A filter, tcp contains maps, has been set. You can see that a browser navigated to Google Maps. Investigate Line/Frame 32344. Hint. Its in the TCP segment.

Wireshark Image 7

For the http connection, the source port is _________ and the destination port is ___________.

The layers that the http fragmented message is encapsulated in is/are ________________.

File Edit View Go Capture Analyze Statistics Telephony Iools Internals Help e o q alp || Qaa % @ Filter: tcp contains maps Expression... Clear Sa Source Destination plus.google.comHTTP Protocol Length Info 32325 198.378531 172.20.72.203 32340 198.442852 plus.google.com 172.20.72.203 32341 198.447947 172.20.72.203 32344 198.476977 plus.google.com172.20.72.203 32349 198.486556 172.20.72.203 32354 198. 516108 www.google.com 32405 198. 684591 plus.google.com 865 GET HTTP 536 HTTP/1.1 3 869 GET /maps 5 34 HTTP/1.1 3 868 GET /mapsI 544 HTTP/1.1 3 534 [TCP Retra plus.google.com HTTP www. goog le.com 172.20.72.203 172.20.72.203 a Frame 32344: 534 bytes on wire (4272 bits), 534 bytes captured (4272 bits) on Ethernet 11, Src : 172. 20. 64. 1 (30: f7: 0d :b8 :69: ff), Dst: 172. 20.72. 203 (f8: bc : 1- Internet Protocol Version 4, Src: plus.google.com (172.217.0.46), Dst: 172.20 Transmission Control Protocol, src Port: http (80), Dst Port: 55560 (55560), s a Hypertext Transfer Protocol a Line-based text data: text/html HTML > KH1>302 Moved n The document has movedn here. /HTML>rin 0010 02 08 68 15 00 00 36 06 78 f4 ac d9 00 2e ac 14 ..h...6. x.. . _ . . . 0020 48 cb 00 50 d9 08 72 6f f3 07 d8 c1 91 94 50 18 H..P..ro P. 0030 01 69 41 03 00 00 48 54 54 50 2f 31 2e 31 20 33 .iA.. .HT TP/1.1 3 0040 30 32 20 46 6f 75 6e 64 0d 0a 4c 6f 63 61 74 69 02 Found LOCati 0060 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 Od Oa oogle.co m/maps.. 0070 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 Cache-Co ntrol: p 0080 72 69 76 61 74 65 Od 0a 43 6f 6e 74 65 6e 74 2d rivate.. Content 0090 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b Type: te xt/html; 00a0 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 Od 0acharset -UTF-8. 00b0 44 61 74 65 20 54 68 75 2c 20 32 38 20 41 70 Date: Th u, 28 Ap 00c0 72 20 32 30 31 36 20 31 36 3a 30 39 3a 35 36 20 r 2016 1 6:09:56 OOd0 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 67 77 73 GMT .. Ser ver: gws 00e0 Od 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68..Conten t-Length 22 3.. -XSS-Pro 0100 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 tection: 1; mode 0110 3d 62 6c 6f 63 6b 0d 0a 58 2d 46 72 61 6d 65 2d -block. X-Frame- 0120 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 Options SAMEOR:I 00f0 3a 20 32 32 33 Od Oa 58 2d 58 53 53 2d 50 72 6f 0130 47 49 4e Od 0a Od Oa C 48 54 4d 4c 3e 3c 48 45 61 20 68 74 74 70 2d 65 71 5 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 7 0160 0170 0180 0190 meta http-eq 0uiv-"con tent-typ 0 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 e" conte nt-" text 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 /html;ch arset-ut 0 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32f-8">.T ITLE 302 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2fM 48 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 5 Moved TITLE

.T 0 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20he docum ent has 01d0 d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 oved. here.. BODYX/H e 63 6f 6d 2f 6d 61 70 73 22 3e 68 65 72 65 3 0200 4d File Edit View Go Capture Analyze Statistics Telephony Iools Internals Help e o q alp || Qaa % @ Filter: tcp contains maps Expression... Clear Sa Source Destination plus.google.comHTTP Protocol Length Info 32325 198.378531 172.20.72.203 32340 198.442852 plus.google.com 172.20.72.203 32341 198.447947 172.20.72.203 32344 198.476977 plus.google.com172.20.72.203 32349 198.486556 172.20.72.203 32354 198. 516108 www.google.com 32405 198. 684591 plus.google.com 865 GET HTTP 536 HTTP/1.1 3 869 GET /maps 5 34 HTTP/1.1 3 868 GET /mapsI 544 HTTP/1.1 3 534 [TCP Retra plus.google.com HTTP www. goog le.com 172.20.72.203 172.20.72.203 a Frame 32344: 534 bytes on wire (4272 bits), 534 bytes captured (4272 bits) on Ethernet 11, Src : 172. 20. 64. 1 (30: f7: 0d :b8 :69: ff), Dst: 172. 20.72. 203 (f8: bc : 1- Internet Protocol Version 4, Src: plus.google.com (172.217.0.46), Dst: 172.20 Transmission Control Protocol, src Port: http (80), Dst Port: 55560 (55560), s a Hypertext Transfer Protocol a Line-based text data: text/html HTML > KH1>302 Moved

n The document has movedn here. /HTML>rin 0010 02 08 68 15 00 00 36 06 78 f4 ac d9 00 2e ac 14 ..h...6. x.. . _ . . . 0020 48 cb 00 50 d9 08 72 6f f3 07 d8 c1 91 94 50 18 H..P..ro P. 0030 01 69 41 03 00 00 48 54 54 50 2f 31 2e 31 20 33 .iA.. .HT TP/1.1 3 0040 30 32 20 46 6f 75 6e 64 0d 0a 4c 6f 63 61 74 69 02 Found LOCati 0060 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 Od Oa oogle.co m/maps.. 0070 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 Cache-Co ntrol: p 0080 72 69 76 61 74 65 Od 0a 43 6f 6e 74 65 6e 74 2d rivate.. Content 0090 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b Type: te xt/html; 00a0 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 Od 0acharset -UTF-8. 00b0 44 61 74 65 20 54 68 75 2c 20 32 38 20 41 70 Date: Th u, 28 Ap 00c0 72 20 32 30 31 36 20 31 36 3a 30 39 3a 35 36 20 r 2016 1 6:09:56 OOd0 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 67 77 73 GMT .. Ser ver: gws 00e0 Od 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68..Conten t-Length 22 3.. -XSS-Pro 0100 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 tection: 1; mode 0110 3d 62 6c 6f 63 6b 0d 0a 58 2d 46 72 61 6d 65 2d -block. X-Frame- 0120 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 Options SAMEOR:I 00f0 3a 20 32 32 33 Od Oa 58 2d 58 53 53 2d 50 72 6f 0130 47 49 4e Od 0a Od Oa C 48 54 4d 4c 3e 3c 48 45 61 20 68 74 74 70 2d 65 71 5 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 7 0160 0170 0180 0190 meta http-eq 0uiv-"con tent-typ 0 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 e" conte nt-" text 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 /html;ch arset-ut 0 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32f-8">.T ITLE 302 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2fM 48 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 5 Moved TITLE

.T 0 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20he docum ent has 01d0 d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 oved. here.. BODYX/H e 63 6f 6d 2f 6d 61 70 73 22 3e 68 65 72 65 3 0200 4d