Question

1 Approved Answer

Posted on Sep 26, 2024

1 Download .cap files(one for http, one for telnet) and import them into the Wireshark. Analyze files and create report based on all information you

1 Download .cap files(one for http, one for telnet) and import them into the Wireshark. Analyze files and create report based on all information you can get from files.

P.s Your report has to be as simple as that non IT managers can understand.

2 Start Capturing your NIC until you get both TCP and UDP segments. Analyze both packets and compare them. image text in transcribed

No. Protocol TCP TCP TCP HTTP Time 1 0.000000 20.911310 3 0.911310 4 0.911310 5 1.472116 6 1.682419 7 1.812606 8 1.812606 9 2.012894 10 2.443513 11 2.553672 12 2.553672 13 2.553672 14 2.633787 15 2.814046 16 2.894161 17 2.914190 18 2.984291 19 3.014334 20 3.374852 21 3.495025 22 3.495025 23 3.635227 24 3.645241 25 3.815486 26 3.915630 27 3.955688 28 3.955688 29 4.105904 30 4.216062 31 4.226076 32 4.356264 33 4.356264 34 4.496465 35 4.496465 36 4.776868 37 4.776868 38 4.846969 39 5.017214 40 17.905747 41 17.905747 42 30.063228 43 30.393704 Source 145.254.160.237 65.208.228.223 145.254.160.237 145.254.160.237 65.208.228.223 65.208.228.223 145.254.160.237 65.208.228.223 145.254.160.237 65.208.228.223 65. 208. 228.223 145.254.160.237 145.254.160.237 65.208.228.223 145.254.160.237 65.208.228.223 145.253.2.203 145.254.160.237 145.254.160.237 65.208.228.223 65.208.228.223 145.254.160.237 65.208.228.223 216.239.59.99 145.254.160.237 216.239.59.99 216.239.59.99 145.254.160.237 65.208.228.223 145.254.160.237 65. 208. 228.223 65.208.228.223 145.254.160.237 65.208.228.223 145.254.160.237 216.239.59.99 145.254.160.237 65.208.228.223 145.254.160.237 65.208.228.223 145.254.160.237 145.254.160.237 65.208.228.223 Destination 65.208.228.223 145.254.160.237 65.208.228.223 65.208.228.223 145.254.160.237 145.254.160.237 65. 208.228.223 145.254.160.237 65.208.228.223 145.254.160.237 145.254.160.237 65.208.228.223 145.253.2.203 145.254.160.237 65.208.228.223 145.254.160.237 145.254.160.237 216.239.59.99 65.208.228.223 145.254.160.237 145.254.160.237 65. 208.228.223 145.254.160.237 145.254.160.237 65.208.228.223 145.254.160.237 145.254.160.237 216.239.59.99 145.254.160.237 65. 208.228.223 145.254.160.237 145.254.160.237 65.208.228.223 145.254.160.237 65. 208.228.223 145.254.160.237 216.239.59.99 145.254.160.237 65.208.228.223 145.254.160.237 65.208.228.223 65. 208.228.223 145.254.160.237 TCP TCP TCP TCP TCP TCP TCP TCP DNS TCP TCP TCP DNS HTTP TCP TCP TCP TCP TCP TCP TCP TCP HTTP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP HTTP/X... TCP TCP TCP TCP TCP Length Info 62 3372 80 [SYN] Seq=0 Win=8760 Len=0 MSS=1460 SACK_PERM=1 62 80 + 3372 (SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1380 SACK_PERM=1 54 3372 80 [ACK] Seq=1 Ack=1 Win=9660 Len=0 533 GET /download.html HTTP/1.1 54 80 + 3372 [ACK] Seq=1 Ack=480 Win=6432 Len=0 1434 80 3372 [ACK] Seq=1 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=1381 Win=9660 Len=0 1434 80 3372 [ACK] Seq=1381 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=2761 Win=9660 Len=0 1434 80 3372 [ACK] Seq=2761 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 1434 80 3372 [PSH, ACK] Seq=4141 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=5521 Win=9660 Len=0 89 Standard query x0023 A pagead2.googlesyndication.com 1434 80 3372 [ACK] Seq=5521 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=6901 Win=9660 Len=0 1434 80 3372 [ACK] Seq=6901 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 188 Standard query response @x0023 A pagead2.googlesyndication.com CNAME pagead2.google.com CNAME pagead.google.akadns.net A 216.239.59.104 A 216.239.59.99 775 GET /pagead/ads?client=ca-pub-2309191948673629&random=1084443430285&Imt=1082467020&format=468x60_as&output=html&url=http%3A%2F%2Fwww.ethereal.com%2Fdownload.html&color_bg=FFFFFF&color_text=333... 54 3372 80 [ACK] Seq=480 Ack=8281 Win=9660 Len=0 1434 80 + 3372 [ACK] Seq=8281 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 1434 80 3372 (PSH, ACK] Seq=9661 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=11041 Win=9660 Len=0 1434 80 3372 [ACK] Seq=11041 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 80 3371 [ACK] Seq=1 Ack=722 Win=31460 Len=0 54 3372 80 [ACK] Seq=480 Ack=12421 Win=9660 Len=0 1484 80 3371 [PSH, ACK] Seq=1 Ack=722 Win=31460 Len=1430 (TCP segment of a reassembled PDU] 214 HTTP/1.1 200 OK (text/html) 54 3371 + 80 [ACK] Seq=722 Ack=1591 Win=8760 Len=0 1434 80 3372 [PSH, ACK] Seq=12421 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=13801 Win=9660 Len=0 1434 80 3372 [ACK] Seq=13801 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 1434 80 + 3372 [ACK] Seq=15181 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=16561 Win=9660 Len=0 1434 80 3372 [ACK] Seq=16561 Ack=480 Win=6432 Len=1380 (TCP segment of a reassembled PDU] 54 3372 80 [ACK] Seq=480 Ack=17941 Win=9660 Len=0 1484 (TCP Spurious Retransmission] 80 3371 [PSH, ACK] Seq=1 Ack=722 Win=31460 Len=1430 54 (TCP Dup ACK 28#1] 3371 + 80 [ACK] Seq=722 Ack=1591 Win=8760 Len=0 478 HTTP/1.1 200 OK 54 3372 80 [ACK] Seq=480 Ack=18365 Win=9236 Len=0 54 80 + 3372 [FIN, ACK] Seq=18365 Ack=480 Win=6432 Len=0 54 3372 80 [ACK] Seq=480 Ack=18366 Win=9236 Len=0 54 3372 80 (FIN, ACK] Seq=480 Ack=18366 Win=9236 Len=0 54 80 + 3372 [ACK] Seq=18366 Ack=481 Win=6432 Len=0 Frame 1: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) > Ethernet II, Src: Xerox_00:00:00 00:00:01:00:00:00), Dst: fe:ff:20:00:01:00 (fe:ff:20:00:01:00) Internet Protocol Version 4, Src: 145.254.160.237, Dst: 65.208.228.223 > Transmission Control Protocol, Src Port: 3372, Dst Port: 80, Seq: 0, Len: 0 E 0000 fe ff 20 00 01 00 00 00 0010 00 30 of 41 40 00 80 06 0020 e4 df Od 2c 00 50 38 af 0030 22 38 c3 Oc 00 00 02 04 01 00 00 00 08 00 45 00 91 eb 91 fe ab ed 41 do fe 13 00 00 00 00 70 02 05 b4 01 01 04 02 0 A@ Pg. "8 p http.cap | Packets: 43. Displayed: 43 (100,0%) Profile: Default No. Time Source Destination Protocol Length Info 1 0.000000 10.20.144.150 10.20.144.151 TCP 74 35974 - 21 [SYN] Seq=0 Win=32648 Len=0 MSS=1380 WS=1 TSval=1657560000 TSecr=0 2 0.000320 10.20.144.151 10.20.144.150 TCP 78 21 + 35974 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1356 WS=1 TSval=1657390000 TSecr=1657560000 3 0.000570 10.20.144.150 10.20.144.151 TCP 66 35974 21 [ACK] Seq=1 Ack=1 Win=32648 Len=0 TSval=1657560000 TSecr=1657390000 4 0.060630 10.20.144.151 10.20.144.150 FTP 106 Response: 220-QTCP at fran.csg.stercomm.com. 5 0.275440 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [ACK] Seq=1 Ack=37 Win=32648 Len=0 TSval=1657560500 TSecr=1657390000 6 0.275760 10.20.144.151 10.20.144.150 FTP 126 Response: 220 Connection will close if idle more than 5 minutes. 70.276140 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [ACK] Seq=1 Ack=93 Win=32648 Len=8 TSval=1657560500 TSecr=1657390000 8 4.216600 10.20.144.150 10.20.144.151 FTP 81 Request: USER cdts 3500 9 4.217350 10.20.144.151 10.20.144.150 FTP 91 Response: 331 Enter password. 10 4.217630 10.20.144.150 10.20.144.151 TCP 66 35974 - 21 (PSH, ACK] Seq=16 Ack=114 Win=32648 Len=0 TSval=1657564500 TSecr=1657394000 11 7.639420 10.20.144.150 10.20.144.151 FTP 81 Request: PASS cdts 3500 12 7.843260 10.20.144.151 10.20.144.150 TCP 70 21 + 35974 [PSH, ACK] Seq=114 Ack=31 Win=16384 Len=0 TSval=1657397500 TSecr=1657568000 13 8.184000 10.20.144.151 10.20.144.150 FTP 95 Response: 230 CDTS3500 logged on. 14 8.184360 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=31 Ack=139 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 15 8.185040 10.20.144.150 10.20.144.151 FTP 72 Request: SYST 16 8.185260 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=139 Ack=37 Win=16384 Len=0 TSval=1657398000 TSecr=1657568500 17 8.192750 10.20.144.151 10.20.144.150 FTP 147 Response: 215 0S/400 is the remote operating system. The TCP/IP version is "V5R2M0". 18 8.193000 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=37 Ack=216 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 19 8.193570 10.20.144.150 10.20.144.151 FTP 80 Request: SITE NAMEFMT 20 8.193780 10.20.144.151 10.20.144.150 TCP 70 21 - 35974 [PSH, ACK] Seq=216 Ack=51 Win=16384 Len=TSval=1657398000 TSecr=1657568500 21 8.194900 10.20.144.151 10.20.144.150 FTP 105 Response: 250 Now using naming format "0". 22 8. 195140 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=51 Ack=251 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 23 8. 195700 10.20.144.150 10.20.144.151 FTP 71 Request: PWD 24 8.195910 10.20.144.151 10.20.144.150 TCP 70 21 + 35974 [PSH, ACK] Seq=251 Ack=56 Win=16384 Len=0 TSval=1657398000 TSecr=1657568500 25 8.197050 10.20.144.151 10.20.144.150 FTP 106 Response: 257 "CDTS3500" is current library. 26 8. 197280 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=56 Ack=287 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 27 20.765720 10.20.144.150 10.20.144.151 FTP 72 Request: PASV 28 20.766000 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=287 Ack=62 Win=16384 Len=0 TSval=1657410500 TSecr=1657581000 29 20.787770 10.20.144.151 10.20.144.150 FTP 121 Response: 227 Entering Passive Mode (10,20,144,151, 62,141). 30 20.788010 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=62 Ack=338 Win=32648 Len=0 TSval=1657581000 TSecr=1657410500 31 20.797560 10.20.144.150 10.20.144.151 TCP 74 35976 + 16013 [SYN] Seq=0 Win=32768 Len=0 MSS=1380 WS=1 TSval=1657581000 TSecr=0 32 20.797850 10.20.144.151 10.20.144.150 TCP 78 16013 - 35976 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=1356 WS=1 TSval=1657410500 TSecr=1657581000 33 20.798130 10.20.144.150 10.20.144.151 TCP 66 35976 16013 [ACK] Seq=1 Ack=1 Win=32768 Len=0 TSval=1657581000 TSecr=1657410500 34 20.798250 10.20.144.150 10.20.144.151 FTP 91 Request: RETR qepl/apkeyf.apkeyf 35 20.798450 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=338 Ack=87 Win=16384 Len=0 Tsval=1657410500 TSecr=1657581000 36 21.202190 10.20.144.151 10.20.144.150 FTP 132 Response: 150 Retrieving member APKEYF in file APKEYF in library QGPL. 37 21.202460 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=87 Ack=400 Win=32648 Len=0 TSval=1657581500 TSecr=1657411000 38 21.313290 10.20.144.151 10.20.144.150 FTP-DA.. 509 FTP Data: 439 bytes (PASV) (RETR qgpl/apkeyf.apkeyf) 39 21.393980 10.20.144.151 10.20.144.150 TCP 70 16013 + 35976 [FIN, PSH, ACK] Seq=440 Ack=1 Win=32768 Len= TSval=1657411500 TSecr=1657581000 40 21.394160 10.20.144.151 10.20.144.150 FTP 113 Response: 250 File transfer completed successfully. 41 21.394310 10.20.144.150 10.20.144.151 TCP 66 35976 + 16013 [ACK] Seq=1 Ack=441 Win=32768 Len=0 TSval=1657581500 TSecr=1657411500 42 21.394430 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=87 Ack=443 Win=32648 Len=TSval=1657581500 TSecr=1657411500 43 22.169470 10.20.144.150 10.20.144.151 TCP 66 35976 + 16013 [FIN, PSH, ACK] Seq=1 Ack=441 Win=32768 Len=TSval=1657582500 TSecr=1657411500 129 16000 100 101 101 10 20 1 100 TCD 7016012 2007 incu > Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) > Ethernet II, Src: IbmRisc6_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) > Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 > Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 0888 88 66 29 9c 14 ae 88 86 29 9c 14 fe 08 00 45 00 E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14 Ethernet II, Src: IbmRisc5_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 8888 88 66 29 9c 14 ae 88 86 29 9C 14 fe 08 00 45 00 ...........E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14 - Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) > Ethernet II, Src: IbmRisc6_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) > Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 > Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 8888 88 66 29 9c 14 ae 88 86 29 9c 14 fe 08 00 45 00 ) .....E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14 Ethernet II, Src: Xerox_00:00:00 00:00:01:00:00:00), Dst: fe:ff:20:00:01:00 (fe:ff:20:00:01:00) Internet Protocol Version 4, Src: 145.254.160.237, Dst: 65.208.228.223 > Transmission Control Protocol, Src Port: 3372, Dst Port: 80, Seq: 0, Len: 0 E 0000 fe ff 20 00 01 00 00 00 0010 00 30 of 41 40 00 80 06 0020 e4 df Od 2c 00 50 38 af 0030 22 38 c3 Oc 00 00 02 04 01 00 00 00 08 00 45 00 91 eb 91 fe ab ed 41 do fe 13 00 00 00 00 70 02 05 b4 01 01 04 02 0 A@ Pg. "8 p http.cap | Packets: 43. Displayed: 43 (100,0%) Profile: Default No. Time Source Destination Protocol Length Info 1 0.000000 10.20.144.150 10.20.144.151 TCP 74 35974 - 21 [SYN] Seq=0 Win=32648 Len=0 MSS=1380 WS=1 TSval=1657560000 TSecr=0 2 0.000320 10.20.144.151 10.20.144.150 TCP 78 21 + 35974 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1356 WS=1 TSval=1657390000 TSecr=1657560000 3 0.000570 10.20.144.150 10.20.144.151 TCP 66 35974 21 [ACK] Seq=1 Ack=1 Win=32648 Len=0 TSval=1657560000 TSecr=1657390000 4 0.060630 10.20.144.151 10.20.144.150 FTP 106 Response: 220-QTCP at fran.csg.stercomm.com. 5 0.275440 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [ACK] Seq=1 Ack=37 Win=32648 Len=0 TSval=1657560500 TSecr=1657390000 6 0.275760 10.20.144.151 10.20.144.150 FTP 126 Response: 220 Connection will close if idle more than 5 minutes. 70.276140 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [ACK] Seq=1 Ack=93 Win=32648 Len=8 TSval=1657560500 TSecr=1657390000 8 4.216600 10.20.144.150 10.20.144.151 FTP 81 Request: USER cdts 3500 9 4.217350 10.20.144.151 10.20.144.150 FTP 91 Response: 331 Enter password. 10 4.217630 10.20.144.150 10.20.144.151 TCP 66 35974 - 21 (PSH, ACK] Seq=16 Ack=114 Win=32648 Len=0 TSval=1657564500 TSecr=1657394000 11 7.639420 10.20.144.150 10.20.144.151 FTP 81 Request: PASS cdts 3500 12 7.843260 10.20.144.151 10.20.144.150 TCP 70 21 + 35974 [PSH, ACK] Seq=114 Ack=31 Win=16384 Len=0 TSval=1657397500 TSecr=1657568000 13 8.184000 10.20.144.151 10.20.144.150 FTP 95 Response: 230 CDTS3500 logged on. 14 8.184360 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=31 Ack=139 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 15 8.185040 10.20.144.150 10.20.144.151 FTP 72 Request: SYST 16 8.185260 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=139 Ack=37 Win=16384 Len=0 TSval=1657398000 TSecr=1657568500 17 8.192750 10.20.144.151 10.20.144.150 FTP 147 Response: 215 0S/400 is the remote operating system. The TCP/IP version is "V5R2M0". 18 8.193000 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=37 Ack=216 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 19 8.193570 10.20.144.150 10.20.144.151 FTP 80 Request: SITE NAMEFMT 20 8.193780 10.20.144.151 10.20.144.150 TCP 70 21 - 35974 [PSH, ACK] Seq=216 Ack=51 Win=16384 Len=TSval=1657398000 TSecr=1657568500 21 8.194900 10.20.144.151 10.20.144.150 FTP 105 Response: 250 Now using naming format "0". 22 8. 195140 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=51 Ack=251 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 23 8. 195700 10.20.144.150 10.20.144.151 FTP 71 Request: PWD 24 8.195910 10.20.144.151 10.20.144.150 TCP 70 21 + 35974 [PSH, ACK] Seq=251 Ack=56 Win=16384 Len=0 TSval=1657398000 TSecr=1657568500 25 8.197050 10.20.144.151 10.20.144.150 FTP 106 Response: 257 "CDTS3500" is current library. 26 8. 197280 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=56 Ack=287 Win=32648 Len=0 TSval=1657568500 TSecr=1657398000 27 20.765720 10.20.144.150 10.20.144.151 FTP 72 Request: PASV 28 20.766000 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=287 Ack=62 Win=16384 Len=0 TSval=1657410500 TSecr=1657581000 29 20.787770 10.20.144.151 10.20.144.150 FTP 121 Response: 227 Entering Passive Mode (10,20,144,151, 62,141). 30 20.788010 10.20.144.150 10.20.144.151 TCP 66 35974 21 [PSH, ACK] Seq=62 Ack=338 Win=32648 Len=0 TSval=1657581000 TSecr=1657410500 31 20.797560 10.20.144.150 10.20.144.151 TCP 74 35976 + 16013 [SYN] Seq=0 Win=32768 Len=0 MSS=1380 WS=1 TSval=1657581000 TSecr=0 32 20.797850 10.20.144.151 10.20.144.150 TCP 78 16013 - 35976 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=1356 WS=1 TSval=1657410500 TSecr=1657581000 33 20.798130 10.20.144.150 10.20.144.151 TCP 66 35976 16013 [ACK] Seq=1 Ack=1 Win=32768 Len=0 TSval=1657581000 TSecr=1657410500 34 20.798250 10.20.144.150 10.20.144.151 FTP 91 Request: RETR qepl/apkeyf.apkeyf 35 20.798450 10.20.144.151 10.20.144.150 TCP 70 21 35974 [PSH, ACK] Seq=338 Ack=87 Win=16384 Len=0 Tsval=1657410500 TSecr=1657581000 36 21.202190 10.20.144.151 10.20.144.150 FTP 132 Response: 150 Retrieving member APKEYF in file APKEYF in library QGPL. 37 21.202460 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=87 Ack=400 Win=32648 Len=0 TSval=1657581500 TSecr=1657411000 38 21.313290 10.20.144.151 10.20.144.150 FTP-DA.. 509 FTP Data: 439 bytes (PASV) (RETR qgpl/apkeyf.apkeyf) 39 21.393980 10.20.144.151 10.20.144.150 TCP 70 16013 + 35976 [FIN, PSH, ACK] Seq=440 Ack=1 Win=32768 Len= TSval=1657411500 TSecr=1657581000 40 21.394160 10.20.144.151 10.20.144.150 FTP 113 Response: 250 File transfer completed successfully. 41 21.394310 10.20.144.150 10.20.144.151 TCP 66 35976 + 16013 [ACK] Seq=1 Ack=441 Win=32768 Len=0 TSval=1657581500 TSecr=1657411500 42 21.394430 10.20.144.150 10.20.144.151 TCP 66 35974 + 21 [PSH, ACK] Seq=87 Ack=443 Win=32648 Len=TSval=1657581500 TSecr=1657411500 43 22.169470 10.20.144.150 10.20.144.151 TCP 66 35976 + 16013 [FIN, PSH, ACK] Seq=1 Ack=441 Win=32768 Len=TSval=1657582500 TSecr=1657411500 129 16000 100 101 101 10 20 1 100 TCD 7016012 2007 incu > Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) > Ethernet II, Src: IbmRisc6_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) > Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 > Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 0888 88 66 29 9c 14 ae 88 86 29 9c 14 fe 08 00 45 00 E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14 Ethernet II, Src: IbmRisc5_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 8888 88 66 29 9c 14 ae 88 86 29 9C 14 fe 08 00 45 00 ...........E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14 - Frame 1: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) > Ethernet II, Src: IbmRisc6_9c:14:fe (00:06:29:9c:14:fe), Dst: IbmRisc6_9c:14:ae (00:06:29:9c:14:ae) > Internet Protocol Version 4, Src: 10.20.144.150, Dst: 10.20.144.151 > Transmission Control Protocol, Src Port: 35974, Dst Port: 21, Seq: 0, Len: 0 8888 88 66 29 9c 14 ae 88 86 29 9c 14 fe 08 00 45 00 ) .....E 0010 00 3c 2d 70 40 00 40 06 d7 f6 a 14 90 96 a 14