [Time since reference or first frame: 1.436914000 seconds] Frame Number: 3935 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b70 (19312) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb345 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2835865, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2835865 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xbbdb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594415, TSecr 987608932 No. Time Source Destination Protocol Info 3936 1.436952 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3936 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.350929000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 1.436952000 seconds] Frame Number: 3936 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0c6f (3183) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe5ee [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2846809, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2846809 (relative sequence number) [Next sequence number: 2848177 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x30ec [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594415 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3935] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \n\022\032\355\312\024\374\261\017-\356\357\343\224\306\003\032\024|7\347?\3202\207\372\301\322\344\241_\177\261\212f\375\345c\237\225q\036\\213\352_\227=\037\365\375sU\205\262'\371\022~\336\234\265\323\313\311\375\36 No. Time Source Destination Protocol Info 3937 1.438900 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2837233 Win=87552 Len=0 TSV=60594415 TSER=987608932 Frame 3937 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.352877000 [Time delta from previous captured frame: 0.001948000 seconds] [Time delta from previous displayed frame: 0.001948000 seconds] [Time since reference or first frame: 1.438900000 seconds] Frame Number: 3937 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b71 (19313) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb344 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2837233, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2837233 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb683 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594415, TSecr 987608932 No. Time Source Destination Protocol Info 3938 1.438916 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3938 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.352893000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 1.438916000 seconds] Frame Number: 3938 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd65e (54878) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1bff [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2848177, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2848177 (relative sequence number) [Next sequence number: 2849545 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x28b9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594415 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3937] [The RTT to ACK the segment was: 0.000016000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \371f[\351\233=\254e\rW\355\267|\021\305\\v8\327\247\366R\330\201a\244\207|s\232\032 52904 [ACK] Seq=1 Ack=2838601 Win=87552 Len=0 TSV=60594415 TSER=987608932 Frame 3939 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.354020000 [Time delta from previous captured frame: 0.001127000 seconds] [Time delta from previous displayed frame: 0.001127000 seconds] [Time since reference or first frame: 1.440043000 seconds] Frame Number: 3939 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b72 (19314) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb343 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2838601, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2838601 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb12b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594415, TSecr 987608932 No. Time Source Destination Protocol Info 3940 1.440059 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3940 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.354036000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 1.440059000 seconds] Frame Number: 3940 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd20a (53770) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2053 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2849545, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2849545 (relative sequence number) [Next sequence number: 2850913 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1e8c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594415 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3939] [The RTT to ACK the segment was: 0.000016000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \024\212\001\212\001\212\001\212\006X\031\307\212\033\031,\fP1@\305\f@{\031,8\331\312(\030V\247\3323b1\321u\347\337\307*\314*\273K\031\367\342\244\317/\032\222\332\027\202\033\327Z\3718\255\275\315I'\364\n$\267HWI\355 No. Time Source Destination Protocol Info 3941 1.441767 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2839969 Win=87552 Len=0 TSV=60594415 TSER=987608932 Frame 3941 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.355744000 [Time delta from previous captured frame: 0.001708000 seconds] [Time delta from previous displayed frame: 0.001708000 seconds] [Time since reference or first frame: 1.441767000 seconds] Frame Number: 3941 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b73 (19315) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb342 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2839969, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2839969 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xabd3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594415, TSecr 987608932 No. Time Source Destination Protocol Info 3942 1.441800 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3942 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.355777000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 1.441800000 seconds] Frame Number: 3942 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3443 (13379) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbe1a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2850913, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2850913 (relative sequence number) [Next sequence number: 2852281 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3a35 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594415 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3941] [The RTT to ACK the segment was: 0.000033000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\0031!\000p\270BAq\232\";\220@\312\213\304\370\227\263\027U\305\333\027\016\341RC\270T:\306HZM\247\323\217^\276\265\340\330\036\370\b^\301\301\267w\303\340"\201'\006+ \340\322-x\027\202\225]v\204\016:\365\315\ No. Time Source Destination Protocol Info 3943 1.443276 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2841337 Win=87552 Len=0 TSV=60594416 TSER=987608932 Frame 3943 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.357253000 [Time delta from previous captured frame: 0.001476000 seconds] [Time delta from previous displayed frame: 0.001476000 seconds] [Time since reference or first frame: 1.443276000 seconds] Frame Number: 3943 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b74 (19316) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb341 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2841337, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2841337 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa67a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594416, TSecr 987608932 No. Time Source Destination Protocol Info 3944 1.443293 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3944 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.357270000 [Time delta from previous captured frame: 0.000017000 seconds] [Time delta from previous displayed frame: 0.000017000 seconds] [Time since reference or first frame: 1.443293000 seconds] Frame Number: 3944 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdf4e (57166) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x130f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2852281, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2852281 (relative sequence number) [Next sequence number: 2853649 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6909 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608936, TSecr 60594416 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3943] [The RTT to ACK the segment was: 0.000017000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \337\357\035\371\004\370\273B\351\027\022\370\260\270!\213\314[\375k\353\\017\036\004\355l\333\251\263\004\341a}\247U\254\000\000\000\\001\250\201`\270\300\252\204)\214e\273\366\210k\006\254\222\243\016x\330\200\353\2 No. Time Source Destination Protocol Info 3945 1.530128 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2842705 Win=87552 Len=0 TSV=60594429 TSER=987608936 Frame 3945 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.444105000 [Time delta from previous captured frame: 0.086835000 seconds] [Time delta from previous displayed frame: 0.086835000 seconds] [Time since reference or first frame: 1.530128000 seconds] Frame Number: 3945 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b75 (19317) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb340 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2842705, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2842705 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa111 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594429, TSecr 987608936 No. Time Source Destination Protocol Info 3946 1.530173 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3946 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.444150000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 1.530173000 seconds] Frame Number: 3946 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x872f (34607) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6b2e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2853649, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2853649 (relative sequence number) [Next sequence number: 2855017 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x414a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608937, TSecr 60594429 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3945] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \214\273\213su\351+\225I\273\275\306\360\225\357}\3546<\267\276\314{\226\253z\005\235\017\256\267\306\335rt0\362dhT\214\205\027\343\213\306\362\030\301\263+I5W,'\317\216\357x\270\370sa\300\323\255qw\nn*9Q\274\376\322\ No. Time Source Destination Protocol Info 3947 1.560234 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2844073 Win=87552 Len=0 TSV=60594432 TSER=987608936 Frame 3947 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.474211000 [Time delta from previous captured frame: 0.030061000 seconds] [Time delta from previous displayed frame: 0.030061000 seconds] [Time since reference or first frame: 1.560234000 seconds] Frame Number: 3947 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b76 (19318) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2844073, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2844073 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9bb6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594432, TSecr 987608936 No. Time Source Destination Protocol Info 3948 1.560280 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3948 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.474257000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 1.560280000 seconds] Frame Number: 3948 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xad7d (44413) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x44e0 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2855017, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2855017 (relative sequence number) [Next sequence number: 2856385 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xea71 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608937, TSecr 60594432 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3947] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \327[\355\314?\316\001\252M\2757\243q\n\360\215G&\\327f\271lY\026\343j\r\322\357\304\n\201_\305i"\313\235\273\366\302\023\203\324P1LP1C\024\003\024\f-\304\226\031\016\371k\237\204\252\344\217L\231\351\374\235Wl\325\02 No. Time Source Destination Protocol Info 3949 1.593258 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2845441 Win=87552 Len=0 TSV=60594435 TSER=987608936 Frame 3949 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.507235000 [Time delta from previous captured frame: 0.032978000 seconds] [Time delta from previous displayed frame: 0.032978000 seconds] [Time since reference or first frame: 1.593258000 seconds] Frame Number: 3949 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b77 (19319) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2845441, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2845441 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x965b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594435, TSecr 987608936 No. Time Source Destination Protocol Info 3950 1.593293 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3950 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.507270000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 1.593293000 seconds] Frame Number: 3950 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd272 (53874) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1feb [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2856385, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2856385 (relative sequence number) [Next sequence number: 2857753 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xed3a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608937, TSecr 60594435 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3949] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \022hps4)Q\034\020\342\277\0232z\226\031\374,3\216\035\302\314^qf \355\374+4]V\275\363d\351\360S]\335\335\365V\340 \300\260\t\356\357\275\240v\306\314\224X\270\244"\340\267\233k]"\346\373Y\2525U\034\177\027w\373\357\2 No. Time Source Destination Protocol Info 3951 1.593301 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3951 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.507278000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 1.593301000 seconds] Frame Number: 3951 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xeb73 (60275) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x06ea [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2857753, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2857753 (relative sequence number) [Next sequence number: 2859121 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xae60 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608937, TSecr 60594435 [SEQ/ACK analysis] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \274\361\2257\326\177n\356\316n\376\373\227\334\325\370\020\003\024\321\237\323]\250\257\256!\n\276\361]\360T\022\361\325\016\204\270+8R\342\034j\247\332\255k]p2\260I\335\357\347\005=U\305x\277g\301\\370\375j\253\337\ No. Time Source Destination Protocol Info 3952 1.669989 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2848177 Win=87552 Len=0 TSV=60594441 TSER=987608936 Frame 3952 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.583966000 [Time delta from previous captured frame: 0.076688000 seconds] [Time delta from previous displayed frame: 0.076688000 seconds] [Time since reference or first frame: 1.669989000 seconds] Frame Number: 3952 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b78 (19320) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2848177, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2848177 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8ba5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594441, TSecr 987608936 No. Time Source Destination Protocol Info 3953 1.670029 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3953 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.584006000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 1.670029000 seconds] Frame Number: 3953 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3976 (14710) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb8e7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2859121, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2859121 (relative sequence number) [Next sequence number: 2860489 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x973f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608938, TSecr 60594441 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3952] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \027\253\341\260Ci\327\334Ow\325pG}\373\027\3312\312\330B\275;S\327\371a\202>O\356+{\275\362A\370<\001\221\255\325|\333\325&1\353Z(\302U|\021Zi\257qU\257USh\322\a\371\v\351\a\003\354;\240V\fFE\327Q|\377\027\265\027\24 No. Time Source Destination Protocol Info 3954 1.670045 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3954 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.584022000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 1.670045000 seconds] Frame Number: 3954 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x213d (8509) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd120 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2860489, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2860489 (relative sequence number) [Next sequence number: 2861857 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xeb3c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608938, TSecr 60594441 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3955 1.710158 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2850913 Win=87552 Len=0 TSV=60594447 TSER=987608936 Frame 3955 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.624135000 [Time delta from previous captured frame: 0.040113000 seconds] [Time delta from previous displayed frame: 0.040113000 seconds] [Time since reference or first frame: 1.710158000 seconds] Frame Number: 3955 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b79 (19321) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2850913, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2850913 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x80ef [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594447, TSecr 987608936 No. Time Source Destination Protocol Info 3956 1.710200 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3956 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.624177000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 1.710200000 seconds] Frame Number: 3956 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9f3c (40764) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5321 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2861857, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2861857 (relative sequence number) [Next sequence number: 2863225 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2a3b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608939, TSecr 60594447 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3955] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3957 1.710210 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3957 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.624187000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 1.710210000 seconds] Frame Number: 3957 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x713c (28988) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8121 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2863225, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2863225 (relative sequence number) [Next sequence number: 2864593 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe5ac [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608939, TSecr 60594447 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \356\265\217\376\353\200\212D\r>sM\016\327\233\202\352\216\227\025\267C\rr\261\177\345\364\355.\206\032\236\241\266\334|O\230\322\215:\316\026\251n\326\204\253\223\242\236~\304\274\f\315\253_\n\033\216\277i\263\211\35 No. Time Source Destination Protocol Info 3958 1.769965 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2853649 Win=87552 Len=0 TSV=60594454 TSER=987608936 Frame 3958 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.683942000 [Time delta from previous captured frame: 0.059755000 seconds] [Time delta from previous displayed frame: 0.059755000 seconds] [Time since reference or first frame: 1.769965000 seconds] Frame Number: 3958 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7a (19322) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2853649, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2853649 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7638 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594454, TSecr 987608936 No. Time Source Destination Protocol Info 3959 1.770000 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3959 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.683977000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 1.770000000 seconds] Frame Number: 3959 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb21a (45594) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4043 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2864593, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2864593 (relative sequence number) [Next sequence number: 2865961 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1206 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608939, TSecr 60594454 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3958] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: T\271\345\266\026\216\225\216\021\243Q[\301\021\350\211>'\253%a\231A\324Q\226\376\251\a\023\267\221\303\351*_\2605X\335\341\315\302\267\303kZ\005\030\234\034\340\257\227<\263\224b\234\313q\331\342\261\213#\352\216\001 No. Time Source Destination Protocol Info 3960 1.770008 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3960 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.683985000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 1.770008000 seconds] Frame Number: 3960 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xdd6e (56686) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x14ef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2865961, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2865961 (relative sequence number) [Next sequence number: 2867329 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3ed9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608939, TSecr 60594454 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \252\3211'\025\034\207\366\372f\257\026(\020\353?v\2734\353'\331^U\364\264\246\211\354<\207w\343\331\370\362 \221\345\267\214N\3337\217'\f\027e_z%\324\207\3428!\f\024e\236\227\td\240\201O{\315j\257V\340\023$\245i$\204 No. Time Source Destination Protocol Info 3961 1.830230 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2856385 Win=87552 Len=0 TSV=60594459 TSER=987608937 Frame 3961 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.744207000 [Time delta from previous captured frame: 0.060222000 seconds] [Time delta from previous displayed frame: 0.060222000 seconds] [Time since reference or first frame: 1.830230000 seconds] Frame Number: 3961 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7b (19323) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb33a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2856385, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2856385 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6b82 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594459, TSecr 987608937 No. Time Source Destination Protocol Info 3962 1.830268 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3962 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.744245000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 1.830268000 seconds] Frame Number: 3962 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1532 (5426) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdd2b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2867329, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2867329 (relative sequence number) [Next sequence number: 2868697 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6039 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608940, TSecr 60594459 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3961] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \344R\301\335\227\fk\037\330k\016\370A\254\256\216\235k:\270\275\036r*\336\267R\213.J$\322h"\271\203M\031\212\227\200\231\306\254\322\327\2627\313\215\202h\223\222\027\204\305\346\245\215Oe\345\r\347\332\211\307\200\2 No. Time Source Destination Protocol Info 3963 1.830276 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3963 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.744253000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 1.830276000 seconds] Frame Number: 3963 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd840 (55360) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1a1d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2868697, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2868697 (relative sequence number) [Next sequence number: 2870065 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb2bb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608940, TSecr 60594459 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \024M\322\212A`\320\230t\026"\b\022\361\357\307Y+\256:s\342\343\236\334\373i\251\327\b\235*\333\t\273\237x\343\245\034 \212$\314^\265\347YO\r2I\367\316{Po\003\345\307\253\372ls\243i\210\305\310\323Y\203\214M\340\236AN No. Time Source Destination Protocol Info 3964 1.890105 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2859121 Win=87552 Len=0 TSV=60594465 TSER=987608937 Frame 3964 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.804082000 [Time delta from previous captured frame: 0.059829000 seconds] [Time delta from previous displayed frame: 0.059829000 seconds] [Time since reference or first frame: 1.890105000 seconds] Frame Number: 3964 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7c (19324) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb339 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2859121, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2859121 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x60cc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594465, TSecr 987608937 No. Time Source Destination Protocol Info 3965 1.890146 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3965 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.804123000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 1.890146000 seconds] Frame Number: 3965 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0b49 (2889) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe714 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2870065, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2870065 (relative sequence number) [Next sequence number: 2871433 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc796 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608940, TSecr 60594465 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3964] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3966 1.890156 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3966 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.804133000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 1.890156000 seconds] Frame Number: 3966 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8b76 (35702) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x66e7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2871433, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2871433 (relative sequence number) [Next sequence number: 2872801 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0ff5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608940, TSecr 60594465 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: &5$\321\335T\337}xtxG\250\313\360\263\226\213\364\314s=FoZ$^(PL^;5w+\332\207t\256\363\242\303\242?\016\360\350p\227\277\262\347\356\376\371u\257\202*\257U\022,\021u1\216\374*$Dh\315Ns\322\n[\006\246ig0\234\326t*\f\330 No. Time Source Destination Protocol Info 3967 1.890162 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3967 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.804139000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 1.890162000 seconds] Frame Number: 3967 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1200 (4608) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe05d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2872801, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2872801 (relative sequence number) [Next sequence number: 2874169 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xca2e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608940, TSecr 60594465 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \252sq\322k\#\031UU6<\252\252\252\252\256\207\t\346\314\252\257\r\202\332\256\360,\322\344_:\005Qqu\027\024\305\3051qqv\305\357\231j\225\370\361\222\000\000\002\362!\000]\370\306Aq\234\t \267\027\2231N\371\276 i\317\ No. Time Source Destination Protocol Info 3968 1.950433 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2861857 Win=87552 Len=0 TSV=60594471 TSER=987608938 Frame 3968 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.864410000 [Time delta from previous captured frame: 0.060271000 seconds] [Time delta from previous displayed frame: 0.060271000 seconds] [Time since reference or first frame: 1.950433000 seconds] Frame Number: 3968 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7d (19325) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb338 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2861857, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2861857 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x5615 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594471, TSecr 987608938 No. Time Source Destination Protocol Info 3969 1.950483 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3969 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.864460000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 1.950483000 seconds] Frame Number: 3969 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8b61 (35681) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x66fc [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2874169, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2874169 (relative sequence number) [Next sequence number: 2875537 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1696 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608941, TSecr 60594471 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3968] [The RTT to ACK the segment was: 0.000050000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \036#\340v\002\037q|Hp\035,U]\227\246\372\250\231\367\242kWM\325\374\357\235\275k\211\202\256\231uE\313\311P?JL}{q\260\246\347\322aZ1\003\327\320\340y`cX\206\2231\331\321\031\374\274\275\026s\224l@4\020\320\360\006\20 No. Time Source Destination Protocol Info 3970 1.950494 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3970 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.864471000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 1.950494000 seconds] Frame Number: 3970 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3239 (12857) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc024 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2875537, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2875537 (relative sequence number) [Next sequence number: 2876905 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8384 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608941, TSecr 60594471 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000v\001\000\226\251\005`\270\304\302\035\035\354P\243_{IeD\026-\325\333\222)\234y/\276\265\t1\204\246\326\306w\321\035\b\345\356\364\312\251\325\352\314\213'\0042\260^\334)D\262\213\335>\177K\\241\023\v\210\ No. Time Source Destination Protocol Info 3971 2.009950 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2864593 Win=87552 Len=0 TSV=60594477 TSER=987608939 Frame 3971 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.923927000 [Time delta from previous captured frame: 0.059456000 seconds] [Time delta from previous displayed frame: 0.059456000 seconds] [Time since reference or first frame: 2.009950000 seconds] Frame Number: 3971 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7e (19326) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb337 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2864593, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2864593 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4b5e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594477, TSecr 987608939 No. Time Source Destination Protocol Info 3972 2.009985 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3972 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.923962000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 2.009985000 seconds] Frame Number: 3972 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5005 (20485) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa258 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2876905, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2876905 (relative sequence number) [Next sequence number: 2878273 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x944b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608942, TSecr 60594477 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3971] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: /T\252\271\031\374V\356\356\374\216\t\274\327}*&\265\301./H]$\222\256\024\313\203y\026\241\016\036\341|\227\214{q\bh\366\306\027\244\200Z\016\205\000^\005\301,\371o\025\212~.L\227\003\266\203\300\313Pq\301%V\267\311\2 No. Time Source Destination Protocol Info 3973 2.009991 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3973 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.923968000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 2.009991000 seconds] Frame Number: 3973 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x146c (5228) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xddf1 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2878273, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2878273 (relative sequence number) [Next sequence number: 2879641 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xfe31 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608942, TSecr 60594477 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \341\2277\233\306\2252\333\367\027\252\341\306\t\254\304\217~~\263\327\216\021}u_\005Z\325u\244\347\314\270|\t\002:\223\025bKPU\255\305\327\254^\270\302\f\213\223"\264\222\022\220Kb\230\236\v\227\216\330;\341\301\302\ No. Time Source Destination Protocol Info 3974 2.070671 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2867329 Win=87552 Len=0 TSV=60594483 TSER=987608939 Frame 3974 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:36.984648000 [Time delta from previous captured frame: 0.060680000 seconds] [Time delta from previous displayed frame: 0.060680000 seconds] [Time since reference or first frame: 2.070671000 seconds] Frame Number: 3974 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b7f (19327) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb336 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2867329, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2867329 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x40a8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594483, TSecr 987608939 No. Time Source Destination Protocol Info 3975 2.070717 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3975 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.984694000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 2.070717000 seconds] Frame Number: 3975 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9b46 (39750) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5717 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2879641, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2879641 (relative sequence number) [Next sequence number: 2881009 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x43c8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608942, TSecr 60594483 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3974] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \rZ\372\037UQqqLS\020sU\317\nI\313\345!\0371u]V\270B\nr\274\331\]r\343\313\315\t\325ww\347\212\213\374\330'\230\3066\245\355\250\217\231\027\250\272\252\250\272\376\232~\035\227\263\026\203\352\265Uc\362\177A\321\365\ No. Time Source Destination Protocol Info 3976 2.070730 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3976 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:36.984707000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 2.070730000 seconds] Frame Number: 3976 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7d5b (32091) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7502 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2881009, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2881009 (relative sequence number) [Next sequence number: 2882377 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf1f9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608942, TSecr 60594483 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \306:^y\245xS\212\357\351\004H*R\353\v\227\033\231\312C\205C\277\334:\025\235\372i4\301\021pg\335\275\357\327v\024\370u\016\027\203& V\234*?\331\3572\361\312'\022\221b'~\227*\202\362c*]\326!\305\210\034\374\225\355\26 No. Time Source Destination Protocol Info 3977 2.130152 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2870065 Win=87552 Len=0 TSV=60594489 TSER=987608940 Frame 3977 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.044129000 [Time delta from previous captured frame: 0.059422000 seconds] [Time delta from previous displayed frame: 0.059422000 seconds] [Time since reference or first frame: 2.130152000 seconds] Frame Number: 3977 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b80 (19328) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb335 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2870065, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2870065 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x35f1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594489, TSecr 987608940 No. Time Source Destination Protocol Info 3978 2.130243 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3978 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.044220000 [Time delta from previous captured frame: 0.000091000 seconds] [Time delta from previous displayed frame: 0.000091000 seconds] [Time since reference or first frame: 2.130243000 seconds] Frame Number: 3978 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xaa44 (43588) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4819 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2882377, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2882377 (relative sequence number) [Next sequence number: 2883745 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x314c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608943, TSecr 60594489 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3977] [The RTT to ACK the segment was: 0.000091000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \214yG\303\2305Y\327,n\347\330\270\016\205\224\2521\255\3725by\325\315D\031\252\252\215a\356\337\265\f\276t\244\266V\356w%e\254K\274e\347\333z\330\377l=\202\257\353_\255\327X\255i\025\353/6\024U\345\337\375\212_"\336\ No. Time Source Destination Protocol Info 3979 2.130254 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3979 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.044231000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.130254000 seconds] Frame Number: 3979 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4564 (17764) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xacf9 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2883745, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2883745 (relative sequence number) [Next sequence number: 2885113 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3a07 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608943, TSecr 60594489 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \322.\377\375\204\235\361\236\006\347\327\020\340r@\3248<\360\367\334\213"\273\267\275\303Q\225\036 52904 [ACK] Seq=1 Ack=2872801 Win=87552 Len=0 TSV=60594495 TSER=987608940 Frame 3980 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.104296000 [Time delta from previous captured frame: 0.060065000 seconds] [Time delta from previous displayed frame: 0.060065000 seconds] [Time since reference or first frame: 2.190319000 seconds] Frame Number: 3980 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b81 (19329) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb334 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2872801, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2872801 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2b3b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594495, TSecr 987608940 No. Time Source Destination Protocol Info 3981 2.190354 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3981 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.104331000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 2.190354000 seconds] Frame Number: 3981 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa420 (42016) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4e3d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2885113, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2885113 (relative sequence number) [Next sequence number: 2886481 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8a67 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608943, TSecr 60594495 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3980] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \261\303\2234\232\336\257\367\003\320k\270x\255\210p\341\311$V\275\261\317\177!k\326\233\277\265G\276\205,\244\205\227{\364\342\a\336+\205\025O\265\276E\360!\275\367\353_i`\352\nB\022z\353\346\311\272\236y\260\234\251 No. Time Source Destination Protocol Info 3982 2.190362 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3982 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.104339000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 2.190362000 seconds] Frame Number: 3982 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0950 (2384) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe90d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2886481, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2886481 (relative sequence number) [Next sequence number: 2887849 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4f5e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608943, TSecr 60594495 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: &cU\231\325\020%\236\a\216\226NNV(\221\231\2161\207\313\037\347\2033\005{R\344(+\251\274>k-\351\224\\235\334\367(\000\352H\251\371\026\311\005R#b\032\357\255\367\334C\017Z0w\220\344/\203\271\215N\a\315J.\321\260c\213\ No. Time Source Destination Protocol Info 3983 2.250323 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2875537 Win=87552 Len=0 TSV=60594501 TSER=987608940 Frame 3983 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.164300000 [Time delta from previous captured frame: 0.059961000 seconds] [Time delta from previous displayed frame: 0.059961000 seconds] [Time since reference or first frame: 2.250323000 seconds] Frame Number: 3983 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b82 (19330) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb333 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2875537, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2875537 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2085 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594501, TSecr 987608940 No. Time Source Destination Protocol Info 3984 2.250357 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3984 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.164334000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 2.250357000 seconds] Frame Number: 3984 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x041e (1054) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xee3f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2887849, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2887849 (relative sequence number) [Next sequence number: 2889217 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x70b7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608944, TSecr 60594501 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3983] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: 7\326Q\205\001\243\201\376'\212\376\214\b|\331|\317\375\022\303\376\3752\215RtF\022\252\365zp+\252\217\355\360\263%\357\306V\227$\0253\a?7&\311D+\366\351\355\364\233\254\276\305!\215\271\234=\034\231s\272\325;\325#eK\ No. Time Source Destination Protocol Info 3985 2.250364 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3985 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.164341000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 2.250364000 seconds] Frame Number: 3985 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x091f (2335) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe93e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2889217, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2889217 (relative sequence number) [Next sequence number: 2890585 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8527 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608944, TSecr 60594501 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: m\317u\025\306\375\351\005\3575u\365z\266oq\203\021/\335\342\273\334W\355\304xm\266qWw\363e~W\377\v\315h^k\336r*\302:R\350#\bH#Dl\372\327\030\240\335n4UO? "\211\346\276EZ\256:\374\343/\353\365\324u\375\363\004\365|\37 No. Time Source Destination Protocol Info 3986 2.250368 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3986 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.164345000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 2.250368000 seconds] Frame Number: 3986 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9044 (36932) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6219 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2890585, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2890585 (relative sequence number) [Next sequence number: 2891953 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1188 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608944, TSecr 60594501 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \234\306*\253\242\321\321\355zW\276\304&H":w\273\177\376Z\025$\004.\247\367/\257\373m\276\356.N,\362r\271\023I\305wE\002\200\224m\211\216\001@z*\364\\006>>=% \274\017\273\267\263Mw}5qQ!5\201\326\227\214\275\2651K\262\ No. Time Source Destination Protocol Info 3987 2.310424 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2878273 Win=87552 Len=0 TSV=60594507 TSER=987608941 Frame 3987 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.224401000 [Time delta from previous captured frame: 0.060056000 seconds] [Time delta from previous displayed frame: 0.060056000 seconds] [Time since reference or first frame: 2.310424000 seconds] Frame Number: 3987 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b83 (19331) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb332 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2878273, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2878273 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x15ce [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594507, TSecr 987608941 No. Time Source Destination Protocol Info 3988 2.310465 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3988 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.224442000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 2.310465000 seconds] Frame Number: 3988 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6d03 (27907) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x855a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2891953, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2891953 (relative sequence number) [Next sequence number: 2893321 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xacb8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608945, TSecr 60594507 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3987] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \352\275\365\3572\364\324O2\367\217\254\340\212^\307\367\265\356\253\314\306@\000\000\001%!\000\341\341\t\005\306\036*\t6\333Yt\201\026f&c\272k\335W\273\021\331\373/\224\023^}\243mr\353\323\005\223v\242&\2631\312g_2(\ No. Time Source Destination Protocol Info 3989 2.310474 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3989 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.224451000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 2.310474000 seconds] Frame Number: 3989 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x803c (32828) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7221 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2893321, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2893321 (relative sequence number) [Next sequence number: 2894689 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x00eb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608945, TSecr 60594507 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: ;\355\270\342\a\002\216\325~\272a\016\224\230\372/\t\306e\300\330<8\372p\342\235\023\201\370\270\260\275\205\323\356\335\360\352\031\035<-Gp}\201z\234r.\355\356\367\320\360\224G\031\233\273\3434\f\267v\f\327\270\363\2 No. Time Source Destination Protocol Info 3990 2.370027 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2881009 Win=87552 Len=0 TSV=60594513 TSER=987608942 Frame 3990 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.284004000 [Time delta from previous captured frame: 0.059553000 seconds] [Time delta from previous displayed frame: 0.059553000 seconds] [Time since reference or first frame: 2.370027000 seconds] Frame Number: 3990 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b84 (19332) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb331 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2881009, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2881009 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0b17 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594513, TSecr 987608942 No. Time Source Destination Protocol Info 3991 2.370068 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3991 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.284045000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 2.370068000 seconds] Frame Number: 3991 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7920 (31008) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x793d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2894689, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2894689 (relative sequence number) [Next sequence number: 2896057 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdd63 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608945, TSecr 60594513 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3990] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: Q\020C\335\342\346\361GF@\217u\364\356\344\023&\345cq\260\000\000\000\217\001\000\341\250\201`\270\303\267\272\274\216B\336\374\335\313\033\240\2247u=\276\273\367;\234\021]\357[\252\273\276\332f\325\264\256\224\211\03 No. Time Source Destination Protocol Info 3992 2.370077 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3992 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.284054000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 2.370077000 seconds] Frame Number: 3992 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3371 (13169) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbeec [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2896057, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2896057 (relative sequence number) [Next sequence number: 2897425 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xde97 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608945, TSecr 60594513 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: +2\361\373\276\025\016g\205\377wM\321(\304\265\bB\276-s>a|\360K\246\262\232\214\227\363=\r\350O\030)e\313\366\256t\3762\253\323i\315\231v\210M\211\346W\211\2511z\026\274a\025\210G\363\220\267\275\314\274G5z\344\255szB No. Time Source Destination Protocol Info 3993 2.470512 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2883745 Win=87552 Len=0 TSV=60594519 TSER=987608942 Frame 3993 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.384489000 [Time delta from previous captured frame: 0.100435000 seconds] [Time delta from previous displayed frame: 0.100435000 seconds] [Time since reference or first frame: 2.470512000 seconds] Frame Number: 3993 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b85 (19333) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb330 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2883745, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2883745 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0061 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594519, TSecr 987608942 No. Time Source Destination Protocol Info 3994 2.470552 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3994 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.384529000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 2.470552000 seconds] Frame Number: 3994 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2d24 (11556) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc539 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2897425, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2897425 (relative sequence number) [Next sequence number: 2898793 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x79dd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608946, TSecr 60594519 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3993] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \241u\337\257D\350\342\252\255w\177-\265\2565.\273U\223\352\303 \356\026\a!;\336\251\313\t\213\265\243}\334\210\372\247\253J\326\342\250U.aBpWw\376\213\332\003\034\2077<9"\253\312\231\207\270\276\227\306\204\3042\273\ No. Time Source Destination Protocol Info 3995 2.470563 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3995 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.384540000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.470563000 seconds] Frame Number: 3995 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8652 (34386) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6c0b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2898793, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2898793 (relative sequence number) [Next sequence number: 2900161 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x96fd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608946, TSecr 60594519 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 3996 2.590426 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2886481 Win=87552 Len=0 TSV=60594535 TSER=987608943 Frame 3996 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.504403000 [Time delta from previous captured frame: 0.119863000 seconds] [Time delta from previous displayed frame: 0.119863000 seconds] [Time since reference or first frame: 2.590426000 seconds] Frame Number: 3996 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b86 (19334) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2886481, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2886481 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf59f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594535, TSecr 987608943 No. Time Source Destination Protocol Info 3997 2.590470 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3997 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.504447000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 2.590470000 seconds] Frame Number: 3997 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7c66 (31846) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x75f7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2900161, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2900161 (relative sequence number) [Next sequence number: 2901529 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x28ba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608947, TSecr 60594535 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3996] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \n/\344\242(\277\312\347|3\250\3144\352\341\331\264M\310.\330~\215\021\276 \345\212~\021\340/\224_\026#\301\002\025\025[\300\363{<&\242&\226'\215=\210\257\272D\244~\226J\365"t\370\326%\027\362\354e\2318\313\326>\370\3 No. Time Source Destination Protocol Info 3998 2.590490 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 3998 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.504467000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 2.590490000 seconds] Frame Number: 3998 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7308 (29448) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7f55 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2901529, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2901529 (relative sequence number) [Next sequence number: 2902897 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x58ba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608947, TSecr 60594535 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \205C"\243E\000\037z\326\255;%C\224\3167Zf\366\371\343:\365\017\275\350\237\367U\261]\207\177\255\371\216\025U\306\bz\205\276\261!\300\352\3625\025\251\332\216MCO\234\332c{N\323\342_\027SH\231K\256\230\320p\327\322#\2 No. Time Source Destination Protocol Info 3999 2.591368 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2889217 Win=87552 Len=0 TSV=60594535 TSER=987608943 Frame 3999 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.505345000 [Time delta from previous captured frame: 0.000878000 seconds] [Time delta from previous displayed frame: 0.000878000 seconds] [Time since reference or first frame: 2.591368000 seconds] Frame Number: 3999 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b87 (19335) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2889217, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2889217 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xeaef [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594535, TSecr 987608943 No. Time Source Destination Protocol Info 4000 2.591382 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4000 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.505359000 [Time delta from previous captured frame: 0.000014000 seconds] [Time delta from previous displayed frame: 0.000014000 seconds] [Time since reference or first frame: 2.591382000 seconds] Frame Number: 4000 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7070 (28784) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x81ed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2902897, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2902897 (relative sequence number) [Next sequence number: 2904265 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe5d8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608947, TSecr 60594535 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3999] [The RTT to ACK the segment was: 0.000014000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \255Ph5\263\301:\035\354\261\227Um\227s}\333\314"\255\364&3\241\361\344\332\345\r&\360\310>\212\252\321\212\037\250\000\205M\303\36670J\236U\355!G\257\005\352\361\227n\031\301\367\275Q\307)8\255\374O\277;7\211\251\021 No. Time Source Destination Protocol Info 4001 2.591390 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4001 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.505367000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 2.591390000 seconds] Frame Number: 4001 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9135 (37173) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6128 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2904265, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2904265 (relative sequence number) [Next sequence number: 2905633 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xca61 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608947, TSecr 60594535 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \363\217\257\037\272\336e?\3347G\274\355\030\G-\243\325hr\005]\200\237\217J\313\377\215\033\003\230\3417,|p\032\035\271\272\331#W\333U\224W\252i\370,_c\355\373\377!\316\361}\2333\265\346~\202\261.\235\356\260>\021\376 No. Time Source Destination Protocol Info 4002 2.669856 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2891953 Win=87552 Len=0 TSV=60594539 TSER=987608944 Frame 4002 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.583833000 [Time delta from previous captured frame: 0.078466000 seconds] [Time delta from previous displayed frame: 0.078466000 seconds] [Time since reference or first frame: 2.669856000 seconds] Frame Number: 4002 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b88 (19336) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2891953, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2891953 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe03a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594539, TSecr 987608944 No. Time Source Destination Protocol Info 4003 2.669896 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4003 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.583873000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 2.669896000 seconds] Frame Number: 4003 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf070 (61552) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x01ed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2905633, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2905633 (relative sequence number) [Next sequence number: 2907001 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7682 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608948, TSecr 60594539 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4002] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \205= 52904 [ACK] Seq=1 Ack=2894689 Win=87552 Len=0 TSV=60594545 TSER=987608945 Frame 4006 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.614116000 [Time delta from previous captured frame: 0.030232000 seconds] [Time delta from previous displayed frame: 0.030232000 seconds] [Time since reference or first frame: 2.700139000 seconds] Frame Number: 4006 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b89 (19337) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2894689, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2894689 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd583 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594545, TSecr 987608945 No. Time Source Destination Protocol Info 4007 2.700176 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4007 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.614153000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 2.700176000 seconds] Frame Number: 4007 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa602 (42498) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4c5b [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2909737, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2909737 (relative sequence number) [Next sequence number: 2911105 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6c3a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608948, TSecr 60594545 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4006] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: ?\350\365\255\232\356\372P\210N\356\376\034\031,>\030X\346@H\037\204;\273\352\356\374/x>\233\025\336\301\350\260IZ\213\333`\1770(\362\345Rn\262\000BA\350\t\000\270(\325E\365Z\302\355\336\034\342\3554\222\252\205\216<\ No. Time Source Destination Protocol Info 4008 2.700183 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4008 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.614160000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 2.700183000 seconds] Frame Number: 4008 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7f28 (32552) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7335 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2911105, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2911105 (relative sequence number) [Next sequence number: 2912473 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9876 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608948, TSecr 60594545 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \337\321\335\331\326\344\f\332L\016\230\022\235\314\271(\270|\t \247J+\332Sf\253~\033\f\3648\022`\313Y+\221'\213\307\v\272m\027\267\277\023tn\332\364\275k\257D\257[\346}U\272\232\253\253\023\\235Wp\306\360\340\t\265\2 No. Time Source Destination Protocol Info 4009 2.752908 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2897425 Win=87552 Len=0 TSV=60594551 TSER=987608945 Frame 4009 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.666885000 [Time delta from previous captured frame: 0.052725000 seconds] [Time delta from previous displayed frame: 0.052725000 seconds] [Time since reference or first frame: 2.752908000 seconds] Frame Number: 4009 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8a (19338) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2897425, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2897425 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xcacd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594551, TSecr 987608945 No. Time Source Destination Protocol Info 4010 2.752953 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4010 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.666930000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 2.752953000 seconds] Frame Number: 4010 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb247 (45639) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4016 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2912473, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2912473 (relative sequence number) [Next sequence number: 2913841 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4468 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608949, TSecr 60594551 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4009] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \227\362\377\337\273\366\211\302^/\220\346\325\022\300\000\000\0024!\000 \3361\220\f \300\207\237\036^\274O\203%\177\004\2764F\257Z\360\237\230,\275\353\247\327\317\304\v\3468\250\272\357\245\214\023\300\260={\201l:\2 No. Time Source Destination Protocol Info 4011 2.752965 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4011 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.666942000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 2.752965000 seconds] Frame Number: 4011 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x883a (34874) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6a23 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2913841, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2913841 (relative sequence number) [Next sequence number: 2915209 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe59a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608949, TSecr 60594551 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: p\016\355W\257R\244\226+x^\260\026@K\bZh\]\305x\206\217\310\302 \360\021\002\031;\375\223\016\202!\376+\270\255\356\357\n\360R 52904 [ACK] Seq=1 Ack=2900161 Win=87552 Len=0 TSV=60594557 TSER=987608946 Frame 4012 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.724513000 [Time delta from previous captured frame: 0.057571000 seconds] [Time delta from previous displayed frame: 0.057571000 seconds] [Time since reference or first frame: 2.810536000 seconds] Frame Number: 4012 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8b (19339) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb32a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2900161, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2900161 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc016 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594557, TSecr 987608946 No. Time Source Destination Protocol Info 4013 2.810575 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4013 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.724552000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 2.810575000 seconds] Frame Number: 4013 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xce0d (52749) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2450 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2915209, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2915209 (relative sequence number) [Next sequence number: 2916577 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xdc34 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608950, TSecr 60594557 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4012] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \000\275\001\000]\371\aB\343\024\376 \337%W\312$F|\313g\223YbL\npk\322;\3754\203d\370\233\321N\030\tA&\016f\314\\277\327\375\257k]5\213\352\347!\t}\362\277\377\271;\276\253\027\177-\354\225_\r\237\322\327\020k\271\267 No. Time Source Destination Protocol Info 4014 2.810585 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4014 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.724562000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 2.810585000 seconds] Frame Number: 4014 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6c0c (27660) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8651 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2916577, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2916577 (relative sequence number) [Next sequence number: 2917945 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcf97 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608950, TSecr 60594557 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: |\375\234V\217T\213Y\212\342\201~\236YM\366\372r\345{Y(\3424\232\036Ce\275\362Ek\337\254Y\271\2558\302\v\212\215\367U\036\247\340\304j\206\225}\b\322,`e\353u\226\001\222\311\374\340\301\354Ltu\242\017n!\301\237~\023uK No. Time Source Destination Protocol Info 4015 2.870903 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2902897 Win=87552 Len=0 TSV=60594563 TSER=987608947 Frame 4015 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.784880000 [Time delta from previous captured frame: 0.060318000 seconds] [Time delta from previous displayed frame: 0.060318000 seconds] [Time since reference or first frame: 2.870903000 seconds] Frame Number: 4015 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8c (19340) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb329 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2902897, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2902897 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb55f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594563, TSecr 987608947 No. Time Source Destination Protocol Info 4016 2.870939 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4016 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.784916000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 2.870939000 seconds] Frame Number: 4016 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3a2b (14891) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb832 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2917945, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2917945 (relative sequence number) [Next sequence number: 2919313 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8cf9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608950, TSecr 60594563 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4015] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: $\343\2348\360\306\321\212e\240\274+\201\017\321Em\377\373k\244e\302eU\026\357H\274\235\361\035\244{\357\237\364\373\265\367\313\273\345\305x\366\355\006\360\247\210r!\310\3350f\0346\375U\3776F\236\264\366\323\360\262 No. Time Source Destination Protocol Info 4017 2.870947 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4017 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.784924000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 2.870947000 seconds] Frame Number: 4017 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x185f (6239) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd9fe [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2919313, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2919313 (relative sequence number) [Next sequence number: 2920681 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5845 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608950, TSecr 60594563 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \326\225\373\353H\006\016}\3717V\367K_X\343\022_\326\253\0208^\371;\357H\377\245\342;_\200\000\000\aG%\000\341\270 !q\237\377\370"\212\000\037\035\257\024g\3049\327\212\336!\377\377\3036\357\273\357\327\207\366\305\26 No. Time Source Destination Protocol Info 4018 2.938485 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2905633 Win=87552 Len=0 TSV=60594569 TSER=987608947 Frame 4018 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.852462000 [Time delta from previous captured frame: 0.067538000 seconds] [Time delta from previous displayed frame: 0.067538000 seconds] [Time since reference or first frame: 2.938485000 seconds] Frame Number: 4018 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8d (19341) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb328 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2905633, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2905633 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xaaa9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594569, TSecr 987608947 No. Time Source Destination Protocol Info 4019 2.938531 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4019 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.852508000 [Time delta from previous captured frame: 0.000046000 seconds] [Time delta from previous displayed frame: 0.000046000 seconds] [Time since reference or first frame: 2.938531000 seconds] Frame Number: 4019 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2149 (8521) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd114 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2920681, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2920681 (relative sequence number) [Next sequence number: 2922049 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x59db [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608951, TSecr 60594569 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4018] [The RTT to ACK the segment was: 0.000046000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: m\264\250\305\315\255\235\022\263\n\377\326\375w/N\371>\317m 52904 [ACK] Seq=1 Ack=2908369 Win=87552 Len=0 TSV=60594575 TSER=987608948 Frame 4021 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.905720000 [Time delta from previous captured frame: 0.053201000 seconds] [Time delta from previous displayed frame: 0.053201000 seconds] [Time since reference or first frame: 2.991743000 seconds] Frame Number: 4021 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8e (19342) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb327 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2908369, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2908369 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9ff2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594575, TSecr 987608948 No. Time Source Destination Protocol Info 4022 2.991786 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4022 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.905763000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 2.991786000 seconds] Frame Number: 4022 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5e10 (24080) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x944d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2923417, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2923417 (relative sequence number) [Next sequence number: 2924785 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5310 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608951, TSecr 60594575 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4021] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \234\304=\352\343~\300\300Mg\230\276\257\305\377[\2203~\t\246\307\233Gt\031\264|4M\347\361\227a\334Q\352\264\246\r\001\364\030-^\265\251\2233U\224\253_\2237\352\254Vr\026\233\212{\314P\377\333"\021\322#t\331\262\366\3 No. Time Source Destination Protocol Info 4023 2.991797 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4023 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.905774000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 2.991797000 seconds] Frame Number: 4023 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xff00 (65280) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf35c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2924785, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2924785 (relative sequence number) [Next sequence number: 2926153 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x013f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608951, TSecr 60594575 [SEQ/ACK analysis] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: UQj\263\245b\034\227\2678s\332LC\202\345\264\217\254\234_\246,E\345\304\273\322,n_vv\354,\373\206\313\356\341j\216\246]\027\212\334Q\323\001\217&\034*\372\bq]O\373\317\v\027\255\226\002\373\r\305\362F\317\355\332\306\ No. Time Source Destination Protocol Info 4024 2.991802 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4024 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.905779000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 2.991802000 seconds] Frame Number: 4024 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x353a (13626) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbd23 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2926153, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2926153 (relative sequence number) [Next sequence number: 2927521 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc51d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608951, TSecr 60594575 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \364\265\214`\237\237\310\033\002\315\277}UU2\346\231Uu\250\325\353t\237\326\327s\331\262\022\273\2162\342~\270\272\352\252U\274\002\345b\v\3454]e\301\016\034?\323\276C\337\373\0266\263V\325\342\037\032`\363\375\340\3 No. Time Source Destination Protocol Info 4025 3.050012 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2911105 Win=87552 Len=0 TSV=60594581 TSER=987608948 Frame 4025 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:37.963989000 [Time delta from previous captured frame: 0.058210000 seconds] [Time delta from previous displayed frame: 0.058210000 seconds] [Time since reference or first frame: 3.050012000 seconds] Frame Number: 4025 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b8f (19343) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb326 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2911105, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2911105 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x953c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594581, TSecr 987608948 No. Time Source Destination Protocol Info 4026 3.050053 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4026 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.964030000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 3.050053000 seconds] Frame Number: 4026 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd353 (54099) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1f0a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2927521, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2927521 (relative sequence number) [Next sequence number: 2928889 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3f60 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608952, TSecr 60594581 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4025] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: q,\033\341\336\352~f\316j\245@\314w"\027\032\277\024\353\323\205\243\2113`\257\301a\304j}\232\232\024#\252\235\v\255\024A\235\036\366\352t\223C\255\225\214\341\005\004\267*1\2632s\216\376\327\202\2751\214\232G\343y#\2 No. Time Source Destination Protocol Info 4027 3.050062 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4027 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:37.964039000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 3.050062000 seconds] Frame Number: 4027 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcf25 (53029) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2338 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2928889, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2928889 (relative sequence number) [Next sequence number: 2930257 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xb7ea [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608952, TSecr 60594581 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \037\306Q)X\005\226lCZ<9\377\351\247\215(+\213\256\ffE\024\310\343\3164\2513\31719\237\370\271r\<\n\216\021G|e\304\273{\304\277\242ow0*\005q\002\306+\265\032\032G\274\236\202\214\242y\025Y\206\027\356\017\000\352\275x No. Time Source Destination Protocol Info 4028 3.109843 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2913841 Win=87552 Len=0 TSV=60594587 TSER=987608948 Frame 4028 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.023820000 [Time delta from previous captured frame: 0.059781000 seconds] [Time delta from previous displayed frame: 0.059781000 seconds] [Time since reference or first frame: 3.109843000 seconds] Frame Number: 4028 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b90 (19344) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb325 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2913841, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2913841 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8a86 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594587, TSecr 987608948 No. Time Source Destination Protocol Info 4029 3.109887 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4029 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.023864000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 3.109887000 seconds] Frame Number: 4029 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xf223 (61987) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x003a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2930257, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2930257 (relative sequence number) [Next sequence number: 2931625 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf0ed [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608952, TSecr 60594587 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4028] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: `\226J\017e\212\003\272SQ\242\303\024\362\330\026\b:\ffK\275\311|\252\255\365\t\306\300\000\000\000-\001\000 \332\210\026\v\214\fU\341\312\365#b&\336\341&\246\273;b\331}]\024\314]\254!^\323p\254\235E\357-\337\266\251\ No. Time Source Destination Protocol Info 4030 3.109897 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4030 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.023874000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 3.109897000 seconds] Frame Number: 4030 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3e3b (15931) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb422 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2931625, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2931625 (relative sequence number) [Next sequence number: 2932993 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x68c5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608952, TSecr 60594587 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 4031 3.169915 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2916577 Win=87552 Len=0 TSV=60594593 TSER=987608949 Frame 4031 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.083892000 [Time delta from previous captured frame: 0.060018000 seconds] [Time delta from previous displayed frame: 0.060018000 seconds] [Time since reference or first frame: 3.169915000 seconds] Frame Number: 4031 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b91 (19345) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb324 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2916577, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2916577 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7fcf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594593, TSecr 987608949 No. Time Source Destination Protocol Info 4032 3.169953 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4032 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.083930000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 3.169953000 seconds] Frame Number: 4032 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0d24 (3364) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe539 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2932993, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2932993 (relative sequence number) [Next sequence number: 2934361 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0330 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608953, TSecr 60594593 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4031] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \2539w*\002:s\212\004\016\232\227p\346s{|\245\341\030\233\310(=\331P\374G!\f\024=\252\243\006a\220\201O\32778\246\353\211\276u*\244n\364X\266\250\336\0003?\345\331h{\267\213f\324\220~\227\345\307\344\003F\341\321\rV\0 No. Time Source Destination Protocol Info 4033 3.169961 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4033 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.083938000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 3.169961000 seconds] Frame Number: 4033 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3753 (14163) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbb0a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2934361, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2934361 (relative sequence number) [Next sequence number: 2935729 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa466 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608953, TSecr 60594593 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \316\243\262\036\321\035^\365\334\371LvV\323{\310\220\031v\251\341\241L\250\3677\307s\305&\375)zL3/\240\213\006\262\226\304\343\234\244b4\240\031\202\310\343\227l\016-\373.\316\207\034\024S\276\316\347I\332tSb'\345\00 No. Time Source Destination Protocol Info 4034 3.232561 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2919313 Win=87552 Len=0 TSV=60594599 TSER=987608950 Frame 4034 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.146538000 [Time delta from previous captured frame: 0.062600000 seconds] [Time delta from previous displayed frame: 0.062600000 seconds] [Time since reference or first frame: 3.232561000 seconds] Frame Number: 4034 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b92 (19346) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb323 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2919313, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2919313 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7518 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594599, TSecr 987608950 No. Time Source Destination Protocol Info 4035 3.232604 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4035 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.146581000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 3.232604000 seconds] Frame Number: 4035 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbb00 (47872) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x375d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2935729, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2935729 (relative sequence number) [Next sequence number: 2937097 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf424 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608954, TSecr 60594599 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4034] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \g\a\263\241z\323\206\355\265\366OEe\362\273\353r\335\343\037`\216\252\361\213\354a\347=bf4{\260\332\\370\245\257a\350Nx\337%\304N\315\340o\322i\237/{\022\322.5\356\332\307[iF\356~\337\242\026KB\236*\027\312N\364m\000 No. Time Source Destination Protocol Info 4036 3.232613 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4036 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.146590000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 3.232613000 seconds] Frame Number: 4036 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc726 (50982) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2b37 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2937097, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2937097 (relative sequence number) [Next sequence number: 2938465 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4c16 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608954, TSecr 60594599 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: f\331\333\326\0362J\351\376\336Ge\3130\323\327Z\322\2345o\241\j\032v\374r\022\251\306\024b#d\277\277r\252HF\214j\337#k\205\275F\361\212\205$(Y)\370\334U\352\230F\225\224\202\355\326\266\313{G`w^ik\255\212\305\252\265v No. Time Source Destination Protocol Info 4037 3.290944 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2922049 Win=87552 Len=0 TSV=60594605 TSER=987608950 Frame 4037 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.204921000 [Time delta from previous captured frame: 0.058331000 seconds] [Time delta from previous displayed frame: 0.058331000 seconds] [Time since reference or first frame: 3.290944000 seconds] Frame Number: 4037 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4b93 (19347) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb322 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2922049, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2922049 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6a62 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594605, TSecr 987608950 No. Time Source Destination Protocol Info 4038 3.290988 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4038 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.204965000 [Time delta from previous captured frame: 0.000044000 seconds] [Time delta from previous displayed frame: 0.000044000 seconds] [Time since reference or first frame: 3.290988000 seconds] Frame Number: 4038 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc15d (49501) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3100 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2938465, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2938465 (relative sequence number) [Next sequence number: 2939833 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7ef1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608954, TSecr 60594605 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4037] [The RTT to ACK the segment was: 0.000044000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \273\376\326\030Y\237\345\374\243\222\323\325\375q\201\305"\236\356\a\273\270\360\255m\257\210\033\027.\303(\037\210\340!\f\024=\272\231\005a XD S\361\331\fu77%\322n\021u8\245u\230\000\024\356\360\250G\314\033\273\217 No. Time Source Destination Protocol Info 4039 3.290999 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4039 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.204976000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 3.290999000 seconds] Frame Number: 4039 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xec77 (60535) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x05e6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2939833, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2939833 (relative sequence number) [Next sequence number: 2941201 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xbac8 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608954, TSecr 60594605 [SEQ/ACK analysis] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 4040 3.350598 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594611 TSER=987608951 SLE=2927521 SRE=2928889 Frame 4040 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.264575000 [Time delta from previous captured frame: 0.059599000 seconds] [Time delta from previous displayed frame: 0.059599000 seconds] [Time since reference or first frame: 3.350598000 seconds] Frame Number: 4040 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b94 (19348) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb315 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x2269 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594611, TSecr 987608951 NOP NOP SACK: 2927521-2928889 left edge = 2927521 (relative) right edge = 2928889 (relative) No. Time Source Destination Protocol Info 4041 3.350636 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4041 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.264613000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 3.350636000 seconds] Frame Number: 4041 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x643c (25660) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8e21 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2941201, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2941201 (relative sequence number) [Next sequence number: 2942569 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x11b2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608955, TSecr 60594611 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4040] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \276\371n\367\214\200\000\000\000\251!\000\341\342\021\005\306\033\257DT\024oj\314\237\227\261W\177/\025\344\216\273\271\362\026"\202\334\273q\317\177F\336\177\f\364W\377\37283nM\367\004\375\335\315\370\276/s*\354\201 No. Time Source Destination Protocol Info 4042 3.540196 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#1] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594630 TSER=987608951 SLE=2927521 SRE=2930257 Frame 4042 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.454173000 [Time delta from previous captured frame: 0.189560000 seconds] [Time delta from previous displayed frame: 0.189560000 seconds] [Time since reference or first frame: 3.540196000 seconds] Frame Number: 4042 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b95 (19349) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb314 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x1cfe [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594630, TSecr 987608951 NOP NOP SACK: 2927521-2930257 left edge = 2927521 (relative) right edge = 2930257 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4043 3.540910 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#2] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594630 TSER=987608951 SLE=2927521 SRE=2931625 Frame 4043 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.454887000 [Time delta from previous captured frame: 0.000714000 seconds] [Time delta from previous displayed frame: 0.000714000 seconds] [Time since reference or first frame: 3.540910000 seconds] Frame Number: 4043 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b96 (19350) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb313 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x17a6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594630, TSecr 987608951 NOP NOP SACK: 2927521-2931625 left edge = 2927521 (relative) right edge = 2931625 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 2] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#2)] [Message: Duplicate ACK (#2)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4044 3.540931 89.223.234.248 x.x.x.x FTP-DATA [TCP Fast Retransmission] FTP Data: 1368 bytes Frame 4044 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.454908000 [Time delta from previous captured frame: 0.000021000 seconds] [Time delta from previous displayed frame: 0.000021000 seconds] [Time since reference or first frame: 3.540931000 seconds] Frame Number: 4044 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8355 (33621) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6f08 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2923417, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2923417 (relative sequence number) [Next sequence number: 2924785 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x90 (ACK, CWR) 1... .... = Congestion Window Reduced (CWR): Set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5253 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608957, TSecr 60594630 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4042] [The RTT to ACK the segment was: 0.000735000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) fast retransmission] [Expert Info (Warn/Sequence): Fast retransmission (suspected)] [Message: Fast retransmission (suspected)] [Severity level: Warn] [Group: Sequence] [This frame is a (suspected) retransmission] FTP Data [truncated] FTP Data: \234\304=\352\343~\300\300Mg\230\276\257\305\377[\2203~\t\246\307\233Gt\031\264|4M\347\361\227a\334Q\352\264\246\r\001\364\030-^\265\251\2233U\224\253_\2237\352\254Vr\026\233\212{\314P\377\333"\021\322#t\331\262\366\3 No. Time Source Destination Protocol Info 4045 3.542525 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#3] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594630 TSER=987608951 SLE=2927521 SRE=2932993 Frame 4045 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.456502000 [Time delta from previous captured frame: 0.001594000 seconds] [Time delta from previous displayed frame: 0.001594000 seconds] [Time since reference or first frame: 3.542525000 seconds] Frame Number: 4045 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b97 (19351) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb312 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x124e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594630, TSecr 987608951 NOP NOP SACK: 2927521-2932993 left edge = 2927521 (relative) right edge = 2932993 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 3] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#3)] [Message: Duplicate ACK (#3)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4046 3.545827 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#4] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594631 TSER=987608951 SLE=2927521 SRE=2934361 Frame 4046 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.459804000 [Time delta from previous captured frame: 0.003302000 seconds] [Time delta from previous displayed frame: 0.003302000 seconds] [Time since reference or first frame: 3.545827000 seconds] Frame Number: 4046 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b98 (19352) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb311 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0cf5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594631, TSecr 987608951 NOP NOP SACK: 2927521-2934361 left edge = 2927521 (relative) right edge = 2934361 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 4] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#4)] [Message: Duplicate ACK (#4)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4047 3.548560 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#5] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594631 TSER=987608951 SLE=2927521 SRE=2935729 Frame 4047 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.462537000 [Time delta from previous captured frame: 0.002733000 seconds] [Time delta from previous displayed frame: 0.002733000 seconds] [Time since reference or first frame: 3.548560000 seconds] Frame Number: 4047 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b99 (19353) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb310 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x079d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594631, TSecr 987608951 NOP NOP SACK: 2927521-2935729 left edge = 2927521 (relative) right edge = 2935729 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 5] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#5)] [Message: Duplicate ACK (#5)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4048 3.548591 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 4048 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.462568000 [Time delta from previous captured frame: 0.000031000 seconds] [Time delta from previous displayed frame: 0.000031000 seconds] [Time since reference or first frame: 3.548591000 seconds] Frame Number: 4048 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3559 (13657) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbd04 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2924785, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2924785 (relative sequence number) [Next sequence number: 2926153 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0101 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608957, TSecr 60594631 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4045] [The RTT to ACK the segment was: 0.006066000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.197955000 seconds] [RTO based on delta from frame: 4041] FTP Data [truncated] FTP Data: UQj\263\245b\034\227\2678s\332LC\202\345\264\217\254\234_\246,E\345\304\273\322,n_vv\354,\373\206\313\356\341j\216\246]\027\212\334Q\323\001\217&\034*\372\bq]O\373\317\v\027\255\226\002\373\r\305\362F\317\355\332\306\ No. Time Source Destination Protocol Info 4049 3.556765 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#6] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594631 TSER=987608951 SLE=2927521 SRE=2937097 Frame 4049 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.470742000 [Time delta from previous captured frame: 0.008174000 seconds] [Time delta from previous displayed frame: 0.008174000 seconds] [Time since reference or first frame: 3.556765000 seconds] Frame Number: 4049 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9a (19354) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0245 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594631, TSecr 987608951 NOP NOP SACK: 2927521-2937097 left edge = 2927521 (relative) right edge = 2937097 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 6] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#6)] [Message: Duplicate ACK (#6)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4050 3.556797 89.223.234.248 x.x.x.x FTP-DATA [TCP Retransmission] FTP Data: 1368 bytes Frame 4050 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.470774000 [Time delta from previous captured frame: 0.000032000 seconds] [Time delta from previous displayed frame: 0.000032000 seconds] [Time since reference or first frame: 3.556797000 seconds] Frame Number: 4050 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2c00 (11264) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc65d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2926153, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2926153 (relative sequence number) [Next sequence number: 2927521 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc4df [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608957, TSecr 60594631 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4049] [The RTT to ACK the segment was: 0.000032000 seconds] [Number of bytes in flight: 19152] [TCP Analysis Flags] [This frame is a (suspected) retransmission] [Expert Info (Note/Sequence): Retransmission (suspected)] [Message: Retransmission (suspected)] [Severity level: Note] [Group: Sequence] [The RTO for this segment was: 0.206161000 seconds] [RTO based on delta from frame: 4041] FTP Data [truncated] FTP Data: \364\265\214`\237\237\310\033\002\315\277}UU2\346\231Uu\250\325\353t\237\326\327s\331\262\022\273\2162\342~\270\272\352\252U\274\002\345b\v\3454]e\301\016\034?\323\276C\337\373\0266\263V\325\342\037\032`\363\375\340\3 No. Time Source Destination Protocol Info 4051 3.569929 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#7] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594633 TSER=987608951 SLE=2927521 SRE=2938465 Frame 4051 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.483906000 [Time delta from previous captured frame: 0.013132000 seconds] [Time delta from previous displayed frame: 0.013132000 seconds] [Time since reference or first frame: 3.569929000 seconds] Frame Number: 4051 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9b (19355) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xfcea [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594633, TSecr 987608951 NOP NOP SACK: 2927521-2938465 left edge = 2927521 (relative) right edge = 2938465 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 7] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#7)] [Message: Duplicate ACK (#7)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4052 3.569962 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4052 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.483939000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 3.569962000 seconds] Frame Number: 4052 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xaa47 (43591) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4816 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2942569, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2942569 (relative sequence number) [Next sequence number: 2943937 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xba2a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608957, TSecr 60594633 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4051] [The RTT to ACK the segment was: 0.000033000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: x\257\fx*W\360\267\204\204R&`\365\207s\301I\304d{\336\252\24292\252\304!\036<%\025\367\213\\324T\326z\254sI\222l\270\347\266\230\256\271f\177\356\357\373\3518Y\364\364-\3336\346[\020\3477\377\347O\273\277\031\365\277* No. Time Source Destination Protocol Info 4053 3.600269 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#8] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594636 TSER=987608951 SLE=2927521 SRE=2939833 Frame 4053 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.514246000 [Time delta from previous captured frame: 0.030307000 seconds] [Time delta from previous displayed frame: 0.030307000 seconds] [Time since reference or first frame: 3.600269000 seconds] Frame Number: 4053 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9c (19356) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf78f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594636, TSecr 987608951 NOP NOP SACK: 2927521-2939833 left edge = 2927521 (relative) right edge = 2939833 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 8] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#8)] [Message: Duplicate ACK (#8)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4054 3.600312 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4054 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.514289000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 3.600312000 seconds] Frame Number: 4054 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2d13 (11539) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc54a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2943937, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2943937 (relative sequence number) [Next sequence number: 2945305 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcc78 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608957, TSecr 60594636 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4053] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: {\325j-jou\255kR6\246c\212\265\260\226tz\326\027\245!\U=kUZ\353Q\265\255\353T\225r\250\236\351:Ye\356\345E\255h\236\257Uz\253\365\255\030#\220\3013\202\222b\371kP\242\356\b\371\255(\244\202K\275\352\227)\201\231\000\2 No. Time Source Destination Protocol Info 4055 3.629940 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#9] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594639 TSER=987608951 SLE=2927521 SRE=2941201 Frame 4055 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.543917000 [Time delta from previous captured frame: 0.029628000 seconds] [Time delta from previous displayed frame: 0.029628000 seconds] [Time since reference or first frame: 3.629940000 seconds] Frame Number: 4055 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9d (19357) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf234 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594639, TSecr 987608951 NOP NOP SACK: 2927521-2941201 left edge = 2927521 (relative) right edge = 2941201 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 9] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#9)] [Message: Duplicate ACK (#9)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4056 3.629978 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4056 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.543955000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 3.629978000 seconds] Frame Number: 4056 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x912a (37162) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6133 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2945305, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2945305 (relative sequence number) [Next sequence number: 2946673 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd96a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608958, TSecr 60594639 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4055] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: ^\357r\315Y\271\263\305\365\027\250\236\036raEG\216\001Z\341][]sB\037,\244\361\236\265\]xP2\nj..)\233;\212b\342\206#\316\224`\bu\204>\023\254^\335\263d)\202\374\322\376\235\277\374\275Tg\273\202<\377z\217k\335\215\344 No. Time Source Destination Protocol Info 4057 3.659893 x.x.x.x 89.223.234.248 TCP [TCP Dup ACK 4040#10] 38691 > 52904 [ACK] Seq=1 Ack=2923417 Win=87552 Len=0 TSV=60594642 TSER=987608951 SLE=2927521 SRE=2942569 Frame 4057 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.573870000 [Time delta from previous captured frame: 0.029915000 seconds] [Time delta from previous displayed frame: 0.029915000 seconds] [Time since reference or first frame: 3.659893000 seconds] Frame Number: 4057 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9e (19358) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2923417, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2923417 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xecd9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594642, TSecr 987608951 NOP NOP SACK: 2927521-2942569 left edge = 2927521 (relative) right edge = 2942569 (relative) [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 10] [Duplicate to the ACK in frame: 4040] [Expert Info (Note/Sequence): Duplicate ACK (#10)] [Message: Duplicate ACK (#10)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4058 3.659927 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4058 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.573904000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 3.659927000 seconds] Frame Number: 4058 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x6f19 (28441) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8344 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2946673, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2946673 (relative sequence number) [Next sequence number: 2948041 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe7f9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608958, TSecr 60594642 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4057] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \3764']\365\4O\036'\251\261-\246\260\340\320\215V\266\237J\363"6\316Z\252\223\2541\355\313\257\326k\220\213\271\034wy\025\241T$\367a{\263\263;\227\001\376j\225L"\320b'\177\310\276\026rO%\230\313\205\275\375\362U\240\3 No. Time Source Destination Protocol Info 4059 3.689836 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2924785 Win=86208 Len=0 TSV=60594645 TSER=987608957 SLE=2927521 SRE=2942569 Frame 4059 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.603813000 [Time delta from previous captured frame: 0.029909000 seconds] [Time delta from previous displayed frame: 0.029909000 seconds] [Time since reference or first frame: 3.689836000 seconds] Frame Number: 4059 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4b9f (19359) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2924785, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2924785 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 86208 (scaled) Checksum: 0xe78d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594645, TSecr 987608957 NOP NOP SACK: 2927521-2942569 left edge = 2927521 (relative) right edge = 2942569 (relative) No. Time Source Destination Protocol Info 4060 3.689866 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4060 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.603843000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 3.689866000 seconds] Frame Number: 4060 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4d70 (19824) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa4ed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2948041, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2948041 (relative sequence number) [Next sequence number: 2949409 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x00c9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608958, TSecr 60594645 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4059] [The RTT to ACK the segment was: 0.000030000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: \255\342\357{\276\211\244\254\251\267}\033\205\335/a\315^\275\217\016/a}.}V\205u\232\253\312\322\034.\356\367|\2543\213\256R\327\v\273\276\211\233*\245\255Qy\274\310p\301]\335\337\252\324\232\366\031\315\000\000\000l\ No. Time Source Destination Protocol Info 4061 3.689875 89.223.234.248 x.x.x.x TCP [TCP Dup ACK 4060#1] 52904 > 38691 [ACK] Seq=2949409 Ack=1 Win=230000 Len=0 TSV=987608958 TSER=60594645 Frame 4061 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.603852000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 3.689875000 seconds] Frame Number: 4061 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x475d (18269) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb058 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2949409, Ack: 1, Len: 0 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2949409 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x945b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608958, TSecr 60594645 [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 4060] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4062 3.720004 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2926153 Win=84864 Len=0 TSV=60594648 TSER=987608957 SLE=2927521 SRE=2942569 Frame 4062 (68 bytes on wire, 68 bytes captured) Arrival Time: May 30, 2010 12:32:38.633981000 [Time delta from previous captured frame: 0.030129000 seconds] [Time delta from previous displayed frame: 0.030129000 seconds] [Time since reference or first frame: 3.720004000 seconds] Frame Number: 4062 Frame Length: 68 bytes Capture Length: 68 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 64 Identification: 0x4ba0 (19360) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb309 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2926153, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2926153 (relative ack number) Header length: 44 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 84864 (scaled) Checksum: 0xe247 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (24 bytes) NOP NOP Timestamps: TSval 60594648, TSecr 987608957 NOP NOP SACK: 2927521-2942569 left edge = 2927521 (relative) right edge = 2942569 (relative) No. Time Source Destination Protocol Info 4063 3.720047 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4063 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.634024000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 3.720047000 seconds] Frame Number: 4063 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xc238 (49720) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3025 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2949409, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2949409 (relative sequence number) [Next sequence number: 2950777 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8d62 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594648 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4062] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: %\355>\345\247yy\031k\272\330+\275\335\356\371\376\274\274o\312K\277\264^9%\341\027s\315\343\3133\021[\243\270\270\275\210\276\at\255\003\266;\035\203\312y\356\302\366\314\bU!r{\337K\v\327vR\254\376bx^_ve\302\243)\277 No. Time Source Destination Protocol Info 4064 3.720060 89.223.234.248 x.x.x.x TCP [TCP Dup ACK 4063#1] 52904 > 38691 [ACK] Seq=2950777 Ack=1 Win=230000 Len=0 TSV=987608959 TSER=60594648 Frame 4064 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.634037000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 3.720060000 seconds] Frame Number: 4064 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x755b (30043) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x825a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2950777, Ack: 1, Len: 0 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2950777 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8eff [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594648 [SEQ/ACK analysis] [TCP Analysis Flags] [This is a TCP duplicate ack] [Duplicate ACK #: 1] [Duplicate to the ACK in frame: 4063] [Expert Info (Note/Sequence): Duplicate ACK (#1)] [Message: Duplicate ACK (#1)] [Severity level: Note] [Group: Sequence] No. Time Source Destination Protocol Info 4065 3.750296 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2942569 Win=77312 Len=0 TSV=60594651 TSER=987608957 Frame 4065 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.664273000 [Time delta from previous captured frame: 0.030236000 seconds] [Time delta from previous displayed frame: 0.030236000 seconds] [Time since reference or first frame: 3.750296000 seconds] Frame Number: 4065 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba1 (19361) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb314 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2942569, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2942569 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 77312 (scaled) Checksum: 0x1aa5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594651, TSecr 987608957 No. Time Source Destination Protocol Info 4066 3.750347 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4066 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.664324000 [Time delta from previous captured frame: 0.000051000 seconds] [Time delta from previous displayed frame: 0.000051000 seconds] [Time since reference or first frame: 3.750347000 seconds] Frame Number: 4066 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9249 (37449) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6014 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2950777, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2950777 (relative sequence number) [Next sequence number: 2952145 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xcbc0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594651 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4065] [The RTT to ACK the segment was: 0.000051000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: Ve\2016\034\236\241z\311)\355\226Y\263d\231\230\205\257\233\235\202k\304Y\212Rf\367\255x\\274\330\253\255x\277\255}k\353\224G\004}\334\311\331\311\275\324\217\266\260^A\374\276\303ww\275?\004\235\313\225\306\267w\361* No. Time Source Destination Protocol Info 4067 3.750359 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4067 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.664336000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 3.750359000 seconds] Frame Number: 4067 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xce44 (52804) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2419 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2952145, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2952145 (relative sequence number) [Next sequence number: 2953513 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xf24d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594651 [SEQ/ACK analysis] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: 5a\246\303g\005\036\304\315g\233E\030 <\n\243\256\323J>gx\3011`Z,\032\302[g<\307\006RF2\035\247f`jrh\325\0266\005\273\333\375\341z\3772r\3147N\326&\335o\367\313\205\207\037\362\264\274\333\270\272\375m\037\200\234yF\2 No. Time Source Destination Protocol Info 4068 3.779902 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2943937 Win=87552 Len=0 TSV=60594654 TSER=987608957 Frame 4068 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.693879000 [Time delta from previous captured frame: 0.029543000 seconds] [Time delta from previous displayed frame: 0.029543000 seconds] [Time since reference or first frame: 3.779902000 seconds] Frame Number: 4068 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba2 (19362) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb313 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2943937, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2943937 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x14aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594654, TSecr 987608957 No. Time Source Destination Protocol Info 4069 3.779947 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4069 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.693924000 [Time delta from previous captured frame: 0.000045000 seconds] [Time delta from previous displayed frame: 0.000045000 seconds] [Time since reference or first frame: 3.779947000 seconds] Frame Number: 4069 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1039 (4153) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe224 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2953513, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2953513 (relative sequence number) [Next sequence number: 2954881 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x44d3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594654 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4068] [The RTT to ACK the segment was: 0.000045000 seconds] [Number of bytes in flight: 24624] FTP Data [truncated] FTP Data: *\245I\032\2402]V\354\245\237v\272\001\016\374\256\367|F\253X\325!z\233\023<\363\322 \306\310\363\371yt\315\312\237\273\vZ\301\241\024o2y\226NU\330\221\350\307\r\351N&\312\365DTe\367\332J\307\027n\363\230W\025Rk\344EA No. Time Source Destination Protocol Info 4070 3.810067 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2945305 Win=87552 Len=0 TSV=60594657 TSER=987608957 Frame 4070 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.724044000 [Time delta from previous captured frame: 0.030120000 seconds] [Time delta from previous displayed frame: 0.030120000 seconds] [Time since reference or first frame: 3.810067000 seconds] Frame Number: 4070 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba3 (19363) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb312 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2945305, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2945305 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0f4f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594657, TSecr 987608957 No. Time Source Destination Protocol Info 4071 3.810107 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4071 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.724084000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 3.810107000 seconds] Frame Number: 4071 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xea2c (59948) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0831 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2954881, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2954881 (relative sequence number) [Next sequence number: 2956249 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc77c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608959, TSecr 60594657 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4070] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 25992] FTP Data [truncated] FTP Data: eW6\303=c\026\242"\337s\262\026X\001\333\322#\374\230;\336\177\306%l\264L\177\376\020\321B8\275\375'=\234\261\223Z\230k\322\225{\261\355\227\034\ff\026\253\230\270x\367D\254\340;\332\n8\321\310\256\275\306~\272\334\23 No. Time Source Destination Protocol Info 4072 3.840153 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2946673 Win=87552 Len=0 TSV=60594660 TSER=987608958 Frame 4072 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.754130000 [Time delta from previous captured frame: 0.030046000 seconds] [Time delta from previous displayed frame: 0.030046000 seconds] [Time since reference or first frame: 3.840153000 seconds] Frame Number: 4072 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba4 (19364) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb311 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2946673, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2946673 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x09f3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594660, TSecr 987608958 No. Time Source Destination Protocol Info 4073 3.840189 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4073 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.754166000 [Time delta from previous captured frame: 0.000036000 seconds] [Time delta from previous displayed frame: 0.000036000 seconds] [Time since reference or first frame: 3.840189000 seconds] Frame Number: 4073 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3776 (14198) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbae7 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2956249, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2956249 (relative sequence number) [Next sequence number: 2957617 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1055 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608960, TSecr 60594660 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4072] [The RTT to ACK the segment was: 0.000036000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \323\350\234\236\242\036\357\357\256\263\352\273\006\345\343k\273\270q\265BFW\260\307\226\240\331\341\353\267E\346{x\370\305G\f\234Z\301,\323\367\2158\312\271n\235\334\223rw\244\373\357\276^\335\336_\206\004\\235\233\ No. Time Source Destination Protocol Info 4074 3.840197 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4074 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.754174000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 3.840197000 seconds] Frame Number: 4074 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa365 (41829) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4ef8 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2957617, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2957617 (relative sequence number) [Next sequence number: 2958985 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1bf3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608960, TSecr 60594660 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \356_/\0301\020\253[\337\331\305\336R{\306\264\203\203\304\200\250\034\240js\203\276UUU\t\340\307C\222\365\001\360\270\215\306\270\352+\G%\274\271\233=*\X\215\304f\242\207%\030\236\005\271/r\0253\020\226\242\325K\210\ No. Time Source Destination Protocol Info 4075 3.870033 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2948041 Win=87552 Len=0 TSV=60594663 TSER=987608958 Frame 4075 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.784010000 [Time delta from previous captured frame: 0.029836000 seconds] [Time delta from previous displayed frame: 0.029836000 seconds] [Time since reference or first frame: 3.870033000 seconds] Frame Number: 4075 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba5 (19365) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb310 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2948041, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2948041 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x0498 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594663, TSecr 987608958 No. Time Source Destination Protocol Info 4076 3.870066 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4076 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.784043000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 3.870066000 seconds] Frame Number: 4076 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4662 (18018) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xabfb [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2958985, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2958985 (relative sequence number) [Next sequence number: 2960353 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x409a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608960, TSecr 60594663 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4075] [The RTT to ACK the segment was: 0.000033000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: E\377\322ZK\273\027t\214\2356\376z\347\252\325{\2657\322k\315\216\375e\302\356]_}:Or\341E\006\r\264\201\266\367\356\235\373\277{C\373~\n;\357v\370\373\177\212\367oM4\315\343\377\267\245.\233\276ML~\362\263\303\240[J\2 No. Time Source Destination Protocol Info 4077 3.900156 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2949409 Win=87552 Len=0 TSV=60594666 TSER=987608958 Frame 4077 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.814133000 [Time delta from previous captured frame: 0.030090000 seconds] [Time delta from previous displayed frame: 0.030090000 seconds] [Time since reference or first frame: 3.900156000 seconds] Frame Number: 4077 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba6 (19366) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30f [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2949409, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2949409 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xff3c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594666, TSecr 987608958 No. Time Source Destination Protocol Info 4078 3.900204 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4078 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.814181000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 3.900204000 seconds] Frame Number: 4078 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xfc6a (64618) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xf5f2 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2960353, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2960353 (relative sequence number) [Next sequence number: 2961721 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x6453 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608960, TSecr 60594666 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4077] [The RTT to ACK the segment was: 0.000048000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: \256\313W67\355\260\212\307\b\323\303PZ\342\327C\351\3212\30718}\304\313\333.\362gAj\371D\326\273Ga\350n\302\366c(\342O<\317\220M}\272\177`\277_Y\3728j+q\004\005\275\314\3533T\326\257Rig\363\322\353I\317\355\267\006\2 No. Time Source Destination Protocol Info 4079 3.930199 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2950777 Win=87552 Len=0 TSV=60594669 TSER=987608959 Frame 4079 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.844176000 [Time delta from previous captured frame: 0.029995000 seconds] [Time delta from previous displayed frame: 0.029995000 seconds] [Time since reference or first frame: 3.930199000 seconds] Frame Number: 4079 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba7 (19367) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30e [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2950777, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2950777 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf9e0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594669, TSecr 987608959 No. Time Source Destination Protocol Info 4080 3.930232 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4080 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.844209000 [Time delta from previous captured frame: 0.000033000 seconds] [Time delta from previous displayed frame: 0.000033000 seconds] [Time since reference or first frame: 3.930232000 seconds] Frame Number: 4080 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2a4b (10827) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc812 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2961721, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2961721 (relative sequence number) [Next sequence number: 2963089 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x15c9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608961, TSecr 60594669 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4079] [The RTT to ACK the segment was: 0.000033000 seconds] [Number of bytes in flight: 13680] FTP Data [truncated] FTP Data: )\272\240_X]\214\265y!Y\270grC\026*\n\177\226\331.\354+\260j]\266(>^^\237j\353\035\322\240\253\G\245\313\r\223m\241\334\317\342\326\347\346Q\262/h\275\230\270\252"k\347\257j\323\246\253\257\251v\257\304LW\016\017\274% No. Time Source Destination Protocol Info 4081 3.960097 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2952145 Win=87552 Len=0 TSV=60594672 TSER=987608959 Frame 4081 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.874074000 [Time delta from previous captured frame: 0.029865000 seconds] [Time delta from previous displayed frame: 0.029865000 seconds] [Time since reference or first frame: 3.960097000 seconds] Frame Number: 4081 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba8 (19368) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30d [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2952145, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2952145 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xf485 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594672, TSecr 987608959 No. Time Source Destination Protocol Info 4082 3.960138 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4082 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.874115000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 3.960138000 seconds] Frame Number: 4082 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x262d (9773) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xcc30 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2963089, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2963089 (relative sequence number) [Next sequence number: 2964457 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x7dca [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608961, TSecr 60594672 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4081] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \3541\332\232\265T\0206\256\372)\267\276A\242{\210\367YS\371\216#'\177w\306\217-f\352'\f\033\027mBu\355\216\252\267\225]7\344`\226\317\314\310}M\372\351\223\225\205\200\000\000\001Y!\000\226\341\t\005\306>\b{\277q\307 No. Time Source Destination Protocol Info 4083 3.990595 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2953513 Win=87552 Len=0 TSV=60594675 TSER=987608959 Frame 4083 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.904572000 [Time delta from previous captured frame: 0.030457000 seconds] [Time delta from previous displayed frame: 0.030457000 seconds] [Time since reference or first frame: 3.990595000 seconds] Frame Number: 4083 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4ba9 (19369) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30c [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2953513, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2953513 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xef2a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594675, TSecr 987608959 No. Time Source Destination Protocol Info 4084 3.990638 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4084 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.904615000 [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 3.990638000 seconds] Frame Number: 4084 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3718 (14104) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbb45 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2964457, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2964457 (relative sequence number) [Next sequence number: 2965825 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3781 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608961, TSecr 60594675 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4083] [The RTT to ACK the segment was: 0.000043000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \245\341\363?\376\266\333\333n\024\301\211\305o\267]\276\337\347\017\205!\3075\0161\256\354D\000\214\340\000h\354\035\264O\226\030\037\232\207\372\222T\276-fU\025^\263\212\314\212\357U%{I6\353[\346:\254\327\212\324U\n No. Time Source Destination Protocol Info 4085 4.020299 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2954881 Win=87552 Len=0 TSV=60594678 TSER=987608959 Frame 4085 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.934276000 [Time delta from previous captured frame: 0.029661000 seconds] [Time delta from previous displayed frame: 0.029661000 seconds] [Time since reference or first frame: 4.020299000 seconds] Frame Number: 4085 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4baa (19370) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30b [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2954881, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2954881 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe9cf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594678, TSecr 987608959 No. Time Source Destination Protocol Info 4086 4.020337 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4086 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.934314000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 4.020337000 seconds] Frame Number: 4086 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xeb51 (60241) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x070c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2965825, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2965825 (relative sequence number) [Next sequence number: 2967193 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x82fe [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608962, TSecr 60594678 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4085] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: df\3122\311\344u\204\367{\002x\312\204\240\034\206\233\202\020\327M\373\371\000*X\026\210\336\033\363\bv\361=\371x\357\032\333\301\031\272l\372\241\322+\005*\3334\247\262\265\\2\262\275\023l\334\376\377\215\363\334\00 No. Time Source Destination Protocol Info 4087 4.050451 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2956249 Win=87552 Len=0 TSV=60594681 TSER=987608959 Frame 4087 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.964428000 [Time delta from previous captured frame: 0.030114000 seconds] [Time delta from previous displayed frame: 0.030114000 seconds] [Time since reference or first frame: 4.050451000 seconds] Frame Number: 4087 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bab (19371) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb30a [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2956249, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2956249 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xe474 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594681, TSecr 987608959 No. Time Source Destination Protocol Info 4088 4.050486 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4088 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.964463000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 4.050486000 seconds] Frame Number: 4088 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x414b (16715) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb112 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2967193, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2967193 (relative sequence number) [Next sequence number: 2968561 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc5b0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608962, TSecr 60594681 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4087] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: U\3230\341$I04\033-\325\034\254\361TRh\323\250m\355\205\302>\250>\353\365CE\f\323A\370\216!\f\024\035\222\261\005a\240\201O?\323YW\250\362\254\272L4\222]W\006\227\230\006E\374L\235\374\362\267\023\336w\214&\201\267\34 No. Time Source Destination Protocol Info 4089 4.079959 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2957617 Win=87552 Len=0 TSV=60594684 TSER=987608960 Frame 4089 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:38.993936000 [Time delta from previous captured frame: 0.029473000 seconds] [Time delta from previous displayed frame: 0.029473000 seconds] [Time since reference or first frame: 4.079959000 seconds] Frame Number: 4089 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bac (19372) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb309 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2957617, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2957617 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xdf18 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594684, TSecr 987608960 No. Time Source Destination Protocol Info 4090 4.079993 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4090 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:38.993970000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 4.079993000 seconds] Frame Number: 4090 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9f30 (40752) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x532d [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2968561, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2968561 (relative sequence number) [Next sequence number: 2969929 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x9d94 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608962, TSecr 60594684 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4089] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 20520] FTP Data [truncated] FTP Data: \360\277O\025\034\366\252\265g\305\343+\355\303R`J\224\344\374!\236\223\221)\225\307\241\022\205\317\203#L\251s^\270s%\032]\0326WpM\342\355\352\311\222\374\220\035\271\371\267\323\302\304\017\251\203\312\033,\214\270\ No. Time Source Destination Protocol Info 4091 4.110203 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2958985 Win=87552 Len=0 TSV=60594687 TSER=987608960 Frame 4091 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.024180000 [Time delta from previous captured frame: 0.030210000 seconds] [Time delta from previous displayed frame: 0.030210000 seconds] [Time since reference or first frame: 4.110203000 seconds] Frame Number: 4091 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bad (19373) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb308 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2958985, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2958985 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xd9bd [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594687, TSecr 987608960 No. Time Source Destination Protocol Info 4092 4.110233 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4092 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.024210000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.000030000 seconds] [Time since reference or first frame: 4.110233000 seconds] Frame Number: 4092 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x545d (21597) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9e00 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2969929, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2969929 (relative sequence number) [Next sequence number: 2971297 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x2d38 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608962, TSecr 60594687 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4091] [The RTT to ACK the segment was: 0.000030000 seconds] [Number of bytes in flight: 21888] FTP Data [truncated] FTP Data: \032N\277\375\352j\2055<\345\313\334\341\031a1(V'\204\353?\201\311XCfCD\310\364\3565afnq\373\345\203\331\265\252\273\345\025\251$\235\206\2426S\327l\312\333V\n\327\365\310\367l\276\361^\374|\255\335\245\336h\253K4\231 No. Time Source Destination Protocol Info 4093 4.110241 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4093 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.024218000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.110241000 seconds] Frame Number: 4093 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1f15 (7957) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd348 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2971297, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2971297 (relative sequence number) [Next sequence number: 2972665 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa900 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608962, TSecr 60594687 [SEQ/ACK analysis] [Number of bytes in flight: 23256] FTP Data [truncated] FTP Data: \030\230\306A\265k9\n\306\346\210A `2r\023y\200RR0\354\b\000\317)p\374G!\f\024\035\336\005a\241 \240L4\020,\371\357\353\210\035\315\227J\322\246\270*t]0\027\034k?\244\3753\276jb\352\222 \026-\365g\016\363\353\276\223` No. Time Source Destination Protocol Info 4094 4.169974 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2961721 Win=87552 Len=0 TSV=60594693 TSER=987608960 Frame 4094 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.083951000 [Time delta from previous captured frame: 0.059733000 seconds] [Time delta from previous displayed frame: 0.059733000 seconds] [Time since reference or first frame: 4.169974000 seconds] Frame Number: 4094 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bae (19374) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb307 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2961721, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2961721 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xcf07 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594693, TSecr 987608960 No. Time Source Destination Protocol Info 4095 4.170013 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4095 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.083990000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 4.170013000 seconds] Frame Number: 4095 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xe947 (59719) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0916 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2972665, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2972665 (relative sequence number) [Next sequence number: 2974033 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x838c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608963, TSecr 60594693 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4094] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 4096 4.170029 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4096 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.084006000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 4.170029000 seconds] Frame Number: 4096 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbb5b (47963) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3702 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2974033, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2974033 (relative sequence number) [Next sequence number: 2975401 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0312 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608963, TSecr 60594693 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: "@\2308\0056\261\324\002=K\325\336\313ZF\b+\330^\355\373q;o\254Y\021\333\316\024\253\210\372R\261\246\330\323B0\000\000\000s\001\000\341\250\201`\270\301\254\346\331\b\245M\262a\004\371A\017U\356\357y\225i'\255\324M\3 No. Time Source Destination Protocol Info 4097 4.230177 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2964457 Win=87552 Len=0 TSV=60594699 TSER=987608961 Frame 4097 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.144154000 [Time delta from previous captured frame: 0.060148000 seconds] [Time delta from previous displayed frame: 0.060148000 seconds] [Time since reference or first frame: 4.230177000 seconds] Frame Number: 4097 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4baf (19375) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb306 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2964457, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2964457 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xc450 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594699, TSecr 987608961 No. Time Source Destination Protocol Info 4098 4.230224 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4098 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.144201000 [Time delta from previous captured frame: 0.000047000 seconds] [Time delta from previous displayed frame: 0.000047000 seconds] [Time since reference or first frame: 4.230224000 seconds] Frame Number: 4098 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4377 (17271) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xaee6 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2975401, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2975401 (relative sequence number) [Next sequence number: 2976769 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x12f1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608964, TSecr 60594699 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4097] [The RTT to ACK the segment was: 0.000047000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: Ub\360\333\212\335\373B:n\253\`K\2100\315!\334\352J\373?{\356+\3053n\253\243\n\335\335\317\323\274dg\021\376n\315z\201\3376\304s\034 d\036xs\204\240\341\352\213\361\020=9\251Z\372\303\254\v!\320\270Lh\205\223\211\263x No. Time Source Destination Protocol Info 4099 4.230236 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4099 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.144213000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 4.230236000 seconds] Frame Number: 4099 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xa56e (42350) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x4cef [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2976769, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2976769 (relative sequence number) [Next sequence number: 2978137 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x4db5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608964, TSecr 60594699 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \335\304\375[\346\343\236\252"\265\271\177^$\362\341d\350\036\262\233\303\317\315\3428\255[[\301\327\231\303\313\035\254+P\373]\020\313>\223j\272\256\265\026\324\371|W\372\313\370\274;\377\377\377\374\230\237\371\205\ No. Time Source Destination Protocol Info 4100 4.289945 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2967193 Win=87552 Len=0 TSV=60594705 TSER=987608961 Frame 4100 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.203922000 [Time delta from previous captured frame: 0.059709000 seconds] [Time delta from previous displayed frame: 0.059709000 seconds] [Time since reference or first frame: 4.289945000 seconds] Frame Number: 4100 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb0 (19376) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb305 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2967193, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2967193 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xb99a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594705, TSecr 987608961 No. Time Source Destination Protocol Info 4101 4.289979 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4101 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.203956000 [Time delta from previous captured frame: 0.000034000 seconds] [Time delta from previous displayed frame: 0.000034000 seconds] [Time since reference or first frame: 4.289979000 seconds] Frame Number: 4101 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x4d34 (19764) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa529 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2978137, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2978137 (relative sequence number) [Next sequence number: 2979505 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x90de [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608964, TSecr 60594705 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4100] [The RTT to ACK the segment was: 0.000034000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \000\230\001\000\341\250\303`\270\303\256\222|\227\336\315\321\245\256\2644\373\030\201\016\356\344M\322\276F{5\347\204\354_"W\f>HF\373\352\266\225q\230\257\275\326\273\337W6\340\223/&\336[\240E\231\206\372\235\364\32 No. Time Source Destination Protocol Info 4102 4.289987 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4102 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.203964000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.289987000 seconds] Frame Number: 4102 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xed4c (60748) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x0511 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2979505, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2979505 (relative sequence number) [Next sequence number: 2980873 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x06f7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608964, TSecr 60594705 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \243n\356C\032\373\370NN\331>f7\331\201=\016\\212\357ea\337\315\020pOV\323\351\275~8\376+\241_c\374\375!\367\275:\345Sc\231\216PCmk\266\000\000\001\r!\000\226\343\031\005\306b\365u\267\036`E\255r\344\212\336:\230x8\25 No. Time Source Destination Protocol Info 4103 4.350038 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2969929 Win=87552 Len=0 TSV=60594711 TSER=987608962 Frame 4103 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.264015000 [Time delta from previous captured frame: 0.060051000 seconds] [Time delta from previous displayed frame: 0.060051000 seconds] [Time since reference or first frame: 4.350038000 seconds] Frame Number: 4103 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb1 (19377) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb304 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2969929, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2969929 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xaee3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594711, TSecr 987608962 No. Time Source Destination Protocol Info 4104 4.350080 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4104 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.264057000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 4.350080000 seconds] Frame Number: 4104 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3604 (13828) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbc59 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2980873, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2980873 (relative sequence number) [Next sequence number: 2982241 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xa342 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608965, TSecr 60594711 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4103] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \301\003A\274\313T\213\324\373_\026 f\221\310\226\244\242\251\243\270w6g\347 %\234\202J>,\344\260bG;p\324\022\307^\016\371\325U\031N\036('\216\267\rls5\255p\300@)e\274Z\244\\035\355\367\212\305\305\325T\330._\0A\227\3 No. Time Source Destination Protocol Info 4105 4.350090 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4105 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.264067000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 4.350090000 seconds] Frame Number: 4105 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x494e (18766) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa90f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2982241, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2982241 (relative sequence number) [Next sequence number: 2983609 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc7ad [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608965, TSecr 60594711 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \254y\037\244~"\267\2338\325\3055\322t\324\265\254\215d\200\000\000\000\251\001\000]\352AX.0\254\247\025\223/w\225\213\022359\323X\351\307\204\276\351\361I=P\215[\255\344D-\276\225\323]\265+\274\226 52904 [ACK] Seq=1 Ack=2972665 Win=87552 Len=0 TSV=60594717 TSER=987608962 Frame 4106 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.324022000 [Time delta from previous captured frame: 0.059955000 seconds] [Time delta from previous displayed frame: 0.059955000 seconds] [Time since reference or first frame: 4.410045000 seconds] Frame Number: 4106 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb2 (19378) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb303 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2972665, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2972665 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0xa42d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594717, TSecr 987608962 No. Time Source Destination Protocol Info 4107 4.410086 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4107 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.324063000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.000041000 seconds] [Time since reference or first frame: 4.410086000 seconds] Frame Number: 4107 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0501 (1281) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xed5c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2983609, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2983609 (relative sequence number) [Next sequence number: 2984977 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x21aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608965, TSecr 60594717 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4106] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 15048] FTP Data [truncated] FTP Data: \327\2127/\316\n\273\273\266\324\335\306\220ZU\226Z\326\020\215\021\353\242z\027\335\371\276T\255\313\274AkiT\331s\327\027\315\365\251"D\363\f\370"\301\037\225z\353\211\305\357\353\225uy\345\362\267{\326\270(\016q>\21 No. Time Source Destination Protocol Info 4108 4.410095 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4108 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.324072000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 4.410095000 seconds] Frame Number: 4108 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2939 (10553) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xc924 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2984977, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2984977 (relative sequence number) [Next sequence number: 2986345 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x89da [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608965, TSecr 60594717 [SEQ/ACK analysis] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \274@\363\341EZ|C\352\267}n\272\335\254\253]u\315\372\372\346\376\255\315\372m\266\231}J\X\301>\264O<1\261w\333M\345\352\356\367\371\fH\234\256\351\373\345\300\340\365\303\317\300\350\230^\016a\252\302\003\222\264\324 No. Time Source Destination Protocol Info 4109 4.410101 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4109 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.324078000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 4.410101000 seconds] Frame Number: 4109 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3813 (14355) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xba4a [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2986345, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2986345 (relative sequence number) [Next sequence number: 2987713 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x3841 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608965, TSecr 60594717 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \3251\024i\265\001\254:@v]\357O\337\277\237\351\366\210\215\332c\372\324\017\375\332\274ga\226\210rgJ\256]\313\312\246\302\362\362\357\264-\373x\213\242s\201ES\324|\026\232\205~6\213\221V3\246\216p%\372\327m\373\323\3 No. Time Source Destination Protocol Info 4110 4.470133 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2975401 Win=87552 Len=0 TSV=60594723 TSER=987608963 Frame 4110 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.384110000 [Time delta from previous captured frame: 0.060032000 seconds] [Time delta from previous displayed frame: 0.060032000 seconds] [Time since reference or first frame: 4.470133000 seconds] Frame Number: 4110 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb3 (19379) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb302 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2975401, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2975401 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x9976 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594723, TSecr 987608963 No. Time Source Destination Protocol Info 4111 4.470170 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4111 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.384147000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 4.470170000 seconds] Frame Number: 4111 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xbd06 (48390) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3557 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2987713, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2987713 (relative sequence number) [Next sequence number: 2989081 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x784b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608966, TSecr 60594723 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4110] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \212\r\2635\2301\333\345e1\340\240\257i\252R$i]~v>\225\232\322\212)\217\271q\017\254\266\351\337Oq\363\naC\255Qn@\364\270\375\347\230oZ\274d\352\336\372ZT\255q\240\020\363\376\261\016\027\276N\371\364\272\3717'~\000\0 No. Time Source Destination Protocol Info 4112 4.470179 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4112 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.384156000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 4.470179000 seconds] Frame Number: 4112 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8441 (33857) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x6e1c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2989081, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2989081 (relative sequence number) [Next sequence number: 2990449 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x0f52 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608966, TSecr 60594723 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \2526kpw<\270/\201\202\326\265\303g\231\327rzT\337\331\216I\024\006\220\322\366L-\331s\356\367\bFH\2065\331\312\256\021\352\272\264\341~\225R\223i\306\311\\276\347Y\337\305\272 @\316u\005D\2570\270jR\247\274\347\371\3 No. Time Source Destination Protocol Info 4113 4.530269 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2978137 Win=87552 Len=0 TSV=60594729 TSER=987608964 Frame 4113 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.444246000 [Time delta from previous captured frame: 0.060090000 seconds] [Time delta from previous displayed frame: 0.060090000 seconds] [Time since reference or first frame: 4.530269000 seconds] Frame Number: 4113 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb4 (19380) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb301 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2978137, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2978137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8ebf [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594729, TSecr 987608964 No. Time Source Destination Protocol Info 4114 4.530309 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4114 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.444286000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 4.530309000 seconds] Frame Number: 4114 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9c34 (39988) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5629 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2990449, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2990449 (relative sequence number) [Next sequence number: 2991817 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd934 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608967, TSecr 60594729 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4113] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \266}\375{\247\235j\205LE~.\207^\241'\027\376\277\361h\220PT\016\a\262\342\262\363\226#\253\313\343\b;\350\314Z\253\276\307\317\n5l\375\365\267\a\250nci\232\224;\211\340J\227O\207-&lcV\333\323N|\211\262/\220-\343\312/ No. Time Source Destination Protocol Info 4115 4.530319 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4115 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.444296000 [Time delta from previous captured frame: 0.000010000 seconds] [Time delta from previous displayed frame: 0.000010000 seconds] [Time since reference or first frame: 4.530319000 seconds] Frame Number: 4115 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd855 (55381) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1a08 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2991817, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2991817 (relative sequence number) [Next sequence number: 2993185 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x86da [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608967, TSecr 60594729 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: Q<\312%\306P>\211L4\242y\364\200\351EI\254\217\376\177\r\000\255t\200\2667\244^\373\344z\313\205\345\302\202\203h6L\301\332C\347{\234\342,\271?/\353\267l?\265w\277~\366\333\326D[X\224\276A:\327OU\204\260H\264\035\367\ No. Time Source Destination Protocol Info 4116 4.589951 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2980873 Win=87552 Len=0 TSV=60594735 TSER=987608964 Frame 4116 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.503928000 [Time delta from previous captured frame: 0.059632000 seconds] [Time delta from previous displayed frame: 0.059632000 seconds] [Time since reference or first frame: 4.589951000 seconds] Frame Number: 4116 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb5 (19381) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb300 [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2980873, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2980873 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x8409 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594735, TSecr 987608964 No. Time Source Destination Protocol Info 4117 4.589986 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4117 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.503963000 [Time delta from previous captured frame: 0.000035000 seconds] [Time delta from previous displayed frame: 0.000035000 seconds] [Time since reference or first frame: 4.589986000 seconds] Frame Number: 4117 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xb709 (46857) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3b54 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2993185, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2993185 (relative sequence number) [Next sequence number: 2994553 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xc444 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608967, TSecr 60594735 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4116] [The RTT to ACK the segment was: 0.000035000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \371{\362\314\317\335DQT\245\325\272]_M?\304q\252\341\f\313&\v\022D\301Q\2769\037%\026%\304\251\230\361N\243\243]\356:^\253\025\353\250\377\016a\254M\001\252\030\376\026W\223\016\005\254\b\255+6J\336\276#\021\304q\276 No. Time Source Destination Protocol Info 4118 4.589993 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4118 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.503970000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 4.589993000 seconds] Frame Number: 4118 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5319 (21273) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9f44 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2994553, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2994553 (relative sequence number) [Next sequence number: 2995921 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8169 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608967, TSecr 60594735 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \333\202\002\027\031\310uV\301s\342\200\000\200\335A \000\023\241\201M\265l\234\236\261\363\353sY\334\202\200\304\206\233o\376\315\301\001\023\343m\347?\357\220\231\356\255\321\271\212`\263\374\276|:\304\334\377@\226 No. Time Source Destination Protocol Info 4119 4.649964 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2983609 Win=87552 Len=0 TSV=60594741 TSER=987608965 Frame 4119 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.563941000 [Time delta from previous captured frame: 0.059971000 seconds] [Time delta from previous displayed frame: 0.059971000 seconds] [Time since reference or first frame: 4.649964000 seconds] Frame Number: 4119 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb6 (19382) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2ff [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2983609, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2983609 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x7952 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594741, TSecr 987608965 No. Time Source Destination Protocol Info 4120 4.650003 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4120 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.563980000 [Time delta from previous captured frame: 0.000039000 seconds] [Time delta from previous displayed frame: 0.000039000 seconds] [Time since reference or first frame: 4.650003000 seconds] Frame Number: 4120 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x7248 (29256) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x8015 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2995921, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2995921 (relative sequence number) [Next sequence number: 2997289 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xaff6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608968, TSecr 60594741 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4119] [The RTT to ACK the segment was: 0.000039000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \322\362\361\3306\316\037\375|$\240\022\n\356F\227\377N\356+A\177\201=C\252\035.l\205\332m\371}W\271Tz\341g\000\331\257.\332'\215)\207k\023\326\257\001\357\177\257\177\340\375\367_\324\373\256W`\\253\263\353\315\222\3 No. Time Source Destination Protocol Info 4121 4.650011 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4121 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.563988000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.650011000 seconds] Frame Number: 4121 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcd64 (52580) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x24f9 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2997289, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2997289 (relative sequence number) [Next sequence number: 2998657 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x1d5d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608968, TSecr 60594741 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 4122 4.710092 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2986345 Win=87552 Len=0 TSV=60594747 TSER=987608965 Frame 4122 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.624069000 [Time delta from previous captured frame: 0.060081000 seconds] [Time delta from previous displayed frame: 0.060081000 seconds] [Time since reference or first frame: 4.710092000 seconds] Frame Number: 4122 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb7 (19383) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2fe [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2986345, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2986345 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x6e9c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594747, TSecr 987608965 No. Time Source Destination Protocol Info 4123 4.710132 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4123 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.624109000 [Time delta from previous captured frame: 0.000040000 seconds] [Time delta from previous displayed frame: 0.000040000 seconds] [Time since reference or first frame: 4.710132000 seconds] Frame Number: 4123 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x5a1e (23070) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x983f [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 2998657, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 2998657 (relative sequence number) [Next sequence number: 3000025 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xe26c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608968, TSecr 60594747 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4122] [The RTT to ACK the segment was: 0.000040000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \376\217\267\264%5\325\375\276\266\232\326b\275\f\362*\b9\233r\177\303\021\253\253\367\177\353\265\261\260A\365\244\233%\002\032S\256Y\236\204\205B^\315J\260yk\031\0048\024o\357F\207MM\275 \t\247\021\r\215vl\313A\203J No. Time Source Destination Protocol Info 4124 4.710140 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4124 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.624117000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.710140000 seconds] Frame Number: 4124 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x0370 (880) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xeeed [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3000025, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3000025 (relative sequence number) [Next sequence number: 3001393 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x09eb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608968, TSecr 60594747 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \250IC\303\270\254\033X\243*U\204\250\212\320\243\024\230PT\324\030X\217\221\275?\0328\211\352>&\260\202j\203\271\335\035\023\245H\304\272\3277w\016\206s\324f'\023N\200\254\330\277O\274^\200#F+[k\311T\261/Z\021\vj5\27 No. Time Source Destination Protocol Info 4125 4.770303 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2989081 Win=87552 Len=0 TSV=60594753 TSER=987608965 Frame 4125 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.684280000 [Time delta from previous captured frame: 0.060163000 seconds] [Time delta from previous displayed frame: 0.060163000 seconds] [Time since reference or first frame: 4.770303000 seconds] Frame Number: 4125 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb8 (19384) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2fd [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2989081, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2989081 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x63e6 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594753, TSecr 987608965 No. Time Source Destination Protocol Info 4126 4.770345 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4126 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.684322000 [Time delta from previous captured frame: 0.000042000 seconds] [Time delta from previous displayed frame: 0.000042000 seconds] [Time since reference or first frame: 4.770345000 seconds] Frame Number: 4126 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x3f0f (16143) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb34e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3001393, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3001393 (relative sequence number) [Next sequence number: 3002761 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x10be [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608969, TSecr 60594753 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4125] [The RTT to ACK the segment was: 0.000042000 seconds] [Number of bytes in flight: 16416] FTP Data [truncated] FTP Data: \255<\260\336\200q4\037\210\340!\f\024%\222\236\311\260\320\340HQ\b m,\221\200\346\252\021\252\257\004\275N\227\330\000\302\261}s[\264\204\365\300\341%\222\365\210\330\241e=\331\260\223\251\364H\3144\306R\f\335\327\25 No. Time Source Destination Protocol Info 4127 4.770361 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4127 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.684338000 [Time delta from previous captured frame: 0.000016000 seconds] [Time delta from previous displayed frame: 0.000016000 seconds] [Time since reference or first frame: 4.770361000 seconds] Frame Number: 4127 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1725 (5925) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xdb38 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3002761, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3002761 (relative sequence number) [Next sequence number: 3004129 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xeb17 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608969, TSecr 60594753 [SEQ/ACK analysis] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \302Y\236\275rqJA\302\001S!\326&=\177\367\345\343`\032\0329e\367oU\224\234\017\304p!\f\024E\252\223c\241\300\330\304\026\021\b\022\233\361:\225\245\264L\225]\222\365e\256\246u6\0063\244\233p|\356\342x\265}5\266\343r\0 No. Time Source Destination Protocol Info 4128 4.770368 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4128 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.684345000 [Time delta from previous captured frame: 0.000007000 seconds] [Time delta from previous displayed frame: 0.000007000 seconds] [Time since reference or first frame: 4.770368000 seconds] Frame Number: 4128 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x1d21 (7457) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd53c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3004129, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3004129 (relative sequence number) [Next sequence number: 3005497 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x64d9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608969, TSecr 60594753 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: s'\t\a\371\226\036\215JR\221\001\246\0322\r\262x \025\273\325*\356>\237\f\346\331n~Lq\245\304\n\036\272D\350E\265\002\351d\272mYh\254Y\3555G\332`\236\361\244\206\360\021\350\305M\027_D6\301\222\025\377\247\355\243\r\3 No. Time Source Destination Protocol Info 4129 4.830544 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2991817 Win=87552 Len=0 TSV=60594759 TSER=987608966 Frame 4129 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.744521000 [Time delta from previous captured frame: 0.060176000 seconds] [Time delta from previous displayed frame: 0.060176000 seconds] [Time since reference or first frame: 4.830544000 seconds] Frame Number: 4129 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bb9 (19385) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2fc [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2991817, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2991817 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x592f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594759, TSecr 987608966 No. Time Source Destination Protocol Info 4130 4.830581 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4130 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.744558000 [Time delta from previous captured frame: 0.000037000 seconds] [Time delta from previous displayed frame: 0.000037000 seconds] [Time since reference or first frame: 4.830581000 seconds] Frame Number: 4130 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xcd34 (52532) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x2529 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3005497, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3005497 (relative sequence number) [Next sequence number: 3006865 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x32db [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608970, TSecr 60594759 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4129] [The RTT to ACK the segment was: 0.000037000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\ No. Time Source Destination Protocol Info 4131 4.830589 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4131 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.744566000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 4.830589000 seconds] Frame Number: 4131 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x9c25 (39973) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x5638 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3006865, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3006865 (relative sequence number) [Next sequence number: 3008233 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x06e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608970, TSecr 60594759 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \334\3149\211\021\311\314\301\366*}\204\345\340\000\000\001(!\000\226\341\t\005\306a0\202\267\3732\313\247\313\004\325UUU]r \215u\a\277+\0257\364\302\224\342\336\332\225\231\256\335\345\341PMZ\303\032\312k\251\353\240 No. Time Source Destination Protocol Info 4132 4.890508 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2994553 Win=87552 Len=0 TSV=60594765 TSER=987608967 Frame 4132 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.804485000 [Time delta from previous captured frame: 0.059919000 seconds] [Time delta from previous displayed frame: 0.059919000 seconds] [Time since reference or first frame: 4.890508000 seconds] Frame Number: 4132 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bba (19386) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2fb [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2994553, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2994553 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x4e78 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594765, TSecr 987608967 No. Time Source Destination Protocol Info 4133 4.890570 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4133 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.804547000 [Time delta from previous captured frame: 0.000062000 seconds] [Time delta from previous displayed frame: 0.000062000 seconds] [Time since reference or first frame: 4.890570000 seconds] Frame Number: 4133 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x183d (6205) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xda20 [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3008233, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3008233 (relative sequence number) [Next sequence number: 3009601 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xd846 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608970, TSecr 60594765 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4132] [The RTT to ACK the segment was: 0.000062000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \305\240\002\311p0\003\001\227}\307\325\236\334}j\242\374\027\f\305\t\257UQuQu\256$`\356\253Z\252\252\340\214@F\252\242\353H\264U\206#L q\221qqu\027MR\027\340\355\211\005\034\026\257\0328!6rzT:\360D\322\337\002\217-\0 No. Time Source Destination Protocol Info 4134 4.890583 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4134 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.804560000 [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 4.890583000 seconds] Frame Number: 4134 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x8a63 (35427) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x67fa [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3009601, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3009601 (relative sequence number) [Next sequence number: 3010969 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0xba9a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608970, TSecr 60594765 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: \251\033J#\034\303\201-Uj\276H\3737U\306 E\253\244\307\301,\]UUW.5\275k\230\201\316\253\227\364\323\304\r.r\n\316\306\206uF\325[k\3743-W\363u_-u|\334yGK8\300\216\362\374;\374>\327S\227\000\000\000,\001\250\201`\270\30 No. Time Source Destination Protocol Info 4135 4.950524 x.x.x.x 89.223.234.248 TCP 38691 > 52904 [ACK] Seq=1 Ack=2997289 Win=87552 Len=0 TSV=60594771 TSER=987608967 Frame 4135 (56 bytes on wire, 56 bytes captured) Arrival Time: May 30, 2010 12:32:39.864501000 [Time delta from previous captured frame: 0.059941000 seconds] [Time delta from previous displayed frame: 0.059941000 seconds] [Time since reference or first frame: 4.950524000 seconds] Frame Number: 4135 Frame Length: 56 bytes Capture Length: 56 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: x.x.x.x (x.x.x.x), Dst: 89.223.234.248 (89.223.234.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0x4bbb (19387) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 57 Protocol: TCP (0x06) Header checksum: 0xb2fa [correct] [Good: True] [Bad : False] Source: x.x.x.x (x.x.x.x) Destination: 89.223.234.248 (89.223.234.248) Transmission Control Protocol, Src Port: 38691 (38691), Dst Port: 52904 (52904), Seq: 1, Ack: 2997289, Len: 0 Source port: 38691 (38691) Destination port: 52904 (52904) [Stream index: 14] Sequence number: 1 (relative sequence number) Acknowledgement number: 2997289 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 87552 (scaled) Checksum: 0x43c2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 60594771, TSecr 987608967 No. Time Source Destination Protocol Info 4136 4.950562 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4136 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.864539000 [Time delta from previous captured frame: 0.000038000 seconds] [Time delta from previous displayed frame: 0.000038000 seconds] [Time since reference or first frame: 4.950562000 seconds] Frame Number: 4136 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0x2441 (9281) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xce1c [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3010969, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3010969 (relative sequence number) [Next sequence number: 3012337 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x8043 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608971, TSecr 60594771 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4135] [The RTT to ACK the segment was: 0.000038000 seconds] [Number of bytes in flight: 17784] FTP Data [truncated] FTP Data: \235\322\301\240\300G`\274\021+\307@\000\000\000\360\001\000 \332\210\026\v\214\263\217\222\b\356\375h\330\206@\237W69\3553wy \240\037\205\344\v\365\005a\t\263&e\310\207\212b\236\224h:0pa\203C\272\256l\252\362\00142\0 No. Time Source Destination Protocol Info 4137 4.950571 89.223.234.248 x.x.x.x FTP-DATA FTP Data: 1368 bytes Frame 4137 (1424 bytes on wire, 1424 bytes captured) Arrival Time: May 30, 2010 12:32:39.864548000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.000009000 seconds] [Time since reference or first frame: 4.950571000 seconds] Frame Number: 4137 Frame Length: 1424 bytes Capture Length: 1424 bytes [Frame is marked: True] [Protocols in frame: ppp:ip:tcp:ftp-data] [Coloring Rule Name: ___tmp_color_filter___01] [Coloring Rule String: (ip.addr eq x.x.x.x and ip.addr eq 89.223.234.248) and (tcp.port eq 38691 and tcp.port eq 52904)] Point-to-Point Protocol Address: 0xff Control: 0x03 Protocol: IP (0x0021) Internet Protocol, Src: 89.223.234.248 (89.223.234.248), Dst: x.x.x.x (x.x.x.x) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1420 Identification: 0xd53f (54591) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x1d1e [correct] [Good: True] [Bad : False] Source: 89.223.234.248 (89.223.234.248) Destination: x.x.x.x (x.x.x.x) Transmission Control Protocol, Src Port: 52904 (52904), Dst Port: 38691 (38691), Seq: 3012337, Ack: 1, Len: 1368 Source port: 52904 (52904) Destination port: 38691 (38691) [Stream index: 14] Sequence number: 3012337 (relative sequence number) [Next sequence number: 3013705 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 230000 (scaled) Checksum: 0x5575 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 987608971, TSecr 60594771 [SEQ/ACK analysis] [Number of bytes in flight: 19152] FTP Data [truncated] FTP Data: }q\2761t\377\377\'\367\344\347\374]i%\025\373\202\3301\215\373\351>z\366\265\341\222e\376(5\310%k\314\023\276\347\377o\245\323}\337\375\361\003\2738'\317X\256\177\022\372\345<^bj\265)\274o\237\340\217\273\313\236\t.\3