1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
| <?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="pdml2html.xsl"?>
<!-- You can find pdml2html.xsl in C:\Program Files\Wireshark or at <a href="http://anonsvn.wireshark.org/trunk/wireshark/pdml2html.xsl" target="_blank">http://anonsvn.wireshark.org/trunk/w.../pdml2html.xsl</a>. -->
<pdml version="0" creator="wireshark/1.12.4" time="Mon May 18 12:24:58 2015" capture_file="C:\Users\MARIET~1\AppData\Local\Temp\wireshark_pcapng_D2D03A68-A0EE-4651-9601-310E6998E63F_20150518122315_a05144">
<packet>
<proto name="geninfo" pos="0" showname="General information" size="79">
<field name="num" pos="0" show="1" showname="Number" value="1" size="79"/>
<field name="len" pos="0" show="79" showname="Frame Length" value="4f" size="79"/>
<field name="caplen" pos="0" show="79" showname="Captured Length" value="4f" size="79"/>
<field name="timestamp" pos="0" show="May 18, 2015 12:23:17.238689000 Paris, Madrid (heure d’été)" showname="Captured Time" value="1431944597.238689000" size="79"/>
</proto>
<proto name="frame" showname="Frame 1: 79 bytes on wire (632 bits), 79 bytes captured (632 bits) on interface 0" size="79" pos="0">
<field name="frame.interface_id" showname="Interface id: 0 (\Device\NPF_{D2D03A68-A0EE-4651-9601-310E6998E63F})" size="0" pos="0" show="0"/>
<field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/>
<field name="frame.time" showname="Arrival Time: May 18, 2015 12:23:17.238689000 Paris, Madrid (heure d\xe2\x80\x99\xc3\xa9t\xc3\xa9)" size="0" pos="0" show="May 18, 2015 12:23:17.238689000 Paris, Madrid (heure d\xe2\x80\x99\xc3\xa9t\xc3\xa9)"/>
<field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_epoch" showname="Epoch Time: 1431944597.238689000 seconds" size="0" pos="0" show="1431944597.238689000"/>
<field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.time_relative" showname="Time since reference or first frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/>
<field name="frame.number" showname="Frame Number: 1" size="0" pos="0" show="1"/>
<field name="frame.len" showname="Frame Length: 79 bytes (632 bits)" size="0" pos="0" show="79"/>
<field name="frame.cap_len" showname="Capture Length: 79 bytes (632 bits)" size="0" pos="0" show="79"/>
<field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/>
<field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/>
<field name="frame.protocols" showname="Protocols in frame: eth:ethertype:ip:udp:dns" size="0" pos="0" show="eth:ethertype:ip:udp:dns"/>
<field name="frame.coloring_rule.name" showname="Coloring Rule Name: UDP" size="0" pos="0" show="UDP"/>
<field name="frame.coloring_rule.string" showname="Coloring Rule String: udp" size="0" pos="0" show="udp"/>
</proto>
<proto name="eth" showname="Ethernet II, Src: HonHaiPr_3c:e6:55 (c0:38:96:3c:e6:55), Dst: Vmware_80:01:15 (00:50:56:80:01:15)" size="14" pos="0">
<field name="eth.dst" showname="Destination: Vmware_80:01:15 (00:50:56:80:01:15)" size="6" pos="0" show="00:50:56:80:01:15" value="005056800115">
<field name="eth.dst_resolved" showname="Destination (resolved): Vmware_80:01:15" hide="yes" size="6" pos="0" show="Vmware_80:01:15" value="005056800115"/>
<field name="eth.addr" showname="Address: Vmware_80:01:15 (00:50:56:80:01:15)" size="6" pos="0" show="00:50:56:80:01:15" value="005056800115"/>
<field name="eth.addr_resolved" showname="Address (resolved): Vmware_80:01:15" hide="yes" size="6" pos="0" show="Vmware_80:01:15" value="005056800115"/>
<field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="005056"/>
<field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="005056"/>
</field>
<field name="eth.src" showname="Source: HonHaiPr_3c:e6:55 (c0:38:96:3c:e6:55)" size="6" pos="6" show="c0:38:96:3c:e6:55" value="c038963ce655">
<field name="eth.src_resolved" showname="Source (resolved): HonHaiPr_3c:e6:55" hide="yes" size="6" pos="6" show="HonHaiPr_3c:e6:55" value="c038963ce655"/>
<field name="eth.addr" showname="Address: HonHaiPr_3c:e6:55 (c0:38:96:3c:e6:55)" size="6" pos="6" show="c0:38:96:3c:e6:55" value="c038963ce655"/>
<field name="eth.addr_resolved" showname="Address (resolved): HonHaiPr_3c:e6:55" hide="yes" size="6" pos="6" show="HonHaiPr_3c:e6:55" value="c038963ce655"/>
<field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="c03896"/>
<field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="c03896"/>
</field>
<field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="2048" value="0800"/>
</proto>
<proto name="ip" showname="Internet Protocol Version 4, Src: 10.129.16.143 (10.129.16.143), Dst: 193.50.208.4 (193.50.208.4)" size="20" pos="14">
<field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/>
<field name="ip.hdr_len" showname="Header Length: 20 bytes" size="1" pos="14" show="20" value="45"/>
<field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00">
<field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0" value="0" unmaskedvalue="00"/>
<field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0" value="0" unmaskedvalue="00"/>
</field>
<field name="ip.len" showname="Total Length: 65" size="2" pos="16" show="65" value="0041"/>
<field name="ip.id" showname="Identification: 0x7595 (30101)" size="2" pos="18" show="30101" value="7595"/>
<field name="ip.flags" showname="Flags: 0x00" size="1" pos="20" show="0" value="00">
<field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="00"/>
<field name="ip.flags.df" showname=".0.. .... = Don't fragment: Not set" size="1" pos="20" show="0" value="00"/>
<field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="00"/>
</field>
<field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="0000"/>
<field name="ip.ttl" showname="Time to live: 128" size="1" pos="22" show="128" value="80"/>
<field name="ip.proto" showname="Protocol: UDP (17)" size="1" pos="23" show="17" value="11"/>
<field name="ip.checksum" showname="Header checksum: 0x18d0 [validation disabled]" size="2" pos="24" show="6352" value="18d0">
<field name="ip.checksum_good" showname="Good: False" size="2" pos="24" show="0" value="18d0"/>
<field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="18d0"/>
</field>
<field name="ip.src" showname="Source: 10.129.16.143 (10.129.16.143)" size="4" pos="26" show="10.129.16.143" value="0a81108f"/>
<field name="ip.addr" showname="Source or Destination Address: 10.129.16.143 (10.129.16.143)" hide="yes" size="4" pos="26" show="10.129.16.143" value="0a81108f"/>
<field name="ip.src_host" showname="Source Host: 10.129.16.143" hide="yes" size="4" pos="26" show="10.129.16.143" value="0a81108f"/>
<field name="ip.host" showname="Source or Destination Host: 10.129.16.143" hide="yes" size="4" pos="26" show="10.129.16.143" value="0a81108f"/>
<field name="ip.dst" showname="Destination: 193.50.208.4 (193.50.208.4)" size="4" pos="30" show="193.50.208.4" value="c132d004"/>
<field name="ip.addr" showname="Source or Destination Address: 193.50.208.4 (193.50.208.4)" hide="yes" size="4" pos="30" show="193.50.208.4" value="c132d004"/>
<field name="ip.dst_host" showname="Destination Host: 193.50.208.4" hide="yes" size="4" pos="30" show="193.50.208.4" value="c132d004"/>
<field name="ip.host" showname="Source or Destination Host: 193.50.208.4" hide="yes" size="4" pos="30" show="193.50.208.4" value="c132d004"/>
<field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="0a81108f"/>
<field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="c132d004"/>
</proto>
<proto name="udp" showname="User Datagram Protocol, Src Port: 58063 (58063), Dst Port: 53 (53)" size="8" pos="34">
<field name="udp.srcport" showname="Source Port: 58063 (58063)" size="2" pos="34" show="58063" value="e2cf"/>
<field name="udp.dstport" showname="Destination Port: 53 (53)" size="2" pos="36" show="53" value="0035"/>
<field name="udp.port" showname="Source or Destination Port: 58063" hide="yes" size="2" pos="34" show="58063" value="e2cf"/>
<field name="udp.port" showname="Source or Destination Port: 53" hide="yes" size="2" pos="36" show="53" value="0035"/>
<field name="udp.length" showname="Length: 45" size="2" pos="38" show="45" value="002d"/>
<field name="udp.checksum_coverage" showname="Checksum coverage: 45" hide="yes" size="0" pos="38" show="45"/>
<field name="udp.checksum" showname="Checksum: 0x3736 [validation disabled]" size="2" pos="40" show="14134" value="3736">
<field name="udp.checksum_good" showname="Good Checksum: False" size="2" pos="40" show="0" value="3736"/>
<field name="udp.checksum_bad" showname="Bad Checksum: False" size="2" pos="40" show="0" value="3736"/>
</field>
<field name="udp.stream" showname="Stream index: 0" size="0" pos="42" show="0"/>
</proto>
<proto name="dns" showname="Domain Name System (query)" size="37" pos="42">
<field name="dns.response_in" showname="Response In: 3" size="0" pos="42" show="3"/>
<field name="dns.id" showname="Transaction ID: 0xff4f" size="2" pos="42" show="65359" value="ff4f"/>
<field name="dns.flags" showname="Flags: 0x0100 Standard query" size="2" pos="44" show="256" value="0100">
<field name="dns.flags.response" showname="0... .... .... .... = Response: Message is a query" size="2" pos="44" show="0" value="0" unmaskedvalue="0100"/>
<field name="dns.flags.opcode" showname=".000 0... .... .... = Opcode: Standard query (0)" size="2" pos="44" show="0" value="0" unmaskedvalue="0100"/>
<field name="dns.flags.truncated" showname=".... ..0. .... .... = Truncated: Message is not truncated" size="2" pos="44" show="0" value="0" unmaskedvalue="0100"/>
<field name="dns.flags.recdesired" showname=".... ...1 .... .... = Recursion desired: Do query recursively" size="2" pos="44" show="1" value="1" unmaskedvalue="0100"/>
<field name="dns.flags.z" showname=".... .... .0.. .... = Z: reserved (0)" size="2" pos="44" show="0" value="0" unmaskedvalue="0100"/>
<field name="dns.flags.checkdisable" showname=".... .... ...0 .... = Non-authenticated data: Unacceptable" size="2" pos="44" show="0" value="0" unmaskedvalue="0100"/>
</field>
<field name="dns.count.queries" showname="Questions: 1" size="2" pos="46" show="1" value="0001"/>
<field name="dns.count.answers" showname="Answer RRs: 0" size="2" pos="48" show="0" value="0000"/>
<field name="dns.count.auth_rr" showname="Authority RRs: 0" size="2" pos="50" show="0" value="0000"/>
<field name="dns.count.add_rr" showname="Additional RRs: 0" size="2" pos="52" show="0" value="0000"/>
<field name="" show="Queries" size="25" pos="54" value="08636c69656e74733206676f6f676c6503636f6d0000010001">
<field name="" show="clients2.google.com: type A, class IN" size="25" pos="54" value="08636c69656e74733206676f6f676c6503636f6d0000010001">
<field name="dns.qry.name" showname="Name: clients2.google.com" size="21" pos="54" show="clients2.google.com" value="08636c69656e74733206676f6f676c6503636f6d00"/>
<field name="dns.qry.name.len" showname="Name Length: 19" size="21" pos="54" show="19" value="08636c69656e74733206676f6f676c6503636f6d00"/>
<field name="dns.count.labels" showname="Label Count: 3" size="21" pos="54" show="3" value="08636c69656e74733206676f6f676c6503636f6d00"/>
<field name="dns.qry.type" showname="Type: A (Host Address) (1)" size="2" pos="75" show="1" value="0001"/>
<field name="dns.qry.class" showname="Class: IN (0x0001)" size="2" pos="77" show="1" value="0001"/>
</field>
</field>
</proto>
<proto name="mate" showname="MATE udp_pdu:1" size="0" pos="0">
<field name="mate.udp_pdu" showname="udp_pdu: 1" size="0" pos="0" show="1">
<field name="mate.udp_pdu.RelativeTime" showname="udp_pdu time: 0" size="0" pos="0" show="0"/>
<field name="" show="udp_pdu Attributes" size="0" pos="0">
<field name="mate.udp_pdu.http_session" showname="http_session: 0" size="0" pos="0" show="0"/>
<field name="mate.udp_pdu.port" showname="port: 58063" size="0" pos="0" show="58063"/>
<field name="mate.udp_pdu.port" showname="port: 53" size="0" pos="0" show="53"/>
</field>
</field>
</proto>
</packet> |
