Análisis forense de una sesión
FTP pasiva
Fecha: 18 de agosto del 2012
Aportes
de datos sobre apertura del puerto 20: 14 de julio 2014
Desarrollo
de la sesión en Wireshark (sesión disponible en: ftp://ftp.vilarrasa.com.ar/ user y
pass: ccna)
Se realiza el análisis
forense de la sesión, donde es relevante el intercambio TCP (saludo de tres
vías, apertura del puerto 20
a demanda, finalización de la sesión de los distintos puertos) y la
resolución ARP y DNS.
Este análisis es ideal
para CCNA 1, CCNA 4 y CCNA Security.
La visualización óptima
es con Google Crome (caracteres en negrita).
Verificación
previa del ARP
C:\>arp -a
No se encontraron entradas ARP
C:\>
Sesión
FTP (capa 7)
C:\>ftp ftp.vilarrasa.com.ar
Conectado a vilarrasa.com.ar.
220 Microsoft FTP Service (Frame 8)
Usuario (vilarrasa.com.ar:(none)): ccna (Frame
10)
331 Password required for ccna. (Frame 11)
Contraseña: (Frame 13)
230-Directory has 78,364,758,016 bytes of disk
space available. (Frame 15)
230 User logged in. (Frame 17)
ftp> dir
(Frame 23)
200 PORT command successful. (Frame 22)
150 Opening ASCII mode data connection.
09-11-08 12:50PM 3913 2 sesiones Telnet al
mismo router.pcap (Frame 26 a 38)
---resumido---
06-19-08 01:02PM 2411 Traza con loop.txt
09-02-08 10:37AM 68421 Trobleshooting.pka
08-12-08 08:48AM 211798 Trouble shooting
ethernet.pdf
11-08-08 09:45AM 125339 Understanding VTP.pdf
11-14-08 06:21PM 2421544 VPN_Client.exe
08-12-08 08:53AM 159209
WirelessySuProblematica.pdf
226-Directory has 78,364,471,296 bytes of disk
space available. (Frame 43)
226 Transfer complete. (Frame 43)
ftp:
11040 bytes recibidos en 0,11 segundos 101,28 a KB/s.(tasa de transferencia)
ftp> by
(Frame 45)
221 Goodbye. (Frame 46)
C:\>arp -a
Interfaz: 10.0.0.109 --- 0x2
Dirección IP Dirección física Tipo
10.0.0.1 00-15-63-40-55-5b dinámico
C:\>
Seguimiento
de las conexiones en el firewall
Gateway# sh conn detail
2 in use, 169 most used
Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,
B - initial SYN from outside,
C - CTIQBE media, D - DNS, d - dump,
E - outside back connection, F
- outside FIN, f - inside FIN,
G - group, g - MGCP, H -
H.323, h - H.225.0, I - inbound data, i - incomplete,
k - Skinny media, M - SMTP
data, m - SIP media, O - outbound data,
P - inside back connection,
q - SQL*Net data, R - outside acknowledged FIN,
R - UDP RPC, r - inside
acknowledged FIN, S - awaiting inside SYN,
s - awaiting outside SYN, T -
SIP, t - SIP transient, U - up
TCP outside:200.58.114.227/20 inside:10.0.0.109/5001 flags UOP
TCP outside:200.58.114.227/21 inside:10.0.0.109/1883 flags UIO
Gateway# sh xlate (NAT en el firewall:
conversión IP privada a pública)
2 in use, 268 most used
PAT Global 201.212.57.251(1218) Local 10.0.0.109(5001)
PAT Global 201.212.57.251(1217) Local 10.0.0.109(1883)
Gateway#
Análisis
de tráfico
No. Time Source Destination Protocol Info
1 0.000000 00:1b:77:b3:80:a5 ff:ff:ff:ff:ff:ff ARP
Who has 10.0.0.1? Tell 10.0.0.109
Frame 1 (42 bytes on wire, 42 bytes captured) (solicitud
de dirección MAC del gateway)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)
No. Time Source Destination Protocol Info
2 0.001725 00:15:63:40:55:5b 00:1b:77:b3:80:a5 ARP
10.0.0.1 is at 00:15:63:40:55:5b
Frame 2 (60 bytes on wire, 60 bytes captured) (respuesta
de la dirección MAC del gateway)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Address Resolution Protocol (reply)
No. Time Source Destination Protocol Info
3 0.001735 10.0.0.109 8.8.8.8 DNS
Standard query A ftp.vilarrasa.com.ar
Frame 3 (80 bytes on wire, 80 bytes captured) (solicitud
de dirección IP del dominio)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 8.8.8.8 (8.8.8.8)
User Datagram Protocol, Src Port: 64931 (64931), Dst Port: 53 (53)
Domain Name System (query)
No. Time Source Destination Protocol Info
4 0.061964 8.8.8.8 10.0.0.109 DNS Standard query response
CNAME vilarrasa.com.ar A
200.58.114.227
Frame 4 (110 bytes on wire, 110 bytes captured) (respuesta
de la dirección IP del dominio)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 8.8.8.8 (8.8.8.8), Dst: 10.0.0.109 (10.0.0.109)
User Datagram Protocol, Src Port: 53 (53), Dst Port: 64931 (64931)
Domain Name System (response)
No. Time Source Destination Protocol Info
5 0.066262 10.0.0.109 200.58.114.227 TCP 1883 > 21 [SYN] Seq=0 Win=65535
Frame 5 (66 bytes on wire, 66 bytes captured)
(inicio saludo de tres vías)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 0, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 0 (relative sequence number)
Header length: 32 bytes
Flags: 0x02
(SYN) (etiqueta (1) en gráfico)
Window size: 65535
Checksum: 0x2c85 [correct]
Options: (12 bytes)
No. Time Source Destination Protocol Info
6 0.098551 200.58.114.227 10.0.0.109 TCP 21 > 1883 [SYN, ACK] Seq=0
Ack=1
Frame 6 (66 bytes on wire, 66 bytes captured)
(respuesta saludo de tres vías)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 0, Ack: 1, Len: 0
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence
number: 0 (relative sequence number)
Acknowledgement
number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x12
(SYN, ACK) (etiqueta (2) en gráfico)
Window size: 8192
Checksum: 0x4bfc [correct]
Options: (12 bytes)
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 5]
[The RTT to ACK the segment
was: 0.032289000 seconds]
No. Time Source Destination Protocol Info
7 0.098582 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=1 Ack=1
Win=65536
Frame 7 (54 bytes on wire, 54 bytes captured)
(acuse de recibo saludo de tres vías)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 1, Ack: 1, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence
number: 1 (relative sequence number)
Acknowledgement
number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10
(ACK) (etiqueta (3) en gráfico)
Window size: 65536 (scaled)
Checksum: 0x2c7f [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 6]
[The RTT to ACK the segment
was: 0.000031000 seconds]
No. Time Source Destination Protocol Info
8 0.130474 200.58.114.227 10.0.0.109 FTP Response: 220 Microsoft FTP Service
Frame 8 (81 bytes on wire, 81 bytes captured)
(inicio sesión FTP)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883), Seq:
1, Ack: 1, Len: 27
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 1 (relative sequence number)
[Next sequence number: 28 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0x106f [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 7]
[The RTT to ACK the segment
was: 0.031892000 seconds]
File Transfer Protocol (FTP)
220 Microsoft FTP Service\r\n
Response code: Service ready
for new user (220)
Response arg: Microsoft FTP
Service
No. Time Source Destination Protocol Info
9 0.311163 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=1 Ack=28
Win=65508 Len=0
Frame 9 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 1, Ack: 28, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 28 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65508 (scaled)
Checksum: 0x2c72 [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 8]
[The RTT to ACK the segment
was: 0.180689000 seconds]
No. Time Source Destination Protocol Info
10 3.215124 10.0.0.109 200.58.114.227 FTP
Request: USER ccna
Frame 10 (65 bytes on wire, 65 bytes captured)
(ingresa usuario)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 1, Ack: 28, Len: 11
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 1 (relative sequence number)
[Next sequence number: 12 (relative sequence number)]
Acknowledgement number: 28 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 65508 (scaled)
Checksum: 0xa2da [correct]
File Transfer Protocol (FTP)
USER ccna\r\n
No. Time Source Destination Protocol Info
11 3.247306 200.58.114.227 10.0.0.109 FTP Response: 331 Password required for
ccna.
Frame 11 (87 bytes on wire, 87 bytes captured)
(solicita password)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 28, Ack: 12, Len: 33
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 28 (relative sequence number)
[Next sequence number: 61 (relative sequence number)]
Acknowledgement number: 12 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xe4fb [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 10]
[The RTT to ACK the segment
was: 0.032182000 seconds]
File Transfer Protocol (FTP)
331 Password required for
ccna.\r\n
No. Time Source Destination Protocol Info
12 3.429227 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=12 Ack=61
Win=65476 Len=0
Frame 12 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 12, Ack: 61, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 12 (relative sequence number)
Acknowledgement number: 61 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65476 (scaled)
Checksum: 0x2c56 [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 11]
[The RTT to ACK the segment
was: 0.181921000 seconds]
No. Time Source Destination Protocol Info
13 4.902156 10.0.0.109 200.58.114.227 FTP
Request: PASS ccna
Frame 13 (65 bytes on wire, 65 bytes captured)
(solicita password)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 12, Ack: 61, Len: 11
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 12 (relative sequence number)
[Next sequence number: 23 (relative sequence number)]
Acknowledgement number: 61 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 65476 (scaled)
Checksum: 0x99cf [correct]
File Transfer Protocol (FTP)
PASS ccna\r\n
No. Time Source Destination Protocol Info
14 5.141702 200.58.114.227 10.0.0.109 TCP 21 > 1883 [ACK] Seq=61 Ack=23
Win=66560 Len=0
Frame 14 (60 bytes on wire, 60 bytes captured)
(control)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 61, Ack: 23, Len: 0
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 61 (relative sequence number)
Acknowledgement number: 23 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0xab29 [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 13]
[The RTT to ACK the segment
was: 0.239546000 seconds]
No. Time Source Destination Protocol Info
15 6.004511 200.58.114.227 10.0.0.109 FTP Response: 230-Directory has
78,400,737,280 bytes of disk space available.
Frame 15 (119 bytes on wire, 119 bytes captured)
(encabezado del directorio)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 61, Ack: 23, Len: 65
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 61 (relative sequence number)
[Next sequence number: 126 (relative sequence number)]
Acknowledgement number: 23 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xbace [correct]
File Transfer Protocol (FTP)
230-Directory has 78,400,737,280 bytes of disk space available.\r\n
No. Time Source Destination Protocol Info
16 6.144932 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=23 Ack=126
Win=65410 Len=0
Frame 16 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 23, Ack: 126, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 23 (relative sequence number)
Acknowledgement number: 126 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65410 (scaled)
Checksum: 0x2c2b [correct]
[SEQ/ACK analysis]
[This is an
ACK to the segment in frame: 15]
[The RTT to ACK the segment
was: 0.140421000 seconds]
No. Time Source Destination Protocol Info
17 6.639721 200.58.114.227 10.0.0.109 FTP Response: 230 User logged in.
Frame 17 (75 bytes on wire, 75 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 126, Ack: 23, Len: 21
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 126 (relative sequence number)
[Next sequence number: 147 (relative sequence number)]
Acknowledgement number: 23 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0x90bd [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 16]
[The RTT to ACK the segment
was: 0.494789000 seconds]
File Transfer Protocol (FTP)
230 User logged in.\r\n
No. Time Source Destination Protocol Info
18 6.748415 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=23 Ack=147
Win=65390 Len=0
Frame 18 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 23, Ack: 147, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 23 (relative sequence number)
Acknowledgement number: 147 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65390 (scaled)
Checksum: 0x2c20 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 17]
[The RTT to ACK the segment
was: 0.108694000 seconds]
No. Time Source Destination Protocol Info
19 9.264333 10.0.0.109 200.58.114.227 FTP
Request: PORT 10,0,0,109,19,137
Frame 19 (78 bytes on wire, 78 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 23, Ack: 147, Len: 24
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 23 (relative sequence number)
[Next sequence number: 47 (relative sequence number)]
Acknowledgement number: 147 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 65390 (scaled)
Checksum: 0xd09e [correct]
File Transfer Protocol (FTP)(en esta trama el cliente informa a que puerto se conectará el puerto 20
del server)
PORT 10,0,0,109,19,137\r\n
Request command: PORT
Request arg: 10,0,0,109,19,137
Active IP address: 10.0.0.109
(10.0.0.109)
Active port: 5001
No. Time Source Destination Protocol Info
20 9.297975 200.58.114.227 10.0.0.109 TCP 20
> 5001 [SYN] Seq=0 Win=8192 Len=0
Frame 20 (66 bytes on wire, 66 bytes captured)
(saludo de tres vías para port 20)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 0, Len: 0
Source port: 20 (20)
Destination
port: 5001 (5001)
Sequence number: 0 (relative sequence number)
Header length: 32 bytes
Flags: 0x02 (SYN)(etiqueta
(1) en la gráfica)
Window size: 8192
Checksum: 0x9213 [correct]
Options: (12 bytes)
No. Time Source Destination Protocol Info
21 9.298033 10.0.0.109 200.58.114.227 TCP 5001 > 20 [SYN, ACK] Seq=0 Ack=1
Frame 21 (66 bytes on wire, 66 bytes captured)
(respuesta saludo de tres vías para port 20)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 0, Ack: 1, Len: 0
Source port:
5001 (5001)
Destination
port: 20 (20)
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x12 (SYN, ACK) (etiqueta (2) en la gráfica)
Window size: 65535
Checksum: 0x2e6b [correct]
Options: (12 bytes)
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 20]
[The RTT to ACK the segment
was: 0.000058000 seconds]
No. Time Source Destination Protocol Info
22 9.298433 200.58.114.227 10.0.0.109 FTP Response: 200 PORT command successful.
Frame 22 (84 bytes on wire, 84 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 147, Ack: 47, Len: 30
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 147 (relative sequence number)
[Next sequence number: 177 (relative sequence number)]
Acknowledgement number: 47 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xedad [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 19]
[The RTT to ACK the segment
was: 0.034100000 seconds]
File Transfer Protocol (FTP)
200 PORT command successful.\r\n
No. Time Source Destination Protocol Info
23 9.300182 10.0.0.109 200.58.114.227 FTP
Request: LIST
Frame 23 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 47, Ack: 177, Len: 6
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 47 (relative sequence number)
[Next sequence number: 53 (relative sequence number)]
Acknowledgement number: 177 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 65360 (scaled)
Checksum: 0x7f43 [correct]
[SEQ/ACK analysis]
[This is an ACK to the segment in frame:
22]
[The RTT to ACK the segment
was: 0.001749000 seconds]
File Transfer Protocol (FTP)
LIST\r\n
No. Time Source Destination Protocol Info
24 9.330145 200.58.114.227 10.0.0.109 TCP 20 > 5001 [ACK] Seq=1 Ack=1 Win=66560
Len=0
Frame 24 (60 bytes on wire, 60 bytes captured)
(acuse de recibo saludo tres vías para port 20)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst: 00:1b:77:b3:80:a5
(00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 1, Ack: 1, Len: 0
Source port: 20
(20)
Destination
port: 5001 (5001)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK) (etiqueta (3) en la gráfica)
Window size: 66560 (scaled)
Checksum: 0x6d6b [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 21]
[The RTT to ACK the segment
was: 0.032112000 seconds]
No. Time Source Destination Protocol Info
25 9.332238 200.58.114.227 10.0.0.109 FTP Response: 125 Data connection already
open;
Transfer starting.
Frame 25 (108 bytes on wire, 108 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 177, Ack: 53, Len: 54
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 177 (relative sequence number)
[Next sequence number: 231 (relative sequence number)]
Acknowledgement number: 53 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0x200a [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 23]
[The RTT to ACK the segment
was: 0.032056000 seconds]
File Transfer Protocol (FTP)
125 Data connection already open;
Transfer starting.\r\n
No. Time Source Destination Protocol Info
26 9.334291 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 26 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 1, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 1 (relative sequence number)
[Next sequence number: 1261 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0x866c [correct]
FTP Data
[truncated]
FTP Data:
09-11-08 12:50PM 3913 2 sesiones Telnet al
mismo router.pcap\r\n
08-12-08 08:44AM 1604910 3com 1100tx.pdf\r\n
08-12-08 08:44AM 2187473 3Com
2226-User-Guide.pdf\r\n
08-12-08 0
08-12-08 08:44AM 1604910 3com 1100tx.pdf\r\n
08-12-08 08:44AM 2187473 3Com
2226-User-Guide.pdf\r\n
08-12-08 08:44AM
No. Time Source Destination Protocol Info
27 9.334688 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 27 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst: 00:1b:77:b3:80:a5
(00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 1261, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 1261 (relative sequence number)
[Next sequence number: 2521 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0x8767 [correct]
FTP Data
[truncated]
FTP Data:
18006 Captura SSH con clave recien generada.pcap\r\n
07-02-08 08:40AM 3935 Captura TFTP.cap\r\n
08-04-08 08:57AM 6351966 Catalyst 2950
databook.pdf\r\n
08-04-08 09:02AM 3935 Captura TFTP.cap\r\n
08-04-08 08:57AM 6351966 Catalyst 2950
databook.pdf\r\n08-04-08 09:02AM
No. Time Source Destination Protocol Info
28 9.334716 10.0.0.109 200.58.114.227 TCP
5001 > 20 [ACK] Seq=1 Ack=2521 Win=65536 Len=0
Frame 28 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 2521, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2521 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65536 (scaled)
Checksum: 0xe496 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 27]
[The RTT to ACK the segment
was: 0.000028000 seconds]
No. Time Source Destination Protocol Info
29 9.366794 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 29 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 2521, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 2521 (relative sequence number)
[Next sequence number: 3781 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0xa267 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 28]
[The RTT to ACK the segment
was: 0.032078000 seconds]
FTP Data
[truncated]
FTP Data:
6PM 264350 Configuring OSPF with IOS
12.0.pdf\r\n10-08-08
04:06PM 96205 Configuring RIP with IOS 12.0.pdf\r\n09-12-08
02:21PM 3102 Conversacion 3 vias y Telnet.pcap\r\n08
No. Time Source Destination Protocol Info
30 9.367088 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 30 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 3781, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 3781 (relative sequence number)
[Next sequence number: 5041 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0x7b43 [correct]
FTP Data
[truncated]
FTP Data:
1PM 136192 Escenario 13
de Sep resuelto con RIP v2.pka\r\n09-22-08
12:41PM 7006
Escenario 13 de sep resuelto con RIP v2.txt\r\n02-16-11
08:51AM 265911
Escenario 15 de mayo
No. Time Source Destination Protocol Info
31 9.367116 10.0.0.109 200.58.114.227 TCP 5001 > 20 [ACK] Seq=1 Ack=5041
Win=65536 Len=0
Frame 31 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst: 00:15:63:40:55:5b
(00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 5041, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 5041 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65536 (scaled)
Checksum: 0xdabe [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 30]
[The RTT to ACK the segment
was: 0.000028000 seconds]
No. Time Source Destination Protocol Info
32 9.367424 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 32 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 5041, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 5041 (relative sequence number)
[Next sequence number: 6301 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0x1454 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 31]
[The RTT to ACK the segment
was: 0.000308000 seconds]
FTP Data
[truncated]
FTP Data: 152102 Escenario
VLSM RIPv2.pka\r\n06-19-08
12:54PM 1826 Estado
de rutas RIP.txt\r\n06-19-08
12:54PM 2368 Eventos
RIP.txt\r\n09-22-08 12:51PM 571 Failov
No. Time Source Destination Protocol Info
33 9.367983 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 33 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 6301, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 6301 (relative sequence number)
[Next sequence number: 7561 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0xc5d2 [correct]
FTP Data
[truncated]
FTP Data: 8 08:46AM 51401 Modem.pdf\r\n09-25-08
04:18PM 346778 Modems
and routers.rar\r\n10-30-08
03:32PM 156148 Modulo 5
CCNA 3 v3_1.pka\r\n08-14-11
07:26PM 9633 M
No. Time Source Destination Protocol Info
34 9.368011 10.0.0.109 200.58.114.227 TCP 5001 > 20 [ACK] Seq=1 Ack=7561
Win=65536 Len=0
Frame 34 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 7561, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number: 7561 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65536 (scaled)
Checksum: 0xd0e6 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 33]
[The RTT to ACK the segment
was: 0.000028000 seconds]
No. Time Source Destination Protocol Info
35 9.401629 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 35 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 7561, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 7561 (relative sequence number)
[Next sequence number: 8821 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0xf111 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 34]
[The RTT to ACK the segment
was: 0.033618000 seconds]
FTP Data
[truncated]
FTP Data: ica 3.doc\r\n
06-02-08 09:01AM 30208 Practica 4.doc\r\n
08-14-11 07:14PM 9046 Practica Capitulo 2
_Parte 1.pdf\r\n
08-14-11 07:14PM 10437 Practica Capitulo 2
_Parte 2.pdf\
No. Time Source Destination Protocol Info
36 9.402012 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 1260 bytes
Frame 36 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 8821, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 8821 (relative sequence number)
[Next sequence number: 10081 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0x0cfc [correct]
FTP Data
[truncated]
FTP Data:
80081 Scenario de
prueba Balance de carga.pka\r\n
11-18-09 10:03PM 236501 Scenario for
IT administration.pka\r\n
09-18-08 08:12AM 152069 Scenario RIP v1 17 de
Septiembre.pka\r\n
08-22-08 02
No. Time Source Destination Protocol Info
37 9.402038 10.0.0.109 200.58.114.227 TCP 5001 > 20 [ACK] Seq=1 Ack=10081
Win=65536 Len=0
Frame 37 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 10081, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number:
10081 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65536 (scaled)
Checksum: 0xc70e [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 36]
[The RTT to ACK the segment
was: 0.000026000 seconds]
No. Time Source Destination Protocol Info
38 9.402346 200.58.114.227 10.0.0.109 FTP-DATA FTP Data: 960 bytes
Frame 38 (1014 bytes on wire, 1014 bytes captured) (saludo de finalización puerto 20)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 10081, Ack: 1, Len: 960
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 10081 (relative sequence number)
[Next sequence number: 11041 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x19
(FIN, PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0x04ec [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 37]
[The RTT to ACK the segment
was: 0.000308000 seconds]
FTP Data
[truncated]
FTP Data: \r\n
08-12-08 08:48AM 352459 sw4500admin.pdf\r\n0
8-12-08 08:48AM 23884510 Switch 4507.pdf\r\n
06-19-08 11:50AM 8448705 sybex - dictionary of
networking.pdf\r\n
03-10-09 08:01PM
No. Time Source Destination Protocol Info
39 9.402378 10.0.0.109 200.58.114.227 TCP 5001 > 20 [ACK] Seq=1 Ack=11042
Win=64576 Len=0
Frame 39 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 11042, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number:
11042 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 64576 (scaled)
Checksum: 0xc52d [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 38]
[The RTT to ACK the segment
was: 0.000032000 seconds]
No. Time Source Destination Protocol Info
40 9.429208 10.0.0.109 200.58.114.227 TCP 5001 > 20 [FIN, ACK] Seq=1 Ack=11042
Win=64576 Len=0
Frame 40 (54 bytes on wire, 54 bytes captured)
(finalización puerto 20)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 5001 (5001), Dst Port: 20 (20),
Seq: 1, Ack: 11042, Len: 0
Source port: 5001 (5001)
Destination port: 20 (20)
Sequence number: 1 (relative sequence number)
Acknowledgement number:
11042 (relative ack number)
Header length: 20 bytes
Flags: 0x11 (FIN,
ACK)
Window size: 64576 (scaled)
Checksum: 0xc52c [correct]
No. Time Source Destination Protocol Info
41 9.462307 200.58.114.227 10.0.0.109 TCP 20 > 5001 [ACK] Seq=11042 Ack=2
Win=66560 Len=0
Frame 41 (60 bytes on wire, 60 bytes captured)
(acuse recibo finalización puerto 20)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 5001 (5001),
Seq: 11042, Ack: 2, Len: 0
Source port: 20 (20)
Destination port: 5001 (5001)
Sequence number: 11042 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 20 bytes
Flags: 0x10
(ACK)
Window size: 66560 (scaled)
Checksum: 0x4249 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 40]
[The RTT to ACK the segment
was: 0.033099000 seconds]
No. Time Source Destination Protocol Info
42 9.464128 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=53 Ack=231 Win=65306
Len=0
Frame 42 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 53, Ack: 231, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 53 (relative sequence number)
Acknowledgement number: 231 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65306 (scaled)
Checksum: 0x2bd8 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 25]
[The RTT to ACK the segment
was: 0.131890000 seconds]
No. Time Source Destination Protocol Info
43 9.978004 200.58.114.227 10.0.0.109 FTP Response: 226-Directory has 78,400,737,280
bytes of disk space available.
Frame 43 (143 bytes on wire, 143 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 231, Ack: 53, Len: 89
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 231 (relative sequence number)
[Next sequence number: 320
(relative sequence number)]
Acknowledgement number: 53 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xbe20 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 42]
[The RTT to ACK the segment
was: 0.513876000 seconds]
File Transfer Protocol (FTP)
226-Directory has 78,400,737,280 bytes of disk space available.\r\n
226 Transfer complete.\r\n
No. Time
Source
Destination Protocol
Info
44 10.168207 10.0.0.109 200.58.114.227 TCP 1883 > 21 [ACK] Seq=53 Ack=320
Win=65216 Len=0
Frame 44 (54 bytes on wire, 54 bytes captured)
(control)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 53, Ack: 320, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 53 (relative sequence number)
Acknowledgement number: 320 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 65216 (scaled)
Checksum: 0x2bac [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 43]
[The RTT to ACK the segment
was: 0.190203000 seconds]
No. Time Source Destination Protocol Info
45 11.277844 10.0.0.109 200.58.114.227 FTP
Request: QUIT
Frame 45 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 53, Ack: 320, Len: 6
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 53 (relative sequence number)
[Next sequence number: 59 (relative sequence number)]
Acknowledgement number: 320 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 65216 (scaled)
Checksum: 0x83ea [correct]
File Transfer Protocol (FTP)
QUIT\r\n
No. Time Source Destination Protocol Info
46 11.311174 200.58.114.227 10.0.0.109 FTP Response: 221 Goodbye.
Frame 46 (68 bytes on wire, 68 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.109
(10.0.0.109)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1883 (1883),
Seq: 320, Ack: 59, Len: 14
Source port: 21 (21)
Destination port: 1883 (1883)
Sequence number: 320 (relative sequence number)
[Next sequence number: 334 (relative sequence number)]
Acknowledgement number: 59 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xbb14 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 45]
[The RTT to ACK the segment
was: 0.033330000 seconds]
File Transfer Protocol (FTP)
221 Goodbye.\r\n
No. Time Source Destination Protocol Info
47 11.312071 10.0.0.109 200.58.114.227 TCP 1883 > 21 [RST, ACK] Seq=59
Ack=334 Win=0 Len=0
Frame 47 (54 bytes on wire, 54 bytes captured)
(finalización puerto 21)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.109 (10.0.0.109), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1883 (1883), Dst Port: 21 (21),
Seq: 59, Ack: 334, Len: 0
Source port: 1883 (1883)
Destination port: 21 (21)
Sequence number: 59 (relative sequence number)
Acknowledgement number: 334 (relative ack number)
Header length: 20 bytes
Flags: 0x14
(RST, ACK) (detalle: no es FIN sino RST (reset))
Window size: 0
Checksum: 0xaaf4 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 46]
[The RTT to ACK the segment
was: 0.000897000 seconds]
Final
alternativo (correcto)
No. Time Source Destination Protocol Info
18 6.911975 200.58.114.227 10.0.0.102 FTP Response: 221 Goodbye.
Frame 18 (68 bytes on wire, 68 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.102
(10.0.0.102)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1695 (1695),
Seq: 148, Ack: 29, Len: 14
Source port: 21 (21)
Destination port: 1695 (1695)
Sequence number: 148 (relative sequence number)
[Next sequence number: 162 (relative sequence number)]
Acknowledgement number: 29 (relative ack number)
Header length: 20 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66560 (scaled)
Checksum: 0xab1e [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 17]
[The RTT to ACK the segment
was: 0.035404000 seconds]
File Transfer Protocol (FTP)
No. Time Source Destination Protocol Info
19 6.913048 10.0.0.102 200.58.114.227 TCP 1695 > 21 [FIN, ACK] Seq=29
Ack=162 Win=65374 Len=0
Frame 19 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.102 (10.0.0.102), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1695 (1695), Dst Port: 21 (21), Seq:
29, Ack: 162, Len: 0
Source port: 1695 (1695)
Destination port: 21 (21)
Sequence number: 29 (relative sequence number)
Acknowledgement number: 162 (relative ack number)
Header length: 20 bytes
Flags: 0x11 (FIN, ACK) (etiqueta (1) en gráfico)
Window size: 65374 (scaled)
Checksum: 0x1b52 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 18]
No. Time Source Destination Protocol Info
20 7.299637 200.58.114.227 10.0.0.102 TCP 21 > 1695 [FIN, ACK] Seq=162 Ack=30 Win=66560
Len=0
Frame 20 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.102
(10.0.0.102)
Transmission Control Protocol, Src Port: 21 (21), Dst Port: 1695 (1695),
Seq: 162, Ack: 30, Len: 0
Source port: 21 (21)
Destination port: 1695 (1695)
Sequence number: 162 (relative sequence number)
Acknowledgement number: 30 (relative ack number)
Header length: 20 bytes
Flags: 0x11 (FIN, ACK) (etiqueta (2) y (3) en gráfico)
Window size: 66560 (scaled)
Checksum: 0x99fc [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 19]
[The RTT to ACK the segment
was: 0.386589000 seconds]
No. Time Source
Destination Protocol Info
21 7.299678 10.0.0.102 200.58.114.227 TCP
1695 > 21 [ACK] Seq=30 Ack=163 Win=65374 Len=0
Frame 21 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5), Dst:
00:15:63:40:55:5b (00:15:63:40:55:5b)
Internet Protocol, Src: 10.0.0.102 (10.0.0.102), Dst: 200.58.114.227
(200.58.114.227)
Transmission Control Protocol, Src Port: 1695 (1695), Dst Port: 21 (21),
Seq: 30, Ack: 163, Len: 0
Source port: 1695 (1695)
Destination port: 21 (21)
Sequence number: 30 (relative sequence number)
Acknowledgement number: 163 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK) (etiqueta (4) en gráfico)
Window size: 65374 (scaled)
Checksum: 0x1b51 [correct]
[SEQ/ACK analysis]
[This is an ACK to the
segment in frame: 20]
[The RTT to ACK the segment
was: 0.000041000 seconds]
Análisis
de una trama de datos con la carga (MTU) completa:
No. Time Source Destination Protocol Info
361 62.152091 200.58.114.227 10.0.0.102 FTP-DATA FTP Data: 1260 bytes
Frame 361 (1314 bytes on wire, 1314 bytes captured)
Ethernet II, Src: 00:15:63:40:55:5b (00:15:63:40:55:5b), Dst:
00:1b:77:b3:80:a5 (00:1b:77:b3:80:a5)
Internet Protocol, Src: 200.58.114.227 (200.58.114.227), Dst: 10.0.0.102
(10.0.0.102)
Transmission Control Protocol, Src Port: 20 (20), Dst Port: 1690 (1690),
Seq: 209581, Ack: 1, Len: 1260
Source port: 20 (20)
Destination port: 1690 (1690)
Sequence number: 209581 (relative sequence number)
[Next sequence number:
210841 (relative sequence number)]
Acknowledgement number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 66560 (scaled)
Checksum: 0xe235 [correct]
FTP Data
[truncated]
FTP Data: 4 00000 n\r\n0000192501 00000 n\r\n0000192548 00000 n\r\n0000192595
00000 n\r\n0000192642
00000 n\r\n0000192689 00000
n\r\n0000192736 00000 n\r\n0000192783 00000 n\r\n0000192830 00000
n\r\n0000192877
00000 n\r\n000019
Verificamos
el tamaño máximo de carga:
C:\>ping
Uso: ping [-t] [-a] [-n cuenta] [-l tamaño] [-f] [-i TTL] [-v TOS]
[-r cuenta] [-s cuenta]
[[-j lista-host] | [-k lista-host]]
[-w tiempo de espera]
nombre-destino
Opciones:
-t Ping el host especificado hasta
que se pare.
Para ver
estadísticas y continuar - presionar Control-Inter;
Parar - presionar
Control-C.
-a Resolver direcciones en nombres de
host.
-n cuenta Número de peticiones eco para enviar.
-l tamaño Enviar tamaño del búfer.
-f Establecer No fragmentar el
indicador en paquetes.
-i TTL Tiempo de vida.
-v TOS Tipo de servicio.
-r cuenta Ruta del registro para la cuenta de
saltos.
-s count Sello de hora para la cuenta de saltos.
-j lista-host Afloja la ruta de origen a lo largo de la
lista- host.
-k lista-host Restringir la ruta de origen a lo largo de la
lista- host.
-w tiempo de espera Tiempo de espera en milisegundos para
esperar cada
respuesta.
C:\>ping -f -l 1273 8.8.8.8 (luego de varias
pruebas, se llegó a este valor)
Haciendo ping a 8.8.8.8 con 1273 bytes de datos:
Es necesario fragmentar el paquete pero se especificó DF.
Es necesario fragmentar el paquete pero se especificó DF.
Es necesario fragmentar el paquete pero se especificó DF.
Es necesario fragmentar el paquete pero se especificó DF.
Estadísticas de ping para 8.8.8.8:
Paquetes: enviados = 4, recibidos
= 0, perdidos = 4
(100% perdidos),
C:\>ping -f -l 1272 8.8.8.8 (valor inmediato
inferior)
Haciendo ping a 8.8.8.8 con 1272 bytes de datos:
Respuesta desde 8.8.8.8: bytes=64 (enviados 1272) tiempo=55ms TTL=49
Respuesta desde 8.8.8.8: bytes=64 (enviados 1272) tiempo=53ms TTL=49
Respuesta desde 8.8.8.8: bytes=64 (enviados 1272) tiempo=53ms TTL=49
Respuesta desde 8.8.8.8: bytes=64 (enviados 1272) tiempo=56ms TTL=49
Estadísticas de ping para 8.8.8.8:
Paquetes: enviados = 4, recibidos
= 4, perdidos = 0
(0% perdidos),
Tiempos aproximados de ida y vuelta en milisegundos:
Mínimo = 53ms, Máximo = 56ms,
Media = 54ms
C:\>
Sitio
de interés sobre configurar tamaño de MTU en Windows: http://support.microsoft.com/kb/314053
Resumen
del flujo TCP:
|Time | 10.0.0.109 | 200.58.114.227 |
|0,066 | SYN | |Seq = 0 Ack = 3642255087
| |(1883) ------------------> (21) |
|0,099 | SYN, ACK | |Seq = 0 Ack = 1
| |(1883) <------------------ (21) |
|0,099 | ACK | |Seq = 1 Ack = 1
| |(1883) ------------------> (21) |
|0,130 | PSH, ACK - Len: 27 |Seq = 1 Ack = 1
| |(1883) <------------------ (21) |
|0,311 | ACK | |Seq = 1 Ack = 28
| |(1883) ------------------> (21) |
|3,215 | PSH, ACK - Len: 11 |Seq = 1 Ack = 28
| |(1883) ------------------> (21) |
|3,247 | PSH, ACK - Len: 33 |Seq = 28 Ack = 12
| |(1883) <------------------ (21) |
|3,429 | ACK | |Seq = 12 Ack = 61
| |(1883) ------------------> (21) |
|4,902 | PSH, ACK - Len: 11 |Seq = 12 Ack = 61
| |(1883) ------------------> (21) |
|5,142 | ACK | |Seq = 61 Ack = 23
| |(1883) <------------------ (21) |
|6,005 | PSH, ACK - Len: 65 |Seq = 61 Ack = 23
| |(1883) <------------------ (21) |
|6,145 | ACK | |Seq = 23 Ack = 126
| |(1883) ------------------> (21) |
|6,640 | PSH, ACK - Len: 21 |Seq = 126 Ack = 23
| |(1883) <------------------ (21) |
|6,748 | ACK | |Seq = 23 Ack = 147
| |(1883) ------------------> (21) |
|9,264 | PSH, ACK - Len: 24 |Seq = 23 Ack = 147
| |(1883) ------------------> (21) |
|9,298 | SYN | |Seq = 0 Ack = 1687951182
| |(5001) <------------------ (20) |
|9,298 | SYN, ACK | |Seq = 0 Ack = 1
| |(5001) ------------------> (20) |
|9,298 | PSH, ACK - Len: 30 |Seq = 147 Ack = 47
| |(1883) <------------------ (21) |
|9,300 | PSH, ACK - Len: 6 |Seq = 47 Ack = 177
| |(1883) ------------------> (21) |
|9,330 | ACK | |Seq = 1 Ack = 1
| |(5001) <------------------ (20) |
|9,332 | PSH, ACK - Len: 54 |Seq = 177 Ack = 53
| |(1883) <------------------ (21) |
|9,334 | ACK - Len: 1260 |Seq = 1 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,335 | ACK - Len: 1260 |Seq = 1261 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,335 | ACK | |Seq = 1 Ack = 2521
| |(5001) ------------------> (20) |
|9,367 | ACK - Len: 1260 |Seq = 2521 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,367 | ACK - Len: 1260 |Seq = 3781 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,367 | ACK | |Seq = 1 Ack = 5041
| |(5001) ------------------> (20) |
|9,367 | ACK - Len: 1260 |Seq = 5041 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,368 | ACK - Len: 1260 |Seq = 6301 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,368 | ACK | |Seq = 1 Ack = 7561
| |(5001) ------------------> (20) |
|9,402 | ACK - Len: 1260 |Seq = 7561 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,402 | ACK - Len: 1260 |Seq = 8821 Ack = 1
| |(5001) <------------------ (20) |(envía data)
|9,402 | ACK | |Seq = 1 Ack = 10081
| |(5001) ------------------> (20) |
|9,402 | FIN, PSH, ACK - Len: 960 |Seq = 10081 Ack = 1
| |(5001) <------------------ (20) |(no hay mas data, cierra canal)
|9,402 | ACK | |Seq = 1 Ack = 11042
| |(5001) ------------------> (20) |
|9,429 | FIN, ACK | |Seq = 1 Ack = 11042
| |(5001) ------------------> (20) |
|9,462 | ACK | |Seq = 11042 Ack = 2
| |(5001) <------------------ (20) |
|9,464 | ACK | |Seq = 53 Ack = 231
| |(1883) ------------------> (21) |
|9,978 | PSH, ACK - Len: 89 |Seq = 231 Ack = 53
| |(1883) <------------------ (21) |
|10,168 | ACK | |Seq = 53 Ack = 320
| |(1883) ------------------> (21) |
|11,278 | PSH, ACK - Len: 6 |Seq = 53 Ack = 320
| |(1883) ------------------> (21) |
|11,311 | PSH, ACK - Len: 14 |Seq = 320 Ack = 59
| |(1883) <------------------ (21) |
|11,312 | RST, ACK | |Seq = 59 Ack = 334
| |(1883) ------------------> (21) |
(2012) Tales from uncle Ernest
Rosario, Argentina