No. Time Source Destination Protocol Info 129 14.553230 10.3.20.159 10.3.147.100 XDMCP Query Frame 129: 49 bytes on wire (392 bits), 49 bytes captured (392 bits) Arrival Time: Feb 8, 2011 16:28:41.110268000 Eastern Standard Time Epoch Time: 1297200521.110268000 seconds [Time delta from previous captured frame: 0.065072000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 14.553230000 seconds] Frame Number: 129 Frame Length: 49 bytes (392 bits) Capture Length: 49 bytes (392 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:xdmcp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) User Datagram Protocol, Src Port: 57941 (57941), Dst Port: xdmcp (177) Source port: 57941 (57941) Destination port: xdmcp (177) Length: 15 Checksum: 0x60bc [validation disabled] X Display Manager Control Protocol Version: 1 Opcode: Query (0x0002) Message length: 1 Authentication names (0) No. Time Source Destination Protocol Info 130 14.554923 10.3.147.100 10.3.20.159 XDMCP Willing Frame 130: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) Arrival Time: Feb 8, 2011 16:28:41.111961000 Eastern Standard Time Epoch Time: 1297200521.111961000 seconds [Time delta from previous captured frame: 0.001693000 seconds] [Time delta from previous displayed frame: 0.001693000 seconds] [Time since reference or first frame: 14.554923000 seconds] Frame Number: 130 Frame Length: 92 bytes (736 bits) Capture Length: 92 bytes (736 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:xdmcp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) User Datagram Protocol, Src Port: xdmcp (177), Dst Port: 57941 (57941) Source port: xdmcp (177) Destination port: 57941 (57941) Length: 58 Checksum: 0x840a [validation disabled] X Display Manager Control Protocol Version: 1 Opcode: Willing (0x0005) Message length: 44 Authentication name: Hostname: dev01.xxx.net Status: Linux 2.6.18-194.32.1.el5 No. Time Source Destination Protocol Info 135 15.226412 10.3.20.159 10.3.147.100 XDMCP Request Frame 135: 129 bytes on wire (1032 bits), 129 bytes captured (1032 bits) Arrival Time: Feb 8, 2011 16:28:41.783450000 Eastern Standard Time Epoch Time: 1297200521.783450000 seconds [Time delta from previous captured frame: 0.146583000 seconds] [Time delta from previous displayed frame: 0.671489000 seconds] [Time since reference or first frame: 15.226412000 seconds] Frame Number: 135 Frame Length: 129 bytes (1032 bits) Capture Length: 129 bytes (1032 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:xdmcp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) User Datagram Protocol, Src Port: 57941 (57941), Dst Port: xdmcp (177) Source port: 57941 (57941) Destination port: xdmcp (177) Length: 95 Checksum: 0x830f [validation disabled] X Display Manager Control Protocol Version: 1 Opcode: Request (0x0007) Message length: 81 Display number: 0 Connections (1) Authentication name: Authentication data (0 bytes) Authorization names (3) Manufacturer display ID: No. Time Source Destination Protocol Info 136 15.231235 10.3.147.100 10.3.20.159 XDMCP Accept Frame 136: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) Arrival Time: Feb 8, 2011 16:28:41.788273000 Eastern Standard Time Epoch Time: 1297200521.788273000 seconds [Time delta from previous captured frame: 0.004823000 seconds] [Time delta from previous displayed frame: 0.004823000 seconds] [Time since reference or first frame: 15.231235000 seconds] Frame Number: 136 Frame Length: 94 bytes (752 bits) Capture Length: 94 bytes (752 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:xdmcp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) User Datagram Protocol, Src Port: xdmcp (177), Dst Port: 57941 (57941) Source port: xdmcp (177) Destination port: 57941 (57941) Length: 60 Checksum: 0x44d6 [validation disabled] X Display Manager Control Protocol Version: 1 Opcode: Accept (0x0008) Message length: 46 Session ID: 0x39e15653 Authentication name: Authentication data (0 bytes) Authorization name: MIT-MAGIC-COOKIE-1 Authorization data (16 bytes) No. Time Source Destination Protocol Info 137 15.231381 10.3.20.159 10.3.147.100 XDMCP Manage Frame 137: 71 bytes on wire (568 bits), 71 bytes captured (568 bits) Arrival Time: Feb 8, 2011 16:28:41.788419000 Eastern Standard Time Epoch Time: 1297200521.788419000 seconds [Time delta from previous captured frame: 0.000146000 seconds] [Time delta from previous displayed frame: 0.000146000 seconds] [Time since reference or first frame: 15.231381000 seconds] Frame Number: 137 Frame Length: 71 bytes (568 bits) Capture Length: 71 bytes (568 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:xdmcp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) User Datagram Protocol, Src Port: 57941 (57941), Dst Port: xdmcp (177) Source port: 57941 (57941) Destination port: xdmcp (177) Length: 37 Checksum: 0xa9a9 [validation disabled] X Display Manager Control Protocol Version: 1 Opcode: Manage (0x000a) Message length: 23 Session ID: 0x39e15653 Display number: 0 Display class: MIT-unspecified No. Time Source Destination Protocol Info 140 15.620933 10.3.147.100 10.3.20.159 TCP 44876 > x11 [SYN] Seq=0 Win=5840 Len=0 MSS=1380 SACK_PERM=1 TSV=1575904876 TSER=0 WS=7 Frame 140: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Arrival Time: Feb 8, 2011 16:28:42.177971000 Eastern Standard Time Epoch Time: 1297200522.177971000 seconds [Time delta from previous captured frame: 0.043879000 seconds] [Time delta from previous displayed frame: 0.389552000 seconds] [Time since reference or first frame: 15.620933000 seconds] Frame Number: 140 Frame Length: 74 bytes (592 bits) Capture Length: 74 bytes (592 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 0, Len: 0 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 0 (relative sequence number) Header length: 40 bytes Flags: 0x02 (SYN) Window size: 5840 Checksum: 0xeca2 [validation disabled] Options: (20 bytes) No. Time Source Destination Protocol Info 141 15.621094 10.3.20.159 10.3.147.100 TCP x11 > 44876 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=4034 WS=8 SACK_PERM=1 TSV=11371858 TSER=1575904876 Frame 141: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Arrival Time: Feb 8, 2011 16:28:42.178132000 Eastern Standard Time Epoch Time: 1297200522.178132000 seconds [Time delta from previous captured frame: 0.000161000 seconds] [Time delta from previous displayed frame: 0.000161000 seconds] [Time since reference or first frame: 15.621094000 seconds] Frame Number: 141 Frame Length: 74 bytes (592 bits) Capture Length: 74 bytes (592 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 0, Ack: 1, Len: 0 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 40 bytes Flags: 0x12 (SYN, ACK) Window size: 8192 Checksum: 0x45ee [validation disabled] Options: (20 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 142 15.621840 10.3.147.100 10.3.20.159 TCP 44876 > x11 [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=1575904877 TSER=11371858 Frame 142: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.178878000 Eastern Standard Time Epoch Time: 1297200522.178878000 seconds [Time delta from previous captured frame: 0.000746000 seconds] [Time delta from previous displayed frame: 0.000746000 seconds] [Time since reference or first frame: 15.621840000 seconds] Frame Number: 142 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 1, Ack: 1, Len: 0 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 5888 (scaled) Checksum: 0x9e9a [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 143 15.621953 10.3.147.100 10.3.20.159 X11 Initial connection request Frame 143: 114 bytes on wire (912 bits), 114 bytes captured (912 bits) Arrival Time: Feb 8, 2011 16:28:42.178991000 Eastern Standard Time Epoch Time: 1297200522.178991000 seconds [Time delta from previous captured frame: 0.000113000 seconds] [Time delta from previous displayed frame: 0.000113000 seconds] [Time since reference or first frame: 15.621953000 seconds] Frame Number: 143 Frame Length: 114 bytes (912 bits) Capture Length: 114 bytes (912 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 1, Ack: 1, Len: 48 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 1 (relative sequence number) [Next sequence number: 49 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 5888 (scaled) Checksum: 0x7a5e [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, Initial connection request byte-order: 0x6c (Little-endian) unused protocol-major-version: 11 protocol-minor-version: 0 authorization-protocol-name-length: 18 authorization-protocol-data-length: 16 unused authorization-protocol-name: MIT-MAGIC-COOKIE-1 authorization-protocol-data: ...W>${....1.7.0 No. Time Source Destination Protocol Info 144 15.622227 10.3.20.159 10.3.147.100 X11 Initial connection reply Frame 144: 1042 bytes on wire (8336 bits), 1042 bytes captured (8336 bits) Arrival Time: Feb 8, 2011 16:28:42.179265000 Eastern Standard Time Epoch Time: 1297200522.179265000 seconds [Time delta from previous captured frame: 0.000274000 seconds] [Time delta from previous displayed frame: 0.000274000 seconds] [Time since reference or first frame: 15.622227000 seconds] Frame Number: 144 Frame Length: 1042 bytes (8336 bits) Capture Length: 1042 bytes (8336 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1, Ack: 49, Len: 976 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1 (relative sequence number) [Next sequence number: 977 (relative sequence number)] Acknowledgement number: 49 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65536 (scaled) Checksum: 0xd667 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, Initial connection reply success: 1 unused protocol-major-version: 11 protocol-minor-version: 0 replylength: 242 release-number: 60900031 resource-id-base: 0x00200000 resource-id-mask: 0x001fffff motion-buffer-size: 256 length-of-vendor: 14 maximum-request-length: 65535 number-of-screens-in-roots: 1 number-of-formats-in-pixmap-formats: 7 image-byte-order: 0x00 (LSBFirst) bitmap-format-bit-order: 0x00 (LSBFirst) bitmap-format-scanline-unit: 32 bitmap-format-scanline-pad: 32 min-keycode: 8 max-keycode: 255 unused vendor: Colin Harrison undecoded No. Time Source Destination Protocol Info 145 15.623024 10.3.147.100 10.3.20.159 TCP 44876 > x11 [ACK] Seq=49 Ack=977 Win=7808 Len=0 TSV=1575904878 TSER=11371858 Frame 145: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.180062000 Eastern Standard Time Epoch Time: 1297200522.180062000 seconds [Time delta from previous captured frame: 0.000797000 seconds] [Time delta from previous displayed frame: 0.000797000 seconds] [Time since reference or first frame: 15.623024000 seconds] Frame Number: 145 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 49, Ack: 977, Len: 0 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 49 (relative sequence number) Acknowledgement number: 977 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 7808 (scaled) Checksum: 0x9a8a [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 146 15.623037 10.3.147.100 10.3.20.159 X11 Requests: CreateGC, QueryExtension, GetProperty Frame 146: 130 bytes on wire (1040 bits), 130 bytes captured (1040 bits) Arrival Time: Feb 8, 2011 16:28:42.180075000 Eastern Standard Time Epoch Time: 1297200522.180075000 seconds [Time delta from previous captured frame: 0.000013000 seconds] [Time delta from previous displayed frame: 0.000013000 seconds] [Time since reference or first frame: 15.623037000 seconds] Frame Number: 146 Frame Length: 130 bytes (1040 bits) Capture Length: 130 bytes (1040 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 49, Ack: 977, Len: 64 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 49 (relative sequence number) [Next sequence number: 113 (relative sequence number)] Acknowledgement number: 977 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0x01a0 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 55 (CreateGC) opcode: 55 (CreateGC) unused request-length: 5 cid: 0x00200000 drawable: 0x0000005b gc-value-mask: 0x00000008 background: 0x00ffffff X11, Request, opcode: 98 (QueryExtension) opcode: 98 (QueryExtension) unused request-length: 5 name-length: 12 unused name: BIG-REQUESTS X11, Request, opcode: 20 (GetProperty) opcode: 20 (GetProperty) delete: False request-length: 6 window: 0x0000005b property: 23 (RESOURCE_MANAGER) get-property-type: 31 (STRING) long-offset: 0 long-length: 100000000 No. Time Source Destination Protocol Info 147 15.623128 10.3.20.159 10.3.147.100 X11 Reply: GetInputFocus, BIG-REQUESTS-Enable Frame 147: 130 bytes on wire (1040 bits), 130 bytes captured (1040 bits) Arrival Time: Feb 8, 2011 16:28:42.180166000 Eastern Standard Time Epoch Time: 1297200522.180166000 seconds [Time delta from previous captured frame: 0.000091000 seconds] [Time delta from previous displayed frame: 0.000091000 seconds] [Time since reference or first frame: 15.623128000 seconds] Frame Number: 147 Frame Length: 130 bytes (1040 bits) Capture Length: 130 bytes (1040 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 977, Ack: 113, Len: 64 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 977 (relative sequence number) [Next sequence number: 1041 (relative sequence number)] Acknowledgement number: 113 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65536 (scaled) Checksum: 0x4f1d [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 43 (GetInputFocus) reply: 1 revert-to: Unknown (142) sequencenumber: 2 (GetInputFocus) replylength: 0 focus: 33793 unused X11, Reply, opcode: 132 (BIG-REQUESTS) reply: 1 unused sequencenumber: 3 (bigreq-Enable) replylength: 0 maximum_request_length: 0x00000000 (0) undecoded No. Time Source Destination Protocol Info 148 15.623755 10.3.147.100 10.3.20.159 X11 Requests: BIG-REQUESTS-Enable Frame 148: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) Arrival Time: Feb 8, 2011 16:28:42.180793000 Eastern Standard Time Epoch Time: 1297200522.180793000 seconds [Time delta from previous captured frame: 0.000627000 seconds] [Time delta from previous displayed frame: 0.000627000 seconds] [Time since reference or first frame: 15.623755000 seconds] Frame Number: 148 Frame Length: 70 bytes (560 bits) Capture Length: 70 bytes (560 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 113, Ack: 1041, Len: 4 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 113 (relative sequence number) [Next sequence number: 117 (relative sequence number)] Acknowledgement number: 1041 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0x14fd [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 132 (BIG-REQUESTS) opcode: 132 (BIG-REQUESTS) extension-minor: 0 (Enable) request-length: 1 No. Time Source Destination Protocol Info 149 15.623862 10.3.20.159 10.3.147.100 X11 Reply: GetInputFocus Frame 149: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) Arrival Time: Feb 8, 2011 16:28:42.180900000 Eastern Standard Time Epoch Time: 1297200522.180900000 seconds [Time delta from previous captured frame: 0.000107000 seconds] [Time delta from previous displayed frame: 0.000107000 seconds] [Time since reference or first frame: 15.623862000 seconds] Frame Number: 149 Frame Length: 98 bytes (784 bits) Capture Length: 98 bytes (784 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1041, Ack: 117, Len: 32 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1041 (relative sequence number) [Next sequence number: 1073 (relative sequence number)] Acknowledgement number: 117 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65536 (scaled) Checksum: 0x63f3 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 43 (GetInputFocus) reply: 1 revert-to: Unknown (128) sequencenumber: 4 (GetInputFocus) replylength: 0 focus: 4194303 unused No. Time Source Destination Protocol Info 150 15.624490 10.3.147.100 10.3.20.159 X11 Requests: QueryExtension Frame 150: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) Arrival Time: Feb 8, 2011 16:28:42.181528000 Eastern Standard Time Epoch Time: 1297200522.181528000 seconds [Time delta from previous captured frame: 0.000628000 seconds] [Time delta from previous displayed frame: 0.000628000 seconds] [Time since reference or first frame: 15.624490000 seconds] Frame Number: 150 Frame Length: 86 bytes (688 bits) Capture Length: 86 bytes (688 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 117, Ack: 1073, Len: 20 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 117 (relative sequence number) [Next sequence number: 137 (relative sequence number)] Acknowledgement number: 1073 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0xa481 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 98 (QueryExtension) opcode: 98 (QueryExtension) unused request-length: 5 name-length: 9 unused name: XKEYBOARD unused No. Time Source Destination Protocol Info 151 15.624590 10.3.20.159 10.3.147.100 X11 Reply: GetInputFocus Frame 151: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) Arrival Time: Feb 8, 2011 16:28:42.181628000 Eastern Standard Time Epoch Time: 1297200522.181628000 seconds [Time delta from previous captured frame: 0.000100000 seconds] [Time delta from previous displayed frame: 0.000100000 seconds] [Time since reference or first frame: 15.624590000 seconds] Frame Number: 151 Frame Length: 98 bytes (784 bits) Capture Length: 98 bytes (784 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1073, Ack: 137, Len: 32 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1073 (relative sequence number) [Next sequence number: 1105 (relative sequence number)] Acknowledgement number: 137 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65536 (scaled) Checksum: 0x1b69 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 43 (GetInputFocus) reply: 1 revert-to: Unknown (219) sequencenumber: 5 (GetInputFocus) replylength: 0 focus: 2421458945 unused No. Time Source Destination Protocol Info 152 15.625090 10.3.147.100 10.3.20.159 X11 Requests: XKEYBOARD-UseExtension Frame 152: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) Arrival Time: Feb 8, 2011 16:28:42.182128000 Eastern Standard Time Epoch Time: 1297200522.182128000 seconds [Time delta from previous captured frame: 0.000500000 seconds] [Time delta from previous displayed frame: 0.000500000 seconds] [Time since reference or first frame: 15.625090000 seconds] Frame Number: 152 Frame Length: 74 bytes (592 bits) Capture Length: 74 bytes (592 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 137, Ack: 1105, Len: 8 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 137 (relative sequence number) [Next sequence number: 145 (relative sequence number)] Acknowledgement number: 1105 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0x0e9f [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 136 (XKEYBOARD) opcode: 136 (XKEYBOARD) extension-minor: 0 (UseExtension) request-length: 2 wantedMajor: 0x0001 (1) wantedMinor: 0x0000 (0) No. Time Source Destination Protocol Info 153 15.625194 10.3.20.159 10.3.147.100 X11 Reply: GetInputFocus Frame 153: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) Arrival Time: Feb 8, 2011 16:28:42.182232000 Eastern Standard Time Epoch Time: 1297200522.182232000 seconds [Time delta from previous captured frame: 0.000104000 seconds] [Time delta from previous displayed frame: 0.000104000 seconds] [Time since reference or first frame: 15.625194000 seconds] Frame Number: 153 Frame Length: 98 bytes (784 bits) Capture Length: 98 bytes (784 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1105, Ack: 145, Len: 32 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1105 (relative sequence number) [Next sequence number: 1137 (relative sequence number)] Acknowledgement number: 145 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65536 (scaled) Checksum: 0x7031 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 43 (GetInputFocus) reply: 1 revert-to: 1 (PointerRoot) sequencenumber: 6 (GetInputFocus) replylength: 0 focus: 1 (PointerRoot) unused No. Time Source Destination Protocol Info 154 15.626298 10.3.147.100 10.3.20.159 X11 Requests: OpenFont, QueryExtension Frame 154: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) Arrival Time: Feb 8, 2011 16:28:42.183336000 Eastern Standard Time Epoch Time: 1297200522.183336000 seconds [Time delta from previous captured frame: 0.001104000 seconds] [Time delta from previous displayed frame: 0.001104000 seconds] [Time since reference or first frame: 15.626298000 seconds] Frame Number: 154 Frame Length: 102 bytes (816 bits) Capture Length: 102 bytes (816 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 145, Ack: 1137, Len: 36 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 145 (relative sequence number) [Next sequence number: 181 (relative sequence number)] Acknowledgement number: 1137 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0xaa20 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 45 (OpenFont) opcode: 45 (OpenFont) unused request-length: 5 fid: 0x00200001 name-length: 6 unused name: cursor unused X11, Request, opcode: 98 (QueryExtension) opcode: 98 (QueryExtension) unused request-length: 4 name-length: 6 unused name: RENDER unused No. Time Source Destination Protocol Info 155 15.626441 10.3.20.159 10.3.147.100 X11 Reply: GetInputFocus Frame 155: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) Arrival Time: Feb 8, 2011 16:28:42.183479000 Eastern Standard Time Epoch Time: 1297200522.183479000 seconds [Time delta from previous captured frame: 0.000143000 seconds] [Time delta from previous displayed frame: 0.000143000 seconds] [Time since reference or first frame: 15.626441000 seconds] Frame Number: 155 Frame Length: 98 bytes (784 bits) Capture Length: 98 bytes (784 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1137, Ack: 181, Len: 32 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1137 (relative sequence number) [Next sequence number: 1169 (relative sequence number)] Acknowledgement number: 181 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65280 (scaled) Checksum: 0x1b17 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 43 (GetInputFocus) reply: 1 revert-to: 0 (None) sequencenumber: 8 (GetInputFocus) replylength: 0 focus: 2751500545 unused No. Time Source Destination Protocol Info 156 15.627162 10.3.147.100 10.3.20.159 X11 Requests: RENDER-QueryVersion, RENDER-QueryPictFormats Frame 156: 82 bytes on wire (656 bits), 82 bytes captured (656 bits) Arrival Time: Feb 8, 2011 16:28:42.184200000 Eastern Standard Time Epoch Time: 1297200522.184200000 seconds [Time delta from previous captured frame: 0.000721000 seconds] [Time delta from previous displayed frame: 0.000721000 seconds] [Time since reference or first frame: 15.627162000 seconds] Frame Number: 156 Frame Length: 82 bytes (656 bits) Capture Length: 82 bytes (656 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 181, Ack: 1169, Len: 16 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 181 (relative sequence number) [Next sequence number: 197 (relative sequence number)] Acknowledgement number: 1169 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 7808 (scaled) Checksum: 0x6926 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 0 (QueryVersion) request-length: 3 client_major_version: 0x00000000 (0) client_minor_version: 0x0000000a (10) X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 1 (QueryPictFormats) request-length: 1 No. Time Source Destination Protocol Info 157 15.627326 10.3.20.159 10.3.147.100 X11 Reply: RENDER-QueryVersion, RENDER-QueryPictFormats Frame 157: 1070 bytes on wire (8560 bits), 1070 bytes captured (8560 bits) Arrival Time: Feb 8, 2011 16:28:42.184364000 Eastern Standard Time Epoch Time: 1297200522.184364000 seconds [Time delta from previous captured frame: 0.000164000 seconds] [Time delta from previous displayed frame: 0.000164000 seconds] [Time since reference or first frame: 15.627326000 seconds] Frame Number: 157 Frame Length: 1070 bytes (8560 bits) Capture Length: 1070 bytes (8560 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 1169, Ack: 197, Len: 1004 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 1169 (relative sequence number) [Next sequence number: 2173 (relative sequence number)] Acknowledgement number: 197 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) Window size: 65280 (scaled) Checksum: 0x1da8 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] X11, Reply, opcode: 145 (RENDER) reply: 1 unused sequencenumber: 9 (render-QueryVersion) replylength: 0 major_version: 0x00000000 (0) minor_version: 0x0000000a (10) unused X11, Reply, opcode: 145.1 (RENDER) reply: 1 unused sequencenumber: 10 (render-QueryPictFormats) replylength: 235 num_formats: 0x00000016 (22) num_screens: 0x00000001 (1) num_depths: 0x00000007 (7) num_visuals: 0x00000020 (32) num_subpixel: 0x00000001 (1) unused PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTFORMINFO PICTSCREEN subpixels No. Time Source Destination Protocol Info 158 15.629927 10.3.147.100 10.3.20.159 X11 Requests: CreatePixmap, CreateGC Frame 158: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.186965000 Eastern Standard Time Epoch Time: 1297200522.186965000 seconds [Time delta from previous captured frame: 0.002601000 seconds] [Time delta from previous displayed frame: 0.002601000 seconds] [Time since reference or first frame: 15.629927000 seconds] Frame Number: 158 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 197, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 197 (relative sequence number) [Next sequence number: 1565 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x2abb [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] TCP segment data (1336 bytes) X11, Request, opcode: 53 (CreatePixmap) opcode: 53 (CreatePixmap) depth: 32 request-length: 4 pid: 0x00200002 drawable: 0x0000005b width: 39 height: 26 X11, Request, opcode: 55 (CreateGC) opcode: 55 (CreateGC) unused request-length: 4 cid: 0x00200003 drawable: 0x00200002 gc-value-mask: 0x00000000 No. Time Source Destination Protocol Info 159 15.629970 10.3.147.100 10.3.20.159 TCP [TCP segment of a reassembled PDU] Frame 159: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.187008000 Eastern Standard Time Epoch Time: 1297200522.187008000 seconds [Time delta from previous captured frame: 0.000043000 seconds] [Time delta from previous displayed frame: 0.000043000 seconds] [Time since reference or first frame: 15.629970000 seconds] Frame Number: 159 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 1565, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 1565 (relative sequence number) [Next sequence number: 2933 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0xf862 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] [Reassembled PDU in frame: 162] TCP segment data (1368 bytes) No. Time Source Destination Protocol Info 160 15.630025 10.3.20.159 10.3.147.100 TCP x11 > 44876 [ACK] Seq=2173 Ack=2933 Win=65536 Len=0 TSV=11371859 TSER=1575904885 Frame 160: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.187063000 Eastern Standard Time Epoch Time: 1297200522.187063000 seconds [Time delta from previous captured frame: 0.000055000 seconds] [Time delta from previous displayed frame: 0.000055000 seconds] [Time since reference or first frame: 15.630025000 seconds] Frame Number: 160 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 2173, Ack: 2933, Len: 0 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 2173 (relative sequence number) Acknowledgement number: 2933 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 65536 (scaled) Checksum: 0x89cf [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 161 15.630829 10.3.147.100 10.3.20.159 TCP [TCP segment of a reassembled PDU] Frame 161: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.187867000 Eastern Standard Time Epoch Time: 1297200522.187867000 seconds [Time delta from previous captured frame: 0.000804000 seconds] [Time delta from previous displayed frame: 0.000804000 seconds] [Time since reference or first frame: 15.630829000 seconds] Frame Number: 161 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 2933, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 2933 (relative sequence number) [Next sequence number: 4301 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0xaf2a [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] [Reassembled PDU in frame: 162] TCP segment data (1368 bytes) No. Time Source Destination Protocol Info 162 15.630890 10.3.147.100 10.3.20.159 X11 Requests: PutImage Frame 162: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.187928000 Eastern Standard Time Epoch Time: 1297200522.187928000 seconds [Time delta from previous captured frame: 0.000061000 seconds] [Time delta from previous displayed frame: 0.000061000 seconds] [Time since reference or first frame: 15.630890000 seconds] Frame Number: 162 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 4301, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 4301 (relative sequence number) [Next sequence number: 5669 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x2bf1 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] TCP segment data (8 bytes) TCP segment data (1268 bytes) [Reassembled TCP Segments (4080 bytes): #158(1336), #159(1368), #161(1368), #162(8)] X11, Request, opcode: 72 (PutImage) opcode: 72 (PutImage) image-format: 2 (ZPixmap) request-length: 1020 drawable: 0x00200002 gc: 0x00200003 width: 39 height: 26 dst-x: 0 dst-y: 0 left-pad: 0 depth: 32 unused data: 000000000000000000000000000000000000000000000000... X11, Request, opcode: 60 (FreeGC) opcode: 60 (FreeGC) unused request-length: 2 gc: 0x00200003 X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 4 (CreatePicture) request-length: 5 pid: 0x00200004 drawable: 0x00200002 format: 0x00000045 undecoded X11, Request, opcode: 54 (FreePixmap) opcode: 54 (FreePixmap) unused request-length: 2 pixmap: 0x00200002 X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 27 (CreateCursor) request-length: 4 cid: 0x00200005 source: 0x00200004 x: 0x0009 (9) y: 0x0002 (2) X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 7 (FreePicture) request-length: 2 picture: 0x00200004 X11, Request, opcode: 53 (CreatePixmap) opcode: 53 (CreatePixmap) depth: 32 request-length: 4 pid: 0x00200006 drawable: 0x0000005b width: 39 height: 26 X11, Request, opcode: 55 (CreateGC) opcode: 55 (CreateGC) unused request-length: 4 cid: 0x00200007 drawable: 0x00200006 gc-value-mask: 0x00000000 No. Time Source Destination Protocol Info 163 15.630913 10.3.20.159 10.3.147.100 TCP x11 > 44876 [ACK] Seq=2173 Ack=5669 Win=65536 Len=0 TSV=11371859 TSER=1575904886 Frame 163: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.187951000 Eastern Standard Time Epoch Time: 1297200522.187951000 seconds [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 15.630913000 seconds] Frame Number: 163 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 2173, Ack: 5669, Len: 0 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 2173 (relative sequence number) Acknowledgement number: 5669 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 65536 (scaled) Checksum: 0x7f1e [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 164 15.631008 10.3.147.100 10.3.20.159 TCP [TCP segment of a reassembled PDU] Frame 164: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.188046000 Eastern Standard Time Epoch Time: 1297200522.188046000 seconds [Time delta from previous captured frame: 0.000095000 seconds] [Time delta from previous displayed frame: 0.000095000 seconds] [Time since reference or first frame: 15.631008000 seconds] Frame Number: 164 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 5669, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 5669 (relative sequence number) [Next sequence number: 7037 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x07fe [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] [Reassembled PDU in frame: 167] TCP segment data (1368 bytes) No. Time Source Destination Protocol Info 165 15.631863 10.3.147.100 10.3.20.159 TCP [TCP segment of a reassembled PDU] Frame 165: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.188901000 Eastern Standard Time Epoch Time: 1297200522.188901000 seconds [Time delta from previous captured frame: 0.000855000 seconds] [Time delta from previous displayed frame: 0.000855000 seconds] [Time since reference or first frame: 15.631863000 seconds] Frame Number: 165 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 7037, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 7037 (relative sequence number) [Next sequence number: 8405 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x792e [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] [Reassembled PDU in frame: 167] TCP segment data (1368 bytes) No. Time Source Destination Protocol Info 166 15.631934 10.3.20.159 10.3.147.100 TCP x11 > 44876 [ACK] Seq=2173 Ack=8405 Win=65536 Len=0 TSV=11371859 TSER=1575904886 Frame 166: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.188972000 Eastern Standard Time Epoch Time: 1297200522.188972000 seconds [Time delta from previous captured frame: 0.000071000 seconds] [Time delta from previous displayed frame: 0.000071000 seconds] [Time since reference or first frame: 15.631934000 seconds] Frame Number: 166 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 2173, Ack: 8405, Len: 0 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 2173 (relative sequence number) Acknowledgement number: 8405 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 65536 (scaled) Checksum: 0x746e [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] No. Time Source Destination Protocol Info 167 15.632054 10.3.147.100 10.3.20.159 X11 Requests: PutImage Frame 167: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.189092000 Eastern Standard Time Epoch Time: 1297200522.189092000 seconds [Time delta from previous captured frame: 0.000120000 seconds] [Time delta from previous displayed frame: 0.000120000 seconds] [Time since reference or first frame: 15.632054000 seconds] Frame Number: 167 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp:x11:x11] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 8405, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 8405 (relative sequence number) [Next sequence number: 9773 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x8714 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] TCP segment data (76 bytes) TCP segment data (1200 bytes) [Reassembled TCP Segments (4080 bytes): #162(1268), #164(1368), #165(1368), #167(76)] X11, Request, opcode: 72 (PutImage) opcode: 72 (PutImage) image-format: 2 (ZPixmap) request-length: 1020 drawable: 0x00200006 gc: 0x00200007 width: 39 height: 26 dst-x: 0 dst-y: 0 left-pad: 0 depth: 32 unused data: 000000000000000000000000000000000000000000000000... X11, Request, opcode: 60 (FreeGC) opcode: 60 (FreeGC) unused request-length: 2 gc: 0x00200007 X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 4 (CreatePicture) request-length: 5 pid: 0x00200008 drawable: 0x00200006 format: 0x00000045 undecoded X11, Request, opcode: 54 (FreePixmap) opcode: 54 (FreePixmap) unused request-length: 2 pixmap: 0x00200006 X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 27 (CreateCursor) request-length: 4 cid: 0x00200009 source: 0x00200008 x: 0x0009 (9) y: 0x0002 (2) X11, Request, opcode: 145 (RENDER) opcode: 145 (RENDER) extension-minor: 7 (FreePicture) request-length: 2 picture: 0x00200008 X11, Request, opcode: 53 (CreatePixmap) opcode: 53 (CreatePixmap) depth: 32 request-length: 4 pid: 0x0020000a drawable: 0x0000005b width: 39 height: 26 X11, Request, opcode: 55 (CreateGC) opcode: 55 (CreateGC) unused request-length: 4 cid: 0x0020000b drawable: 0x0020000a gc-value-mask: 0x00000000 No. Time Source Destination Protocol Info 168 15.632072 10.3.147.100 10.3.20.159 TCP [TCP segment of a reassembled PDU] Frame 168: 1434 bytes on wire (11472 bits), 1434 bytes captured (11472 bits) Arrival Time: Feb 8, 2011 16:28:42.189110000 Eastern Standard Time Epoch Time: 1297200522.189110000 seconds [Time delta from previous captured frame: 0.000018000 seconds] [Time delta from previous displayed frame: 0.000018000 seconds] [Time since reference or first frame: 15.632072000 seconds] Frame Number: 168 Frame Length: 1434 bytes (11472 bits) Capture Length: 1434 bytes (11472 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_b1:71:40 (00:0b:45:b1:71:40), Dst: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b) Internet Protocol, Src: 10.3.147.100 (10.3.147.100), Dst: 10.3.20.159 (10.3.20.159) Transmission Control Protocol, Src Port: 44876 (44876), Dst Port: x11 (6000), Seq: 9773, Ack: 2173, Len: 1368 Source port: 44876 (44876) Destination port: x11 (6000) [Stream index: 20] Sequence number: 9773 (relative sequence number) [Next sequence number: 11141 (relative sequence number)] Acknowledgement number: 2173 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 9856 (scaled) Checksum: 0x23d1 [validation disabled] Options: (12 bytes) [SEQ/ACK analysis] [Reassembled PDU in frame: 171] TCP segment data (1368 bytes) No. Time Source Destination Protocol Info 169 15.632098 10.3.20.159 10.3.147.100 TCP x11 > 44876 [ACK] Seq=2173 Ack=11141 Win=65536 Len=0 TSV=11371859 TSER=1575904887 Frame 169: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) Arrival Time: Feb 8, 2011 16:28:42.189136000 Eastern Standard Time Epoch Time: 1297200522.189136000 seconds [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 15.632098000 seconds] Frame Number: 169 Frame Length: 66 bytes (528 bits) Capture Length: 66 bytes (528 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: HewlettP_5d:bb:1b (1c:c1:de:5d:bb:1b), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Internet Protocol, Src: 10.3.20.159 (10.3.20.159), Dst: 10.3.147.100 (10.3.147.100) Transmission Control Protocol, Src Port: x11 (6000), Dst Port: 44876 (44876), Seq: 2173, Ack: 11141, Len: 0 Source port: x11 (6000) Destination port: 44876 (44876) [Stream index: 20] Sequence number: 2173 (relative sequence number) Acknowledgement number: 11141 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) Window size: 65536 (scaled) Checksum: 0x69bd [validation disabled] Options: (12 bytes) [SEQ/ACK analysis]