CS 455 Spring 2013 | CS455-S13 / Wireshark Capture Notes

Capture

Download of http://warcreate.com/, captured at the client (128.82.5.17)

 No.    Time        Source           Destination     Protocol Length Info
 1      0.000000    128.82.5.17      128.82.4.3      DNS      73     Standard query 0x7061  A warcreate.com
 2      0.000324    128.82.4.3       128.82.5.17     DNS      89     Standard query response 0x7061  A 67.205.2.233

 3      0.002149    128.82.5.17      67.205.2.233    TCP      78     49204 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=16 TSval=2772015878 TSecr=0 SACK_PERM=1
 4      0.002214    128.82.5.17      67.205.2.233    TCP      78     49205 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=16 TSval=2772015878 TSecr=0 SACK_PERM=1
 5      0.002268    128.82.5.17      67.205.2.233    TCP      78     49206 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=16 TSval=2772015878 TSecr=0 SACK_PERM=1
 6      0.071854    67.205.2.233     128.82.5.17     TCP      66     http > 49204 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380 SACK_PERM=1 WS=512
 7      0.071960    128.82.5.17      67.205.2.233    TCP      54     49204 > http [ACK] Seq=1 Ack=1 Win=262144 Len=0
 8      0.074123    67.205.2.233     128.82.5.17     TCP      66     http > 49206 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380 SACK_PERM=1 WS=512
 9      0.074124    67.205.2.233     128.82.5.17     TCP      66     http > 49205 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380 SACK_PERM=1 WS=512
 10     0.074317    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=1 Ack=1 Win=262144 Len=0
 11     0.074331    128.82.5.17      67.205.2.233    TCP      54     49205 > http [ACK] Seq=1 Ack=1 Win=262144 Len=0

 12     0.148168    128.82.5.17      67.205.2.233    HTTP     440    GET / HTTP/1.1
 13     0.218287    67.205.2.233     128.82.5.17     TCP      60     http > 49204 [ACK] Seq=1 Ack=387 Win=7168 Len=0
 14     0.262254    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 15     0.262258    67.205.2.233     128.82.5.17     HTTP     171    HTTP/1.1 200 OK  (text/html)
 16     0.262323    128.82.5.17      67.205.2.233    TCP      54     49204 > http [ACK] Seq=387 Ack=1498 Win=260640 Len=0

 17     0.298004    128.82.5.17      67.205.2.233    HTTP     436    GET /style.css HTTP/1.1
 18     0.334490    128.82.5.17      67.205.2.233    HTTP     420    GET /icon.png HTTP/1.1
 19     0.367702    67.205.2.233     128.82.5.17     TCP      60     http > 49204 [ACK] Seq=1498 Ack=769 Win=8192 Len=0
 20     0.405396    67.205.2.233     128.82.5.17     TCP      60     http > 49206 [ACK] Seq=1 Ack=367 Win=7168 Len=0
 21     0.410632    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 22     0.410635    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 23     0.410670    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=2761 Win=259376 Len=0
 24     0.410797    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 25     0.411516    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=4141 Win=262144 Len=0
 26     0.435018    67.205.2.233     128.82.5.17     HTTP     968    HTTP/1.1 200 OK  (text/css)
 27     0.435074    128.82.5.17      67.205.2.233    TCP      54     49204 > http [ACK] Seq=769 Ack=2412 Win=261216 Len=0
 28     0.481603    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 29     0.481680    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 30     0.481703    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=6901 Win=260752 Len=0
 31     0.481772    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 32     0.481876    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=8281 Win=262144 Len=0
 33     0.482295    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 34     0.482480    67.205.2.233     128.82.5.17     TCP      1434   [TCP segment of a reassembled PDU]
 35     0.482495    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=11041 Win=260752 Len=0
 36     0.552579    67.205.2.233     128.82.5.17     HTTP     1062   HTTP/1.1 200 OK  (PNG)
 37     0.552645    128.82.5.17      67.205.2.233    TCP      54     49206 > http [ACK] Seq=367 Ack=12049 Win=261136 Len=0

Summary

DNS Query/Response:

128.82.5.17 -> 128.82.4.3 (local authoritative server)

TCP Connections:

128.82.5.17:49204 -> 67.205.2.233:80 (warcreate.com)
128.82.5.17:49205 -> 67.205.2.233:80 (warcreate.com)
128.82.5.17:49206 -> 67.205.2.233:80 (warcreate.com)

HTTP Req/Rsp:

warcreate.com/ - base page, TCP #1, req pckt 13, rsp pckts 14-15
warcreate.com/style.css - TCP #1, req pckt 17, rsp pckt 26
warcreate.com/icon.png - TCP #3, req pckt 18, rsp pckts 21, 22, 24, 28, 29, 31, 33, 34, 36

From CS 455 Spring 2013

CS455-S13: Wireshark Capture Notes

Capture

Summary