No. Time Source Destination Protocol Info 1 0.000000 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 Frame 1 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 0, Ack: 0, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 30 db 3a 40 00 80 06 c4 81 ac 1f 01 68 ac 1f .0.:@........h.. 0020 01 65 07 ca 04 01 e7 79 50 22 00 00 00 00 70 02 .e.....yP"....p. 0030 fa f0 e9 bb 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 2 0.000689 172.31.1.101 172.31.1.104 TCP blackjack > stun-port [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 Frame 2 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 30 2d 4a 40 00 80 06 72 72 ac 1f 01 65 ac 1f .0-J@...rr...e.. 0020 01 68 04 01 07 ca 52 21 b5 7f e7 79 50 23 70 12 .h....R!...yP#p. 0030 fa f0 e2 09 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 3 0.002335 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [ACK] Seq=1 Ack=1 Win=64240 Len=0 Frame 3 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1, Ack: 1, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 db 3b 40 00 80 06 c4 88 ac 1f 01 68 ac 1f .(.;@........h.. 0020 01 65 07 ca 04 01 e7 79 50 23 52 21 b5 80 50 10 .e.....yP#R!..P. 0030 fa f0 0e ce 00 00 ac 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 4 0.005165 172.31.1.104 172.31.1.101 DCERPC Bind: call_id: 1659 UUID: DRSUAPI Frame 4 (1359 bytes on wire, 1359 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1, Ack: 1, Len: 1305 DCE RPC Frame (1359 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 41 db 3c 40 00 80 06 bf 6e ac 1f 01 68 ac 1f .A.<@....n...h.. 0020 01 65 07 ca 04 01 e7 79 50 23 52 21 b5 80 50 18 .e.....yP#R!..P. 0030 fa f0 f6 c9 00 00 05 00 0b 07 10 00 00 00 19 05 ................ 0040 c9 04 7b 06 00 00 d0 16 d0 16 3f 0e 01 00 01 00 ..{.......?..... 0050 00 00 00 00 01 00 35 42 51 e3 06 4b d1 11 ab 04 ......5BQ..K.... 0060 00 c0 4f c2 dc d2 04 00 00 00 04 5d 88 8a eb 1c ..O........].... 0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 10 06 ......+.H`...... 0080 00 00 01 00 00 00 6e 82 04 c5 30 82 04 c1 a0 03 ......n...0..... 0090 02 01 05 a1 03 02 01 0e a2 07 03 05 00 20 00 00 ............. .. 00a0 00 a3 82 03 dc 61 82 03 d8 30 82 03 d4 a0 03 02 .....a...0...... 00b0 01 05 a1 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 ......W2K3.VMNET 00c0 31 2e 56 4d 2e 42 41 53 45 a2 42 30 40 a0 03 02 1.VM.BASE.B0@... 00d0 01 02 a1 39 30 37 1b 02 47 43 1b 1c 77 32 6b 33 ...907..GC..w2k3 00e0 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 -101.w2k3.vmnet1 00f0 2e 76 6d 2e 62 61 73 65 1b 13 77 32 6b 33 2e 76 .vm.base..w2k3.v 0100 6d 6e 65 74 31 2e 76 6d 2e 62 61 73 65 a3 82 03 mnet1.vm.base... 0110 70 30 82 03 6c a0 03 02 01 17 a1 03 02 01 0a a2 p0..l........... 0120 82 03 5e 04 82 03 5a b9 16 48 94 e0 79 76 bd 76 ..^...Z..H..yv.v 0130 63 d0 c9 89 c0 38 cf 4d 28 a5 32 9b 4f f4 ba 79 c....8.M(.2.O..y 0140 e6 21 8f f9 32 5c e9 e2 ca f4 24 91 18 93 f5 ca .!..2\....$..... 0150 ef 37 a2 f7 71 12 d4 6e 02 62 82 67 e1 65 32 60 .7..q..n.b.g.e2` 0160 46 64 61 b2 d7 3e f6 e0 35 24 94 2d 1b 81 83 74 Fda..>..5$.-...t 0170 42 26 08 47 ef ab 0d 45 3c 4a 9a 9d d3 0d 01 78 B&.G...E.M..1...... 03e0 10 55 8b b3 10 89 4f 28 fb da 62 e4 b7 61 af ab .U....O(..b..a.. 03f0 80 8e a0 11 de 29 0d 0e d4 8d 45 d3 40 4a e5 10 .....)....E.@J.. 0400 a1 f3 61 03 45 de 05 a5 a1 f8 36 0c 92 a3 fa 6a ..a.E.....6....j 0410 3d 02 62 18 75 2b 4d 44 f7 df d9 0f c7 38 9d 70 =.b.u+MD.....8.p 0420 9e 38 72 8f 35 fb 5f b1 28 1c 37 24 3a a0 cf d2 .8r.5._.(.7$:... 0430 66 18 ec 15 9f de 94 27 8e 92 cf 46 03 83 0e 91 f......'...F.... 0440 ef 50 ad 5c 01 18 3f 15 f1 c1 63 18 bd f1 44 f1 .P.\..?...c...D. 0450 00 a0 5a 2a e3 31 46 99 2d 5b fa 5a a7 cf b4 bb ..Z*.1F.-[.Z.... 0460 a6 6a 92 60 38 21 1e df 91 5e b0 f1 86 cc ff e5 .j.`8!...^...... 0470 bd b2 92 09 6c c1 f1 c9 d0 e8 d2 49 0e 01 10 da ....l......I.... 0480 07 a4 81 cb 30 81 c8 a0 03 02 01 17 a2 81 c0 04 ....0........... 0490 81 bd d5 95 4d 77 c6 6d 45 09 9e 62 f7 99 51 d5 ....Mw.mE..b..Q. 04a0 58 8a e8 46 b6 11 99 b6 d0 b7 86 dc c5 db d7 d6 X..F............ 04b0 ac 3e 78 2e 13 79 60 22 1c bf 77 8b 0b 3c e1 fb .>x..y`"..w..<.. 04c0 98 42 f3 a4 78 28 61 b1 90 c4 07 b5 ca 04 30 fc .B..x(a.......0. 04d0 7d 2e a4 99 8e 6b 78 cd cc 38 8d 0e 7e 60 52 ef }....kx..8..~`R. 04e0 4a e4 10 4b 82 1b 90 f0 4e 3e 25 b6 99 de e0 1e J..K....N>%..... 04f0 66 a7 c2 f5 be f4 14 b2 5c 2f fb b7 a2 4d fd 87 f.......\/...M.. 0500 ba 6c 06 b2 57 4a a2 1e a8 4b 75 7e 49 9d 07 35 .l..WJ...Ku~I..5 0510 42 76 2b 9b c2 00 86 ff 7b ee 55 15 c7 96 cc 1a Bv+.....{.U..... 0520 d0 22 a3 20 ea 6f 4f 57 27 94 25 a8 06 02 91 52 .". .oOW'.%....R 0530 7d 85 16 4e 0e 04 0e 1c 6e 31 1b 8d 5c 20 93 19 }..N....n1..\ .. 0540 4f e3 b3 f1 ed 27 a1 ac 7e 73 4f cf 97 9f ae O....'..~sO.... Decrypted Krb5 (858 bytes): 0000 63 82 03 3e 30 82 03 3a a0 07 03 05 00 40 a4 00 c..>0..:.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 c3 74 ...0...........t 0020 f7 77 8d 11 a1 ad 4e a7 76 20 8b 26 d1 57 a2 1a .w....N.v .&.W.. 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 16 30 14 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 0d 30 0b 1b 09 77 32 6b 33 2d 31 30 .....0...w2k3-10 0060 34 24 a4 0b 30 09 a0 03 02 01 01 a1 02 04 00 a5 4$..0........... 0070 11 18 0f 32 30 30 35 30 33 30 34 30 39 34 32 32 ...2005030409422 0080 36 5a a6 11 18 0f 32 30 30 35 30 33 30 36 30 31 6Z....2005030601 0090 34 34 35 36 5a a7 11 18 0f 32 30 30 35 30 33 30 4456Z....2005030 00a0 36 31 31 30 32 34 37 5a a8 11 18 0f 32 30 30 35 6110247Z....2005 00b0 30 33 31 31 30 39 34 32 32 36 5a aa 82 02 83 30 0311094226Z....0 00c0 82 02 7f 30 82 02 7b a0 03 02 01 01 a1 82 02 72 ...0..{........r 00d0 04 82 02 6e 30 82 02 6a 30 82 02 66 a0 04 02 02 ...n0..j0..f.... 00e0 00 80 a1 82 02 5c 04 82 02 58 04 00 00 00 00 00 .....\...X...... 00f0 00 00 01 00 00 00 c0 01 00 00 48 00 00 00 00 00 ..........H..... 0100 00 00 0a 00 00 00 1c 00 00 00 08 02 00 00 00 00 ................ 0110 00 00 06 00 00 00 14 00 00 00 28 02 00 00 00 00 ..........(..... 0120 00 00 07 00 00 00 14 00 00 00 40 02 00 00 00 00 ..........@..... 0130 00 00 01 10 08 00 cc cc cc cc b0 01 00 00 00 00 ................ 0140 00 00 00 00 02 00 23 f2 e6 43 64 1d c5 01 ff ff ......#..Cd..... 0150 ff ff ff ff ff 7f ff ff ff ff ff ff ff 7f b1 56 ...............V 0160 3b 6a 5c 15 c5 01 b1 16 a5 94 25 16 c5 01 ff ff ;j\.......%..... 0170 ff ff ff ff ff 7f 12 00 12 00 04 00 02 00 00 00 ................ 0180 00 00 08 00 02 00 00 00 00 00 0c 00 02 00 00 00 ................ 0190 00 00 10 00 02 00 00 00 00 00 14 00 02 00 00 00 ................ 01a0 00 00 18 00 02 00 5f 00 00 00 e8 03 00 00 04 02 ......_......... 01b0 00 00 01 00 00 00 1c 00 02 00 20 00 00 00 00 00 .......... ..... 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 ................ 01d0 12 00 20 00 02 00 08 00 0a 00 24 00 02 00 28 00 .. .......$...(. 01e0 02 00 00 00 00 00 00 00 00 00 00 21 00 00 00 00 ...........!.... 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 01 00 00 00 2c 00 ..............,. 0210 02 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 ................ 0220 00 00 00 00 00 00 09 00 00 00 57 00 32 00 4b 00 ..........W.2.K. 0230 33 00 2d 00 31 00 30 00 34 00 24 00 00 00 00 00 3.-.1.0.4.$..... 0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04 02 ................ 0280 00 00 07 00 00 00 09 00 00 00 00 00 00 00 08 00 ................ 0290 00 00 57 00 32 00 4b 00 33 00 2d 00 31 00 30 00 ..W.2.K.3.-.1.0. 02a0 34 00 05 00 00 00 00 00 00 00 04 00 00 00 53 00 4.............S. 02b0 55 00 42 00 31 00 04 00 00 00 01 04 00 00 00 00 U.B.1........... 02c0 00 05 15 00 00 00 39 15 ce fd e9 c3 37 9b 6f 15 ......9.....7.o. 02d0 38 1a 01 00 00 00 30 00 02 00 07 00 00 00 01 00 8.....0......... 02e0 00 00 01 01 00 00 00 00 00 05 09 00 00 00 00 00 ................ 02f0 00 00 00 6d 2f 79 9e 20 c5 01 12 00 77 00 32 00 ...m/y. ....w.2. 0300 6b 00 33 00 2d 00 31 00 30 00 34 00 24 00 00 00 k.3.-.1.0.4.$... 0310 00 00 76 ff ff ff 50 7e be ef 12 28 55 36 dd b6 ..v...P~...(U6.. 0320 6f 1a 2c 1a 37 f0 00 00 00 00 76 ff ff ff a8 6a o.,.7.....v....j 0330 b2 f8 b0 b2 a3 51 6a bb 24 ee fe c8 75 9a 00 00 .....Qj.$...u... 0340 00 00 76 ff 31 00 00 00 a8 d1 5f 08 f0 57 1b 41 ..v.1....._..W.A 0350 24 ee fe c8 75 9a 00 00 00 00 $...u..... Decrypted Krb5 (189 bytes): 0000 62 81 a2 30 81 9f a0 03 02 01 05 a1 1a 1b 18 53 b..0...........S 0010 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 2e UB1.W2K3.VMNET1. 0020 56 4d 2e 42 41 53 45 a2 16 30 14 a0 03 02 01 01 VM.BASE..0...... 0030 a1 0d 30 0b 1b 09 77 32 6b 33 2d 31 30 34 24 a3 ..0...w2k3-104$. 0040 25 30 23 a0 05 02 03 00 80 03 a1 1a 04 18 10 00 %0#............. 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 3e 10 00 00 a4 05 02 03 0b 14 23 a5 11 18 ..>.........#... 0070 0f 32 30 30 35 30 33 30 36 30 39 30 38 34 32 5a .20050306090842Z 0080 a6 1b 30 19 a0 03 02 01 17 a1 12 04 10 fd 3e dc ..0...........>. 0090 82 eb 69 b5 e3 ab b4 f0 74 64 2d 23 a4 a7 06 02 ..i.....td-#.... 00a0 04 16 99 a4 1b fd 3e dc 82 eb 69 b5 19 00 00 00 ......>...i..... 00b0 50 62 5e 08 d8 57 1b 41 04 16 99 a4 1b Pb^..W.A..... No. Time Source Destination Protocol Info 5 0.007173 172.31.1.101 172.31.1.104 DCERPC Bind_ack: call_id: 1659 accept max_xmit: 5840 max_recv: 5840 Frame 5 (240 bytes on wire, 240 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 1, Ack: 1306, Len: 186 DCE RPC Frame (240 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e2 2d 4b 40 00 80 06 71 bf ac 1f 01 65 ac 1f ..-K@...q....e.. 0020 01 68 04 01 07 ca 52 21 b5 80 e7 79 55 3c 50 18 .h....R!...yU.."Pv, 00c0 28 9e bc d7 a6 5d 33 3f 5e 33 64 d6 01 09 86 1d (....]3?^3d..... 00d0 c5 42 63 1b ea c1 45 1c 01 89 15 7b 6e f0 2c f9 .Bc...E....{n.,. 00e0 de 14 c4 11 67 83 a8 46 d2 16 48 07 50 4c c6 24 ....g..F..H.PL.$ Decrypted Krb5 (91 bytes): 0000 7b 41 30 3f a0 11 18 0f 32 30 30 35 30 33 30 36 {A0?....20050306 0010 30 39 30 38 34 32 5a a1 05 02 03 0b 14 23 a2 1b 090842Z......#.. 0020 30 19 a0 03 02 01 17 a1 12 04 10 fd 3e dc 82 eb 0...........>... 0030 69 b5 e3 ab b4 f0 74 64 2d 23 a4 a3 06 02 04 16 i.....td-#...... 0040 8e 85 74 fd 19 00 00 00 28 10 5f 08 65 20 28 32 ..t.....(._.e (2 0050 34 30 20 62 79 74 65 73 29 3a 00 40 bytes):. No. Time Source Destination Protocol Info 6 0.021202 172.31.1.104 172.31.1.101 DCERPC Alter_context: call_id: 1659 UUID: DRSUAPI Frame 6 (223 bytes on wire, 223 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1306, Ack: 187, Len: 169 DCE RPC Frame (223 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 d1 db 3d 40 00 80 06 c3 dd ac 1f 01 68 ac 1f ...=@........h.. 0020 01 65 07 ca 04 01 e7 79 55 3c 52 21 b6 3a 50 18 .e.....yU..........x..~J 00b0 59 82 f5 22 3b f4 28 c4 08 64 b4 56 ac ff 6f 1a Y..";.(..d.V..o. 00c0 3a 5b f8 27 36 0c 10 5b 07 f2 ae 5e 04 58 8a 6f :[.'6..[...^.X.o 00d0 e7 a8 43 2b 1f 6d a6 65 e9 b9 b9 4c 19 3c 45 ..C+.m.e...L.@........h.. 0020 01 65 07 ca 04 01 e7 79 55 e5 52 21 b6 7a 50 18 .e.....yU.R!.zP. 0030 f9 f6 51 34 00 00 05 00 00 03 10 00 00 00 ed 00 ..Q4............ 0040 2d 00 7b 06 00 00 9a 00 00 00 00 00 0c 00 a9 56 -.{............V 0050 77 00 1d 6c 7e fb 25 ca 8b 51 b7 07 16 d0 ba 97 w..l~.%..Q...... 0060 95 d3 c6 22 83 f2 2c f5 24 17 bb 44 c9 71 37 5d ..."..,.$..D.q7] 0070 46 bb 95 02 6c 94 d4 6f c3 67 5b 87 de 78 58 9a F...l..o.g[..xX. 0080 bf b9 60 c8 bc 1e 6f 3f da 7f 33 2d b6 75 d8 32 ..`...o?..3-.u.2 0090 fd 7e 5c e1 8e b4 95 7a fa 06 ee 39 f3 8f e9 bf .~\....z...9.... 00a0 d8 0a 9e 39 1e e1 9a 4e 9f 68 95 57 ac 30 42 8a ...9...N.h.W.0B. 00b0 f2 fd a1 f4 0d 66 90 e9 f7 a9 13 c8 ed 89 06 46 .....f.........F 00c0 73 d8 84 26 56 6a db 50 f2 2f f3 c3 66 0d 2a 2e s..&Vj.P./..f.*. 00d0 fe 50 f8 20 0a 7e 3d 74 24 55 26 82 4b 9c 8a f5 .P. .~=t$U&.K... 00e0 3a 1b c7 86 bd d4 80 36 24 ff de 4d d4 df 10 06 :......6$..M.... 00f0 06 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0100 01 02 02 02 01 11 00 10 00 ff ff ce 0f de 78 bb ..............x. 0110 e9 cb ee 59 a1 2a 86 7f a8 5e 0a de 08 a4 ab 22 ...Y.*...^....." 0120 d5 aa 96 ... No. Time Source Destination Protocol Info 9 0.026112 172.31.1.101 172.31.1.104 DRSUAPI DRSCrackNames response Frame 9 (339 bytes on wire, 339 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 251, Ack: 1712, Len: 285 DCE RPC Microsoft Directory Replication Service, DRSCrackNames 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 45 2d 4d 40 00 80 06 71 5a ac 1f 01 65 ac 1f .E-M@...qZ...e.. 0020 01 68 04 01 07 ca 52 21 b6 7a e7 79 56 d2 50 18 .h....R!.z.yV.P. 0030 fa 03 65 51 00 00 05 00 02 03 10 00 00 00 1d 01 ..eQ............ 0040 2d 00 7b 06 00 00 c4 00 00 00 00 00 00 00 ee 16 -.{............. 0050 60 e1 8a 4a d7 2d a3 62 65 14 1e aa d5 00 bd 21 `..J.-.be......! 0060 fe 43 9e ed 85 df fb 6f 00 0b c8 f8 ce d6 7f 7b .C.....o.......{ 0070 1a 5b af 17 c8 33 72 0c 4a 0e fc 1e 9a 9d 62 4f .[...3r.J.....bO 0080 ce 2b b2 02 7d 04 78 ea 94 d0 e2 58 4f cf 5a a1 .+..}.x....XO.Z. 0090 b5 56 2c 8c ce 1c ec 32 84 39 18 c6 33 ea bc b1 .V,....2.9..3... 00a0 d5 87 72 47 0e e9 9c 5d 94 01 a8 bd 27 b1 c7 db ..rG...]....'... 00b0 6c cb a7 16 4d 5f ae 84 65 ba c4 2a 0e a4 5f 2d l...M_..e..*.._- 00c0 12 0e fa 4e 3d 93 66 f4 cc 2e d9 eb f5 17 e7 fc ...N=.f......... 00d0 ce 0e 13 54 c6 3f 22 74 b9 5e c3 54 d6 ba 23 b9 ...T.?"t.^.T..#. 00e0 b6 ad 62 c9 53 04 8f b4 b6 db 53 e0 e5 0b e5 c4 ..b.S.....S..... 00f0 7d 29 f0 86 d7 0b cb 45 5d 91 a8 74 ce d0 ec 07 }).....E]..t.... 0100 33 be 07 5a 8d f8 e3 59 65 7f 2e 13 af d3 3f 7a 3..Z...Ye.....?z 0110 38 d1 63 7b c0 34 b8 ef 3e ca ec 3f 18 6e 10 06 8.c{.4..>..?.n.. 0120 0c 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0130 01 02 02 02 01 11 00 10 00 ff ff 78 2e c4 10 22 ...........x..." 0140 e6 4a 70 31 22 70 28 b0 aa 65 43 17 41 a2 96 40 .Jp1"p(..eC.A..@ 0150 14 d4 46 ..F No. Time Source Destination Protocol Info 10 0.231892 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [ACK] Seq=1712 Ack=536 Win=63705 Len=0 Frame 10 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1712, Ack: 536, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 db 72 40 00 80 06 c4 51 ac 1f 01 68 ac 1f .(.r@....Q...h.. 0020 01 65 07 ca 04 01 e7 79 56 d2 52 21 b7 97 50 10 .e.....yV.R!..P. 0030 f8 d9 08 1f 00 00 00 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 11 8.593562 172.31.1.104 172.31.1.101 TCP perf-port > blackjack [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 Frame 11 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 0, Ack: 0, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 30 db 8f 40 00 80 06 c4 2c ac 1f 01 68 ac 1f .0..@....,...h.. 0020 01 65 07 cb 04 01 05 7f 5c 58 00 00 00 00 70 02 .e......\X....p. 0030 fa f0 bf 7f 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 12 8.594438 172.31.1.101 172.31.1.104 TCP blackjack > perf-port [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 Frame 12 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 30 2d 4e 40 00 80 06 72 6e ac 1f 01 65 ac 1f .0-N@...rn...e.. 0020 01 68 04 01 07 cb fd 8c 8b 98 05 7f 5c 59 70 12 .h..........\Yp. 0030 fa f0 36 49 00 00 02 04 05 b4 01 01 04 02 ..6I.......... No. Time Source Destination Protocol Info 13 8.594846 172.31.1.104 172.31.1.101 TCP perf-port > blackjack [ACK] Seq=1 Ack=1 Win=64240 Len=0 Frame 13 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1, Ack: 1, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 db 90 40 00 80 06 c4 33 ac 1f 01 68 ac 1f .(..@....3...h.. 0020 01 65 07 cb 04 01 05 7f 5c 59 fd 8c 8b 99 50 10 .e......\Y....P. 0030 fa f0 63 0d 00 00 ac 1f 01 65 c5 d5 ..c......e.. No. Time Source Destination Protocol Info 14 8.596338 172.31.1.104 172.31.1.101 DCERPC Bind: call_id: 1660 UUID: DRSUAPI Frame 14 (1401 bytes on wire, 1401 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1, Ack: 1, Len: 1347 DCE RPC Frame (1401 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 6b db 91 40 00 80 06 be ef ac 1f 01 68 ac 1f .k..@........h.. 0020 01 65 07 cb 04 01 05 7f 5c 59 fd 8c 8b 99 50 18 .e......\Y....P. 0030 fa f0 21 10 00 00 05 00 0b 07 10 00 00 00 43 05 ..!...........C. 0040 f3 04 7c 06 00 00 d0 16 d0 16 3f 0e 01 00 01 00 ..|.......?..... 0050 00 00 00 00 01 00 35 42 51 e3 06 4b d1 11 ab 04 ......5BQ..K.... 0060 00 c0 4f c2 dc d2 04 00 00 00 04 5d 88 8a eb 1c ..O........].... 0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 10 06 ......+.H`...... 0080 00 00 01 00 00 00 6e 82 04 ef 30 82 04 eb a0 03 ......n...0..... 0090 02 01 05 a1 03 02 01 0e a2 07 03 05 00 20 00 00 ............. .. 00a0 00 a3 82 04 06 61 82 04 02 30 82 03 fe a0 03 02 .....a...0...... 00b0 01 05 a1 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 ......W2K3.VMNET 00c0 31 2e 56 4d 2e 42 41 53 45 a2 6c 30 6a a0 03 02 1.VM.BASE.l0j... 00d0 01 02 a1 63 30 61 1b 24 45 33 35 31 34 32 33 35 ...c0a.$E3514235 00e0 2d 34 42 30 36 2d 31 31 44 31 2d 41 42 30 34 2d -4B06-11D1-AB04- 00f0 30 30 43 30 34 46 43 32 44 43 44 32 1b 24 62 31 00C04FC2DCD2.$b1 0100 37 33 64 61 61 35 2d 63 34 30 31 2d 34 34 33 62 73daa5-c401-443b 0110 2d 39 30 32 38 2d 65 32 66 38 33 32 66 65 34 36 -9028-e2f832fe46 0120 36 66 1b 13 77 32 6b 33 2e 76 6d 6e 65 74 31 2e 6f..w2k3.vmnet1. 0130 76 6d 2e 62 61 73 65 a3 82 03 70 30 82 03 6c a0 vm.base...p0..l. 0140 03 02 01 17 a1 03 02 01 0a a2 82 03 5e 04 82 03 ............^... 0150 5a 27 16 e8 a2 28 b1 e1 32 a9 88 01 3c 2a c8 a9 Z'...(..2...<*.. 0160 dc 42 b7 78 3d cb a4 1a 3e e8 d0 d5 ec ec ec b0 .B.x=...>....... 0170 8e 76 7d f5 b6 1f cc 67 f4 3e 5e 74 1b 54 e5 1c .v}....g.>^t.T.. 0180 04 97 b2 34 2c c9 6c 5c 18 19 6b 5a f5 88 78 6a ...4,.l\..kZ..xj 0190 44 1c 81 29 ef e1 c0 d2 80 77 cc c9 2d b9 bd e3 D..).....w..-... 01a0 28 2e aa 70 d0 62 c3 f0 b7 f7 04 1e aa 96 2b f0 (..p.b........+. 01b0 c8 7a 49 d5 44 40 30 bb 31 9a 01 20 f2 70 06 cc .zI.D@0.1.. .p.. 01c0 96 0f 9f 91 14 7a b7 9b 3e c2 56 46 4d e1 f0 4a .....z..>.VFM..J 01d0 01 a2 1a 37 82 d7 81 8d 8a 3c 4e 86 87 72 8e 1e ...7.....J*F.y.. 0220 c7 0c a4 9b 5d ac 9a ff 93 6c b4 15 da 4a f6 4b ....]....l...J.K 0230 96 d6 12 53 34 a6 18 92 81 2b d2 54 bc 40 4e f2 ...S4....+.T.@N. 0240 a7 1f bf e6 a0 49 09 3c f0 07 44 21 a5 6c 12 26 .....I.<..D!.l.& 0250 ab d4 fe 2c 54 3a 7a a2 60 38 ba 01 79 ee bb 53 ...,T:z.`8..y..S 0260 50 8e 7d 07 9f 4a 2a 34 bb 66 03 e1 db 8f 6c fb P.}..J*4.f....l. 0270 41 ed b6 eb 38 4b 09 98 d4 02 9e 68 63 0e 26 7b A...8K.....hc.&{ 0280 cf 5c b0 8f bd 2d dc d8 02 9b 58 94 0a 90 e5 6e .\...-....X....n 0290 0a d0 55 19 94 41 5e cd 3f 3a ce 19 4d a1 14 26 ..U..A^.?:..M..& 02a0 01 8f b3 62 d7 b3 c0 2d f8 e6 88 1d 01 a3 04 7d ...b...-.......} 02b0 e3 fa 44 bb 48 e2 6d 83 a8 b5 47 70 67 2c 6f 28 ..D.H.m...Gpg,o( 02c0 ed 26 ca 4e 27 24 fc 5a ae 24 29 bd 8d f0 94 46 .&.N'$.Z.$)....F 02d0 3b ba 4c 80 47 f7 6b 5a e8 e1 6f b4 a6 d7 31 14 ;.L.G.kZ..o...1. 02e0 7a 67 b9 da 95 20 04 65 ae f6 82 05 4e 9c 6f 7d zg... .e....N.o} 02f0 17 a5 7a e0 73 d4 86 18 5d 2d 7b 56 43 fe 35 7c ..z.s...]-{VC.5| 0300 09 5e 41 3f b1 ef b7 ae 1d a5 e2 81 9b 57 d0 09 .^A?.........W.. 0310 17 2a 9e c1 61 37 f2 25 bf fa 4e 39 00 fa 8d 9e .*..a7.%..N9.... 0320 6e d4 6f 6d 04 26 87 c4 28 aa 00 d1 58 df f7 dd n.om.&..(...X... 0330 2d c6 d3 67 9e e3 a5 6c 12 00 56 6a c7 ff f1 f9 -..g...l..Vj.... 0340 b4 38 0c 12 71 54 ec 4a 50 c9 35 75 0d 1e 15 1e .8..qT.JP.5u.... 0350 e1 c2 63 28 4f 93 3e a2 a8 d0 e5 1b 44 df 0d 82 ..c(O.>.....D... 0360 9a f5 d9 a2 5a d7 b1 e1 d9 90 11 e9 6c 05 e2 7f ....Z.......l... 0370 e3 34 0e 38 81 3f 3c c8 9a e8 f1 c6 cf 5e 10 2c .4.8.?<......^., 0380 05 e8 99 e6 7f e3 5e ec 17 a6 43 62 a4 21 29 42 ......^...Cb.!)B 0390 cf 92 71 f2 a5 31 42 6c 2d 4c 44 ca 19 b0 07 14 ..q..1Bl-LD..... 03a0 2f 8d 7a fb ce 24 2f 84 cf da 47 65 b5 04 92 06 /.z..$/...Ge.... 03b0 6e 91 43 26 05 d4 48 be ee b8 8c 10 47 92 3a e3 n.C&..H.....G.:. 03c0 73 51 71 ce 08 71 b2 d7 f8 a3 56 54 1b 8e 80 4d sQq..q....VT...M 03d0 ef ce c2 f2 7f 79 ef f2 e1 b2 d8 d2 9a 0e 4d 9d .....y........M. 03e0 68 94 35 f5 19 bc c6 1a f0 80 46 12 a2 3e c4 bc h.5.......F..>.. 03f0 c6 80 07 4b 69 e4 be f3 84 e0 7c 53 ea b1 52 e8 ...Ki.....|S..R. 0400 27 9a 51 2a 16 f3 d7 02 61 49 e6 91 4a 82 ed a0 '.Q*....aI..J... 0410 81 ff b7 4b 61 55 1c 44 3d 63 29 a0 85 07 3a 4c ...KaU.D=c)...:L 0420 44 db 74 27 79 ba c8 34 a2 3a f0 ef 19 07 b2 c4 D.t'y..4.:...... 0430 cf 9d 7f b3 02 ef f4 ec fd 12 a2 be 65 c5 a4 47 ............e..G 0440 43 83 6c 5e 7d b2 c0 10 38 49 ec d1 5c 81 af 55 C.l^}...8I..\..U 0450 21 ba 7e a1 67 f7 e3 15 87 6b d9 e3 49 52 fb 01 !.~.g....k..IR.. 0460 39 cb a6 8f 1e ca 32 c3 db c8 39 fe a7 7f 73 e9 9.....2...9...s. 0470 3d e5 a0 62 f3 bc 8f a3 fe fa 2c 75 d9 1f e0 fe =..b......,u.... 0480 53 1e 44 87 68 5f 0b e6 06 0b 75 08 c2 6f c4 f1 S.D.h_....u..o.. 0490 1b 6c e1 14 1a 29 3b 9f 48 f8 69 b6 07 52 df a0 .l...);.H.i..R.. 04a0 4f 70 53 11 41 d9 0e a8 ab 68 01 a4 81 cb 30 81 OpS.A....h....0. 04b0 c8 a0 03 02 01 17 a2 81 c0 04 81 bd c2 6b 3f f5 .............k?. 04c0 f1 9d 07 67 54 57 6a 55 48 36 f1 ec b5 35 df c3 ...gTWjUH6...5.. 04d0 ea 21 6a d5 35 54 52 c2 79 56 7f 95 d6 80 bd e0 .!j.5TR.yV...... 04e0 20 52 c4 81 ea f1 91 8b 67 75 f7 94 10 d5 be 53 R......gu.....S 04f0 67 04 d3 10 8c 42 c0 52 4d 66 94 67 49 bd 1a 46 g....B.RMf.gI..F 0500 53 b7 bc d5 62 43 14 40 5f 63 b0 7b 93 05 a8 8c S...bC.@_c.{.... 0510 69 d7 26 ef d1 a2 7f 09 37 a5 50 48 6d c8 80 d0 i.&.....7.PHm... 0520 c7 b6 3c ae 81 25 ec 2d 2c d0 65 7b 39 7c 39 39 ..<..%.-,.e{9|99 0530 d6 c6 3e 9d 6f 30 24 55 ba 44 fd 95 5c 34 f8 8a ..>.o0$U.D..\4.. 0540 de 27 73 4a 5c c1 c4 d8 bf 9e f6 e8 af 9b 34 43 .'sJ\.........4C 0550 6f db 75 1a d7 cc eb e2 60 40 8f e9 d8 c7 da 9b o.u.....`@...... 0560 e9 f5 bd d1 32 8d e0 90 67 e8 13 10 37 c9 c6 68 ....2...g...7..h 0570 36 df 47 ba ca 76 2f 93 fe 6.G..v/.. Decrypted Krb5 (858 bytes): 0000 63 82 03 3e 30 82 03 3a a0 07 03 05 00 40 a4 00 c..>0..:.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 b6 81 ...0............ 0020 fe 0d f7 7f 42 d0 45 56 99 92 84 38 87 13 a2 1a ....B.EV...8.... 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 16 30 14 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 0d 30 0b 1b 09 77 32 6b 33 2d 31 30 .....0...w2k3-10 0060 34 24 a4 0b 30 09 a0 03 02 01 01 a1 02 04 00 a5 4$..0........... 0070 11 18 0f 32 30 30 35 30 33 30 34 30 39 34 32 32 ...2005030409422 0080 36 5a a6 11 18 0f 32 30 30 35 30 33 30 36 30 31 6Z....2005030601 0090 34 39 35 35 5a a7 11 18 0f 32 30 30 35 30 33 30 4955Z....2005030 00a0 36 31 31 30 32 34 37 5a a8 11 18 0f 32 30 30 35 6110247Z....2005 00b0 30 33 31 31 30 39 34 32 32 36 5a aa 82 02 83 30 0311094226Z....0 00c0 82 02 7f 30 82 02 7b a0 03 02 01 01 a1 82 02 72 ...0..{........r 00d0 04 82 02 6e 30 82 02 6a 30 82 02 66 a0 04 02 02 ...n0..j0..f.... 00e0 00 80 a1 82 02 5c 04 82 02 58 04 00 00 00 00 00 .....\...X...... 00f0 00 00 01 00 00 00 c0 01 00 00 48 00 00 00 00 00 ..........H..... 0100 00 00 0a 00 00 00 1c 00 00 00 08 02 00 00 00 00 ................ 0110 00 00 06 00 00 00 14 00 00 00 28 02 00 00 00 00 ..........(..... 0120 00 00 07 00 00 00 14 00 00 00 40 02 00 00 00 00 ..........@..... 0130 00 00 01 10 08 00 cc cc cc cc b0 01 00 00 00 00 ................ 0140 00 00 00 00 02 00 23 f2 e6 43 64 1d c5 01 ff ff ......#..Cd..... 0150 ff ff ff ff ff 7f ff ff ff ff ff ff ff 7f b1 56 ...............V 0160 3b 6a 5c 15 c5 01 b1 16 a5 94 25 16 c5 01 ff ff ;j\.......%..... 0170 ff ff ff ff ff 7f 12 00 12 00 04 00 02 00 00 00 ................ 0180 00 00 08 00 02 00 00 00 00 00 0c 00 02 00 00 00 ................ 0190 00 00 10 00 02 00 00 00 00 00 14 00 02 00 00 00 ................ 01a0 00 00 18 00 02 00 5f 00 00 00 e8 03 00 00 04 02 ......_......... 01b0 00 00 01 00 00 00 1c 00 02 00 20 00 00 00 00 00 .......... ..... 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 ................ 01d0 12 00 20 00 02 00 08 00 0a 00 24 00 02 00 28 00 .. .......$...(. 01e0 02 00 00 00 00 00 00 00 00 00 00 21 00 00 00 00 ...........!.... 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 01 00 00 00 2c 00 ..............,. 0210 02 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 ................ 0220 00 00 00 00 00 00 09 00 00 00 57 00 32 00 4b 00 ..........W.2.K. 0230 33 00 2d 00 31 00 30 00 34 00 24 00 00 00 00 00 3.-.1.0.4.$..... 0240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 01 00 00 00 04 02 ................ 0280 00 00 07 00 00 00 09 00 00 00 00 00 00 00 08 00 ................ 0290 00 00 57 00 32 00 4b 00 33 00 2d 00 31 00 30 00 ..W.2.K.3.-.1.0. 02a0 34 00 05 00 00 00 00 00 00 00 04 00 00 00 53 00 4.............S. 02b0 55 00 42 00 31 00 04 00 00 00 01 04 00 00 00 00 U.B.1........... 02c0 00 05 15 00 00 00 39 15 ce fd e9 c3 37 9b 6f 15 ......9.....7.o. 02d0 38 1a 01 00 00 00 30 00 02 00 07 00 00 00 01 00 8.....0......... 02e0 00 00 01 01 00 00 00 00 00 05 09 00 00 00 00 00 ................ 02f0 00 00 00 6d 2f 79 9e 20 c5 01 12 00 77 00 32 00 ...m/y. ....w.2. 0300 6b 00 33 00 2d 00 31 00 30 00 34 00 24 00 00 00 k.3.-.1.0.4.$... 0310 00 00 76 ff ff ff 50 7e be ef 12 28 55 36 dd b6 ..v...P~...(U6.. 0320 6f 1a 2c 1a 37 f0 00 00 00 00 76 ff ff ff a8 6a o.,.7.....v....j 0330 b2 f8 b0 b2 a3 51 6a bb 24 ee fe c8 75 9a 00 00 .....Qj.$...u... 0340 00 00 76 ff 31 00 00 00 d8 c9 5e 08 f0 57 1b 41 ..v.1.....^..W.A 0350 24 ee fe c8 75 9a 00 00 00 00 $...u..... Decrypted Krb5 (189 bytes): 0000 62 81 a2 30 81 9f a0 03 02 01 05 a1 1a 1b 18 53 b..0...........S 0010 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 2e UB1.W2K3.VMNET1. 0020 56 4d 2e 42 41 53 45 a2 16 30 14 a0 03 02 01 01 VM.BASE..0...... 0030 a1 0d 30 0b 1b 09 77 32 6b 33 2d 31 30 34 24 a3 ..0...w2k3-104$. 0040 25 30 23 a0 05 02 03 00 80 03 a1 1a 04 18 10 00 %0#............. 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 3e 10 00 00 a4 05 02 03 04 a4 30 a5 11 18 ..>.........0... 0070 0f 32 30 30 35 30 33 30 36 30 39 30 38 35 30 5a .20050306090850Z 0080 a6 1b 30 19 a0 03 02 01 17 a1 12 04 10 e0 2f cc ..0.........../. 0090 4e b4 28 79 8d 76 80 05 8d 8d c9 b3 31 a7 06 02 N.(y.v......1... 00a0 04 1d fe f0 46 e0 2f cc 4e b4 28 79 29 00 00 00 ....F./.N.(y)... 00b0 00 a4 5d 08 e8 57 1b 41 04 1d fe f0 46 ..]..W.A....F No. Time Source Destination Protocol Info 15 8.598999 172.31.1.101 172.31.1.104 DCERPC Bind_ack: call_id: 1660 accept max_xmit: 5840 max_recv: 5840 Frame 15 (240 bytes on wire, 240 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 1, Ack: 1348, Len: 186 DCE RPC Frame (240 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e2 2d 4f 40 00 80 06 71 bb ac 1f 01 65 ac 1f ..-O@...q....e.. 0020 01 68 04 01 07 cb fd 8c 8b 99 05 7f 61 9c 50 18 .h..........a.P. 0030 f5 ad 3f b3 00 00 05 00 0c 07 10 00 00 00 ba 00 ..?............. 0040 76 00 7c 06 00 00 d0 16 d0 16 3f 0e 01 00 05 00 v.|.......?..... 0050 31 30 32 35 00 00 01 00 00 00 00 00 00 00 04 5d 1025...........] 0060 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 ..........+.H`.. 0070 00 00 10 06 00 00 01 00 00 00 6f 74 30 72 a0 03 ..........ot0r.. 0080 02 01 05 a1 03 02 01 0f a2 66 30 64 a0 03 02 01 .........f0d.... 0090 17 a2 5d 04 5b e0 30 eb 73 85 b1 8d bb 3c 3e 6d ..].[.0.s....<>m 00a0 4e cb 29 73 14 8c 3b c7 e0 b1 fe 34 57 6f 46 c8 N.)s..;....4WoF. 00b0 94 56 b1 24 8c ae bf 55 15 bc 75 a5 f6 4a 85 a4 .V.$...U..u..J.. 00c0 07 99 40 70 32 16 52 e9 f4 84 12 7e f4 19 39 ca ..@p2.R....~..9. 00d0 20 be bc a0 3e ac 48 e0 57 0d 4a b5 62 54 7e 30 ...>.H.W.J.bT~0 00e0 33 4e 09 ca d1 5d c9 91 bc ff 5a 18 04 cc 00 47 3N...]....Z....G Decrypted Krb5 (91 bytes): 0000 7b 41 30 3f a0 11 18 0f 32 30 30 35 30 33 30 36 {A0?....20050306 0010 30 39 30 38 35 30 5a a1 05 02 03 04 a4 30 a2 1b 090850Z......0.. 0020 30 19 a0 03 02 01 17 a1 12 04 10 e0 2f cc 4e b4 0.........../.N. 0030 28 79 8d 76 80 05 8d 8d c9 b3 31 a3 06 02 04 1d (y.v......1..... 0040 f6 5f e1 e0 19 00 00 00 f0 53 5e 08 65 20 28 32 ._.......S^.e (2 0050 34 30 20 62 79 74 65 73 29 3a 00 40 bytes):. No. Time Source Destination Protocol Info 16 8.603587 172.31.1.104 172.31.1.101 DCERPC Alter_context: call_id: 1660 UUID: DRSUAPI Frame 16 (223 bytes on wire, 223 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1348, Ack: 187, Len: 169 DCE RPC Frame (223 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 d1 db 92 40 00 80 06 c3 88 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 cb 04 01 05 7f 61 9c fd 8c 8c 53 50 18 .e......a....SP. 0030 fa 36 f8 fa 00 00 05 00 0e 03 10 00 00 00 a9 00 .6.............. 0040 59 00 7c 06 00 00 d0 16 d0 16 3f 0e 01 00 01 00 Y.|.......?..... 0050 00 00 00 00 01 00 35 42 51 e3 06 4b d1 11 ab 04 ......5BQ..K.... 0060 00 c0 4f c2 dc d2 04 00 00 00 04 5d 88 8a eb 1c ..O........].... 0070 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 10 06 ......+.H`...... 0080 00 00 01 00 00 00 6f 57 30 55 a0 03 02 01 05 a1 ......oW0U...... 0090 03 02 01 0f a2 49 30 47 a0 03 02 01 17 a2 40 04 .....I0G......@. 00a0 3e d4 aa a4 de f0 58 49 be d1 91 30 82 a2 25 86 >.....XI...0..%. 00b0 51 08 df df b1 de 08 b1 40 62 eb 5b d1 b8 bd 1f Q.......@b.[.... 00c0 c8 18 2a 55 fd 9b c0 a5 c8 09 3d 67 8f 6b 03 85 ..*U......=g.k.. 00d0 94 5e bf 46 b2 b8 b5 bc 08 ef 55 6a 31 74 cb .^.F......Uj1t. Decrypted Krb5 (62 bytes): 0000 7b 24 30 22 a0 11 18 0f 32 30 30 35 30 33 30 36 {$0"....20050306 0010 30 39 30 38 35 30 5a a1 05 02 03 04 e1 39 a3 06 090850Z......9.. 0020 02 04 1d f6 5f e1 30 36 30 39 30 38 19 00 00 00 ...._.060908.... 0030 e0 85 5e 08 e1 39 a3 06 02 04 1d f6 5f e1 ..^..9......_. No. Time Source Destination Protocol Info 17 8.604951 172.31.1.101 172.31.1.104 DCERPC Alter_context_resp: call_id: 1660 accept max_xmit: 5840 max_recv: 5840 Frame 17 (118 bytes on wire, 118 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 187, Ack: 1517, Len: 64 DCE RPC 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 68 2d 50 40 00 80 06 72 34 ac 1f 01 65 ac 1f .h-P@...r4...e.. 0020 01 68 04 01 07 cb fd 8c 8c 53 05 7f 62 45 50 18 .h.......S..bEP. 0030 fa f0 fa 33 00 00 05 00 0f 03 10 00 00 00 40 00 ...3..........@. 0040 00 00 7c 06 00 00 d0 16 d0 16 3f 0e 01 00 00 00 ..|.......?..... 0050 31 30 01 00 00 00 00 00 00 00 04 5d 88 8a eb 1c 10.........].... 0060 c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 10 06 ......+.H`...... 0070 00 00 01 00 00 00 ...... No. Time Source Destination Protocol Info 18 8.613235 172.31.1.104 172.31.1.101 DRSUAPI DRSReplicaSync request Frame 18 (339 bytes on wire, 339 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1517, Ack: 251, Len: 285 DCE RPC Microsoft Directory Replication Service, DRSReplicaSync 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 45 db 93 40 00 80 06 c3 13 ac 1f 01 68 ac 1f .E..@........h.. 0020 01 65 07 cb 04 01 05 7f 62 45 fd 8c 8c 93 50 18 .e......bE....P. 0030 f9 f6 0e 0a 00 00 05 00 00 03 10 00 00 00 1d 01 ................ 0040 2d 00 7c 06 00 00 c4 00 00 00 00 00 02 00 79 0b -.|...........y. 0050 c4 e7 27 e6 f0 74 29 f4 56 a5 e2 2b 30 72 bd 42 ..'..t).V..+0r.B 0060 f7 98 a9 e6 06 f9 a0 77 0d 4f bd d6 13 35 e4 6e .......w.O...5.n 0070 ea 31 9a ce d9 46 2a e6 03 4f 82 2c b0 5d 62 fb .1...F*..O.,.]b. 0080 78 05 54 1a 81 cd 22 7e 75 67 54 94 6d ce e7 78 x.T..."~ugT.m..x 0090 ee 80 6b 2b 95 04 cf 64 6e e5 7b a9 cc 31 45 9a ..k+...dn.{..1E. 00a0 2a 24 30 e8 00 ad 13 7e be ec 89 03 cd 11 68 5a *$0....~......hZ 00b0 08 06 7d 7b 28 3d d3 c8 03 75 e1 d8 9a 44 df 88 ..}{(=...u...D.. 00c0 c6 4c 87 76 05 e3 fa 6e 31 71 b9 ff 81 f2 10 c5 .L.v...n1q...... 00d0 2f 82 bd 68 2f 86 4e d6 99 84 31 72 c2 82 46 45 /..h/.N...1r..FE 00e0 56 ae ce cd 4a 8a 21 67 d7 b3 0a 7e b6 7d 18 e6 V...J.!g...~.}.. 00f0 0b 0c 50 20 86 d7 f4 b9 93 79 98 9a fa 6a 72 94 ..P .....y...jr. 0100 80 6c 25 e3 9b 22 51 32 e5 d3 4b 30 52 89 96 cd .l%.."Q2..K0R... 0110 c0 1a a4 b1 6e 99 f9 37 7f 92 b5 b2 22 cc 10 06 ....n..7...."... 0120 0c 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0130 01 02 02 02 01 11 00 10 00 ff ff 59 dc 5c 98 63 ...........Y.\.c 0140 a8 7b ca 13 41 08 e8 00 1a 37 8d cc 26 38 71 de .{..A....7..&8q. 0150 27 f8 c7 '.. No. Time Source Destination Protocol Info 19 8.614869 172.31.1.101 172.31.1.104 DRSUAPI DRSReplicaSync response Frame 19 (147 bytes on wire, 147 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 251, Ack: 1802, Len: 93 DCE RPC Microsoft Directory Replication Service, DRSReplicaSync 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 85 2d 51 40 00 80 06 72 16 ac 1f 01 65 ac 1f ..-Q@...r....e.. 0020 01 68 04 01 07 cb fd 8c 8c 93 05 7f 63 62 50 18 .h..........cbP. 0030 f9 d3 4e c0 00 00 05 00 02 03 10 00 00 00 5d 00 ..N...........]. 0040 2d 00 7c 06 00 00 04 00 00 00 00 00 00 00 23 05 -.|...........#. 0050 5e 2c d3 46 11 ee f0 e8 f2 1d cb 81 89 20 10 06 ^,.F......... .. 0060 0c 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0070 01 02 02 02 01 11 00 10 00 ff ff b9 c2 83 5f a2 .............._. 0080 79 a9 2a 00 7f 89 78 36 88 ed fb 04 82 0d 6e 5f y.*...x6......n_ 0090 0e c1 1b ... No. Time Source Destination Protocol Info 20 8.616889 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 20 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: 1147 (1147), Dst Port: blackjack (1025), Seq: 0, Ack: 0, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d 52 40 00 80 06 6c be ac 1f 01 65 ac 1f ..-R@...l....e.. 0020 01 68 04 7b 04 01 b5 9c 2c 40 70 f0 0d 4d 50 10 .h.{....,@p..MP. 0030 fa f0 4b a9 00 00 05 00 00 03 10 00 00 00 6d 07 ..K...........m. 0040 2d 00 83 1d 00 00 11 07 00 00 00 00 03 00 98 25 -..............% 0050 3c 51 cb b0 db 31 b7 ef 52 0f e9 e6 05 27 a9 a9 (,Q2........_ 0400 f5 04 10 14 b5 df a5 a8 58 b5 ce 32 7a 70 7c 75 ........X..2zp|u 0410 3e 11 19 13 ac 01 d6 1d 2e 92 2b 15 85 57 57 ce >.........+..WW. 0420 e3 e0 60 8b 64 71 6f 9e f2 44 da 8c 90 bf 8d 78 ..`.dqo..D.....x 0430 ee b3 8a 46 b4 c8 a3 fc ec 8c cf f4 37 8e c9 c9 ...F........7... 0440 f7 97 60 90 32 27 27 16 18 ba 84 68 bc 22 d3 11 ..`.2''....h.".. 0450 dd fe 93 b2 8e d5 fa 1c e0 46 ce b4 20 f5 13 ec .........F.. ... 0460 77 3e b3 f7 a3 1d 4e bc 1d 6d 28 02 1a d0 15 10 w>....N..m(..... 0470 3a 5e 3d 2e da 13 19 a1 fc 77 be 71 52 da bf 2c :^=......w.qR.., 0480 ae 5d 33 a6 09 dc 2a 5e 84 35 2a 15 98 cf 41 7e .]3...*^.5*...A~ 0490 bb 35 e5 11 26 d9 3a d2 c7 67 67 2e 30 c3 76 84 .5..&.:..gg.0.v. 04a0 26 58 7f 2e 0e 9d c7 ec 54 3e 94 4d bb e3 1b 20 &X......T>.M... 04b0 19 f8 44 7a a9 71 6b 0a 69 7a 3f 41 6d 15 63 a3 ..Dz.qk.iz?Am.c. 04c0 45 83 9b ca 40 ef 94 98 99 06 7f 65 5d 1e 3a e0 E...@......e].:. 04d0 1a 73 c1 88 89 a8 1d 07 0e b0 21 e7 61 da c7 6d .s........!.a..m 04e0 23 9d 84 76 9c 28 99 bc 2f 0e 6a 42 cd df 91 50 #..v.(../.jB...P 04f0 05 92 57 5a 39 b5 a5 81 b8 23 94 cd 90 d7 6e 00 ..WZ9....#....n. 0500 5e a3 6c 3d 49 e2 5f fc 18 2b 57 77 02 d6 4e d0 ^.l=I._..+Ww..N. 0510 ed 5d 1f 75 80 b9 31 8a 3a ce 44 14 c8 4d c6 2b .].u..1.:.D..M.+ 0520 e9 26 79 d9 04 bd de 73 c1 15 07 a1 96 d8 29 6e .&y....s......)n 0530 b3 37 2f 92 d5 ec d4 f5 b3 bd a2 89 96 a9 79 e6 .7/...........y. 0540 5e e3 8a b9 89 5b f5 bf 9e 93 a0 61 0e 94 2b 8b ^....[.....a..+. 0550 35 2b 64 ec c6 2a e2 ac a8 70 3a 29 8f 26 23 4e 5+d..*...p:).&#N 0560 7b 27 a3 61 09 5f 9f 4a a9 f2 e1 26 60 61 21 54 {'.a._.J...&`a!T 0570 92 48 37 37 f3 bf 1c 93 39 27 cd a9 b3 70 14 36 .H77....9'...p.6 0580 b0 ea 06 a9 28 d2 57 77 df f3 8e ba eb 0f a1 7b ....(.Ww.......{ 0590 1c 4e 36 06 e5 3d 86 71 51 83 d7 12 2e 61 34 d4 .N6..=.qQ....a4. 05a0 c8 e8 d5 65 20 e1 2d 9c 32 7e 83 34 5c ff 8b 9e ...e .-.2~.4\... 05b0 1d 26 af 3a a0 be 6a 84 89 37 ea 5e ca 46 21 0a .&.:..j..7.^.F!. 05c0 2f 1c 2b 08 51 17 fd d7 72 6b ef 64 e1 d5 f0 a2 /.+.Q...rk.d.... 05d0 9b 9f 9b 78 0b 67 b8 4b 25 fd 98 b6 be 0f 05 56 ...x.g.K%......V 05e0 23 5c ca c1 5d b9 7e 00 ad 53 #\..].~..S No. Time Source Destination Protocol Info 21 8.617256 172.31.1.101 172.31.1.104 DCERPC Request: call_id: 7555 opnum: 3 ctx_id: 0 Frame 21 (495 bytes on wire, 495 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: 1147 (1147), Dst Port: blackjack (1025), Seq: 1460, Ack: 0, Len: 441 DCE RPC Frame (495 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 e1 2d 53 40 00 80 06 70 b8 ac 1f 01 65 ac 1f ..-S@...p....e.. 0020 01 68 04 7b 04 01 b5 9c 31 f4 70 f0 0d 4d 50 18 .h.{....1.p..MP. 0030 fa f0 88 d8 00 00 45 4b cd 37 36 9d ed 36 eb 7a ......EK.76..6.z 0040 1c af 6b fd f1 1c 39 a5 67 74 4a 4c 1b 3a 19 1d ..k...9.gtJL.:.. 0050 fc 39 89 6f 22 38 59 15 73 3e 17 5f 3b 14 c2 fa .9.o"8Y.s>._;... 0060 bd 68 f2 05 b6 75 bd 63 03 39 21 9f ba 5b 7a 21 .h...u.c.9!..[z! 0070 65 fb b0 f8 78 52 f4 51 a4 26 da 56 c3 96 e6 05 e...xR.Q.&.V.... 0080 3f cb a0 c6 22 f8 98 dd 19 e5 35 ae 84 41 21 f1 ?...".....5..A!. 0090 34 db e8 2e 49 4b cb a9 11 08 f6 64 0d 9a 4c d2 4...IK.....d..L. 00a0 ec a6 6b 6e 58 96 f9 0c 9e 0d 94 0d 06 81 3c 53 ..knX.........{.....{...e. 0100 7d 2a c5 f4 be 06 e6 60 1b 0b 27 c3 8d b6 bc b6 }*.....`..'..... 0110 7b 58 03 dc 9e bc a5 34 a0 d2 14 4c c4 b2 ff 9e {X.....4...L.... 0120 af f8 f5 ac 8f 4e ef 7b 3d 1e 2a b6 4d 91 ff 8b .....N.{=.*.M... 0130 0e 56 51 44 34 7e 6a 37 1c 89 b1 ca 99 23 a0 a5 .VQD4~j7.....#.. 0140 08 8b e0 02 c2 90 4c 40 98 d8 fb 2c 44 e2 36 dc ......L@...,D.6. 0150 a1 62 02 b3 33 15 9d c6 b4 93 04 42 77 d9 a5 a8 .b..3......Bw... 0160 1f ee 99 5b 35 c9 9a 04 03 1a f9 77 24 db 63 3b ...[5......w$.c; 0170 67 eb a1 f4 08 ba a7 3e 64 73 e8 f4 04 cc 10 34 g......>ds.....4 0180 bd 90 c7 f9 a6 3b be 63 b6 f4 8b bc 5e 30 c1 c0 .....;.c....^0.. 0190 4d c0 66 79 05 b8 3a 5e 57 6a f6 c0 3e 7b 64 5c M.fy..:^Wj..>{d\ 01a0 48 4f 46 80 08 cf 31 25 07 8b e0 63 58 c1 c9 6d HOF...1%...cX..m 01b0 aa 22 40 d9 fe 23 34 ea 0d 37 10 06 0f 00 01 00 ."@..#4..7...... 01c0 00 00 60 2b 06 09 2a 86 48 86 f7 12 01 02 02 02 ..`+..*.H....... 01d0 01 11 00 10 00 ff ff bc 65 13 8b 69 27 d7 f8 c2 ........e..i'... 01e0 0b 7e a8 80 c4 10 35 3b e3 bf c7 d8 85 78 df .~....5;.....x. Reassembled TCP (1901 bytes): 0000 05 00 00 03 10 00 00 00 6d 07 2d 00 83 1d 00 00 ........m.-..... 0010 11 07 00 00 00 00 03 00 98 25 3c 51 cb b0 db 31 .........%(,Q 03c0 32 c5 14 b3 d9 0b f8 b9 e1 5f f5 04 10 14 b5 df 2........_...... 03d0 a5 a8 58 b5 ce 32 7a 70 7c 75 3e 11 19 13 ac 01 ..X..2zp|u>..... 03e0 d6 1d 2e 92 2b 15 85 57 57 ce e3 e0 60 8b 64 71 ....+..WW...`.dq 03f0 6f 9e f2 44 da 8c 90 bf 8d 78 ee b3 8a 46 b4 c8 o..D.....x...F.. 0400 a3 fc ec 8c cf f4 37 8e c9 c9 f7 97 60 90 32 27 ......7.....`.2' 0410 27 16 18 ba 84 68 bc 22 d3 11 dd fe 93 b2 8e d5 '....h."........ 0420 fa 1c e0 46 ce b4 20 f5 13 ec 77 3e b3 f7 a3 1d ...F.. ...w>.... 0430 4e bc 1d 6d 28 02 1a d0 15 10 3a 5e 3d 2e da 13 N..m(.....:^=... 0440 19 a1 fc 77 be 71 52 da bf 2c ae 5d 33 a6 09 dc ...w.qR..,.]3... 0450 2a 5e 84 35 2a 15 98 cf 41 7e bb 35 e5 11 26 d9 *^.5*...A~.5..&. 0460 3a d2 c7 67 67 2e 30 c3 76 84 26 58 7f 2e 0e 9d :..gg.0.v.&X.... 0470 c7 ec 54 3e 94 4d bb e3 1b 20 19 f8 44 7a a9 71 ..T>.M... ..Dz.q 0480 6b 0a 69 7a 3f 41 6d 15 63 a3 45 83 9b ca 40 ef k.iz?Am.c.E...@. 0490 94 98 99 06 7f 65 5d 1e 3a e0 1a 73 c1 88 89 a8 .....e].:..s.... 04a0 1d 07 0e b0 21 e7 61 da c7 6d 23 9d 84 76 9c 28 ....!.a..m#..v.( 04b0 99 bc 2f 0e 6a 42 cd df 91 50 05 92 57 5a 39 b5 ../.jB...P..WZ9. 04c0 a5 81 b8 23 94 cd 90 d7 6e 00 5e a3 6c 3d 49 e2 ...#....n.^.l=I. 04d0 5f fc 18 2b 57 77 02 d6 4e d0 ed 5d 1f 75 80 b9 _..+Ww..N..].u.. 04e0 31 8a 3a ce 44 14 c8 4d c6 2b e9 26 79 d9 04 bd 1.:.D..M.+.&y... 04f0 de 73 c1 15 07 a1 96 d8 29 6e b3 37 2f 92 d5 ec .s......)n.7/... 0500 d4 f5 b3 bd a2 89 96 a9 79 e6 5e e3 8a b9 89 5b ........y.^....[ 0510 f5 bf 9e 93 a0 61 0e 94 2b 8b 35 2b 64 ec c6 2a .....a..+.5+d..* 0520 e2 ac a8 70 3a 29 8f 26 23 4e 7b 27 a3 61 09 5f ...p:).&#N{'.a._ 0530 9f 4a a9 f2 e1 26 60 61 21 54 92 48 37 37 f3 bf .J...&`a!T.H77.. 0540 1c 93 39 27 cd a9 b3 70 14 36 b0 ea 06 a9 28 d2 ..9'...p.6....(. 0550 57 77 df f3 8e ba eb 0f a1 7b 1c 4e 36 06 e5 3d Ww.......{.N6..= 0560 86 71 51 83 d7 12 2e 61 34 d4 c8 e8 d5 65 20 e1 .qQ....a4....e . 0570 2d 9c 32 7e 83 34 5c ff 8b 9e 1d 26 af 3a a0 be -.2~.4\....&.:.. 0580 6a 84 89 37 ea 5e ca 46 21 0a 2f 1c 2b 08 51 17 j..7.^.F!./.+.Q. 0590 fd d7 72 6b ef 64 e1 d5 f0 a2 9b 9f 9b 78 0b 67 ..rk.d.......x.g 05a0 b8 4b 25 fd 98 b6 be 0f 05 56 23 5c ca c1 5d b9 .K%......V#\..]. 05b0 7e 00 ad 53 45 4b cd 37 36 9d ed 36 eb 7a 1c af ~..SEK.76..6.z.. 05c0 6b fd f1 1c 39 a5 67 74 4a 4c 1b 3a 19 1d fc 39 k...9.gtJL.:...9 05d0 89 6f 22 38 59 15 73 3e 17 5f 3b 14 c2 fa bd 68 .o"8Y.s>._;....h 05e0 f2 05 b6 75 bd 63 03 39 21 9f ba 5b 7a 21 65 fb ...u.c.9!..[z!e. 05f0 b0 f8 78 52 f4 51 a4 26 da 56 c3 96 e6 05 3f cb ..xR.Q.&.V....?. 0600 a0 c6 22 f8 98 dd 19 e5 35 ae 84 41 21 f1 34 db ..".....5..A!.4. 0610 e8 2e 49 4b cb a9 11 08 f6 64 0d 9a 4c d2 ec a6 ..IK.....d..L... 0620 6b 6e 58 96 f9 0c 9e 0d 94 0d 06 81 3c 53 50 e6 knX.........{.....{...e.}* 0680 c5 f4 be 06 e6 60 1b 0b 27 c3 8d b6 bc b6 7b 58 .....`..'.....{X 0690 03 dc 9e bc a5 34 a0 d2 14 4c c4 b2 ff 9e af f8 .....4...L...... 06a0 f5 ac 8f 4e ef 7b 3d 1e 2a b6 4d 91 ff 8b 0e 56 ...N.{=.*.M....V 06b0 51 44 34 7e 6a 37 1c 89 b1 ca 99 23 a0 a5 08 8b QD4~j7.....#.... 06c0 e0 02 c2 90 4c 40 98 d8 fb 2c 44 e2 36 dc a1 62 ....L@...,D.6..b 06d0 02 b3 33 15 9d c6 b4 93 04 42 77 d9 a5 a8 1f ee ..3......Bw..... 06e0 99 5b 35 c9 9a 04 03 1a f9 77 24 db 63 3b 67 eb .[5......w$.c;g. 06f0 a1 f4 08 ba a7 3e 64 73 e8 f4 04 cc 10 34 bd 90 .....>ds.....4.. 0700 c7 f9 a6 3b be 63 b6 f4 8b bc 5e 30 c1 c0 4d c0 ...;.c....^0..M. 0710 66 79 05 b8 3a 5e 57 6a f6 c0 3e 7b 64 5c 48 4f fy..:^Wj..>{d\HO 0720 46 80 08 cf 31 25 07 8b e0 63 58 c1 c9 6d aa 22 F...1%...cX..m." 0730 40 d9 fe 23 34 ea 0d 37 10 06 0f 00 01 00 00 00 @..#4..7........ 0740 60 2b 06 09 2a 86 48 86 f7 12 01 02 02 02 01 11 `+..*.H......... 0750 00 10 00 ff ff bc 65 13 8b 69 27 d7 f8 c2 0b 7e ......e..i'....~ 0760 a8 80 c4 10 35 3b e3 bf c7 d8 85 78 df ....5;.....x. No. Time Source Destination Protocol Info 22 8.618330 172.31.1.104 172.31.1.101 TCP blackjack > 1147 [ACK] Seq=0 Ack=1901 Win=64240 Len=0 Frame 22 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: 1147 (1147), Seq: 0, Ack: 1901, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 db 94 40 00 80 06 c4 2f ac 1f 01 68 ac 1f .(..@..../...h.. 0020 01 65 04 01 04 7b 70 f0 0d 4d b5 9c 33 ad 50 10 .e...{p..M..3.P. 0030 fa f0 e9 d4 00 00 05 00 00 03 10 00 ............ No. Time Source Destination Protocol Info 23 8.645413 172.31.1.104 172.31.1.101 DCERPC Response: call_id: 7555 ctx_id: 0 Frame 23 (1331 bytes on wire, 1331 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: 1147 (1147), Seq: 0, Ack: 1901, Len: 1277 DCE RPC 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 25 db 95 40 00 80 06 bf 31 ac 1f 01 68 ac 1f .%..@....1...h.. 0020 01 65 04 01 04 7b 70 f0 0d 4d b5 9c 33 ad 50 18 .e...{p..M..3.P. 0030 fa f0 7f 57 00 00 05 00 02 03 10 00 00 00 fd 04 ...W............ 0040 2d 00 83 1d 00 00 a8 04 00 00 00 00 00 00 4c 73 -.............Ls 0050 3d 77 3e 32 a7 30 d4 9c 56 4b f6 fb fa c1 61 62 =w>2.0..VK....ab 0060 56 11 c8 b2 e9 78 73 48 96 54 f6 d4 64 78 1e 3d V....xsH.T..dx.= 0070 1d f1 d4 f4 45 0c 4e f9 f9 fa 59 86 fc 0c 0b 08 ....E.N...Y..... 0080 a4 f7 54 d9 d6 9c ee 49 1f 99 99 b0 dc d8 28 76 ..T....I......(v 0090 57 ba 6f 69 6f ad 99 51 4a 15 a6 10 f1 b0 07 f9 W.oio..QJ....... 00a0 00 ea f5 d4 1a fd f8 90 88 ea f8 fb c4 6e 49 ba .............nI. 00b0 cb 36 00 f8 33 81 77 ff f0 bf e7 c0 45 02 d1 1c .6..3.w.....E... 00c0 8a 71 92 63 5d 5a cf 5e 35 1e 42 34 0b 01 46 38 .q.c]Z.^5.B4..F8 00d0 da 9d b7 86 c6 3a 5d 80 da 85 00 87 41 14 b7 ad .....:].....A... 00e0 d1 f8 50 4a c3 ff 60 51 e5 ee 72 6f 29 65 4d c8 ..PJ..`Q..ro)eM. 00f0 15 b0 0a dc 03 d9 54 5e 04 ea e6 df 0b fb a0 33 ......T^.......3 0100 03 4e f6 2d 31 07 ed 25 58 1d c2 2c 92 2f 9f a0 .N.-1..%X..,./.. 0110 f3 46 ac 57 b7 bf fe ad 36 fa c1 a9 0b cd d5 02 .F.W....6....... 0120 1a 14 4a 99 b2 f9 1c 39 bc 14 8d 5f 06 84 55 da ..J....9..._..U. 0130 27 46 40 e2 f7 e1 b3 6f 9b 8b 0f 6f 4f 41 55 f5 'F@....o...oOAU. 0140 65 e5 e0 b6 d5 bf ba d0 2e 86 11 ab 00 86 43 0a e.............C. 0150 3f cc b9 af 45 78 af 44 66 5a 4b 81 cf a0 e6 ed ?...Ex.DfZK..... 0160 23 1d 44 58 10 a7 6e 85 02 c6 3e 23 28 ad b8 56 #.DX..n...>#(..V 0170 ba 19 9b db 33 2b 90 45 fe 58 07 8f cc e0 79 c9 ....3+.E.X....y. 0180 b3 7a 7e e2 db 0b 77 12 ed c3 11 46 90 b3 69 b6 .z~...w....F..i. 0190 26 4a 04 32 4a 56 fa 99 0a ff a5 c4 01 4d 7d 15 &J.2JV.......M}. 01a0 e2 6c 1b 60 cf 1a 67 07 7f 2e 2b dd eb 72 00 17 .l.`..g...+..r.. 01b0 d6 47 fa c5 18 d4 0f 7d 2f 04 a6 90 f1 8e 86 59 .G.....}/......Y 01c0 48 74 ad e9 f9 00 03 a3 52 a5 d3 34 24 7b a5 19 Ht......R..4${.. 01d0 9b 5d 0d bb d4 06 b7 8a c7 89 cf 70 77 9d 37 0f .].........pw.7. 01e0 59 3d 81 90 e0 64 59 0c 34 16 d6 c1 15 8e 93 5f Y=...dY.4......_ 01f0 fc 87 9a 78 81 da 01 55 ce b8 97 1b 7f 6d 57 5a ...x...U.....mWZ 0200 42 c0 71 47 e4 7d c7 79 a1 24 1d 89 94 f0 dd ba B.qG.}.y.$...... 0210 ff 3a 72 22 93 6b 52 ac e5 88 7f 02 05 27 a2 1f .:r".kR......'.. 0220 bc 62 76 25 16 c2 92 a3 0a 53 24 71 01 3c 7c ff .bv%.....S$q.<|. 0230 59 5a 99 05 7f 06 af 91 6f 6c 8e 75 e6 58 5c c4 YZ......ol.u.X\. 0240 36 0d a4 ab e1 6e 15 2f a4 24 b9 88 50 79 ba 70 6....n./.$..Py.p 0250 73 01 e0 12 df 4c d5 de 56 28 a7 93 cd 86 eb e0 s....L..V(...... 0260 7d 6b 64 b0 73 f3 4e 73 d5 0c cf ac bb f3 22 03 }kd.s.Ns......". 0270 a1 aa 24 93 9e b1 07 c8 42 5f 84 b1 b9 6b 52 d9 ..$.....B_...kR. 0280 d0 80 1e f9 45 e6 39 b8 f7 65 8d c0 20 08 5f d9 ....E.9..e.. ._. 0290 c0 7c 05 67 91 76 85 50 17 ad 15 17 6f 28 28 97 .|.g.v.P....o((. 02a0 a9 50 47 e8 a8 e0 8e 43 8a 14 c4 36 17 a1 20 4c .PG....C...6.. L 02b0 b4 fa 82 58 ad 67 d3 c6 15 d0 02 49 77 07 45 e4 ...X.g.....Iw.E. 02c0 14 22 f7 38 98 eb a4 4c 9e 82 1a 68 b5 00 38 65 .".8...L...h..8e 02d0 30 c6 65 6a 9f 34 f6 c9 1b a1 95 83 2c 10 d9 60 0.ej.4......,..` 02e0 7b 1b cd 79 ef 63 4c 78 cc 36 3f 01 50 5d cc ca {..y.cLx.6?.P].. 02f0 73 41 20 36 fe 96 72 93 86 5d 8c c6 6c ba b1 3e sA 6..r..]..l..> 0300 9f 75 25 10 63 10 93 fb 6e 31 c7 c5 65 ad 70 04 .u%.c...n1..e.p. 0310 3f e5 61 a9 cb 18 75 60 6b 7e be 3e e8 6b 9c 03 ?.a...u`k~.>.k.. 0320 4d 1b f7 b0 27 b6 dd 8c 2f 2f 83 39 42 98 ca ac M...'...//.9B... 0330 4e bf e7 25 ad fb a5 d3 33 4e d8 48 70 61 fe 2f N..%....3N.Hpa./ 0340 4b 1f 5e 48 6a f1 ee 9f 3f 33 c3 13 7b fd d4 29 K.^Hj...?3..{..) 0350 51 a3 c2 9e a4 1d bd 8e 37 26 4c f9 8a f1 db d1 Q.......7&L..... 0360 93 87 12 26 d8 8d e2 77 28 5f d9 e4 40 13 c0 c5 ...&...w(_..@... 0370 07 e7 1b b3 21 71 08 69 f8 fb b1 36 e5 bd b3 54 ....!q.i...6...T 0380 42 1a bc 59 48 96 dd 0f 72 b7 14 7c 60 a9 93 52 B..YH...r..|`..R 0390 93 f5 da a6 c3 fb 76 01 ab 17 09 00 4d 7e 04 9f ......v.....M~.. 03a0 40 ce 1b 6d 52 9e 24 39 15 f8 64 c9 1c 95 30 15 @..mR.$9..d...0. 03b0 aa 39 86 ff 2b cf da ae ab 28 3e b0 a6 9b b1 63 .9..+....(>....c 03c0 3e 9b 15 90 cc 33 b2 2e 74 9a d9 72 0b 97 63 e9 >....3..t..r..c. 03d0 9d e6 4e 3f 75 73 ee fb f2 de b1 1c 51 47 3e 20 ..N?us......QG> 03e0 ae d9 45 b1 bf 2e 5b 07 07 3f 99 05 96 45 cd e2 ..E...[..?...E.. 03f0 06 ad 50 03 b7 1d c7 a4 ab b0 53 4e b3 44 be b2 ..P.......SN.D.. 0400 9d 4c 3b 2d 1f de 2b e8 de c2 ec 02 a5 40 10 f7 .L;-..+......@.. 0410 cd df bb da 34 34 c1 0d e7 3f 02 25 55 7a 1a 22 ....44...?.%Uz." 0420 15 71 5e e3 72 24 5e e2 99 81 11 1b 2f e1 de 0e .q^.r$^...../... 0430 1e 2b b0 31 0c ef e4 27 03 dc 91 96 ed 8f 17 5c .+.1...'.......\ 0440 ed 18 d2 29 e7 54 99 aa ac e1 5b 70 94 f3 4a 78 ...).T....[p..Jx 0450 e9 ca 71 cc d1 6f 28 63 5a 88 7b 41 c5 30 c2 d7 ..q..o(cZ.{A.0.. 0460 aa fc 6d ee fd 82 98 1e 95 05 c2 e0 c5 de 30 3b ..m...........0; 0470 0b 9f 0e ce 6a ff 10 58 2b d9 c9 af 30 c5 a1 96 ....j..X+...0... 0480 70 5a 12 ef c8 7b 36 cb 12 63 9c 4c 15 1e da 31 pZ...{6..c.L...1 0490 d8 89 42 d6 56 92 48 3e 19 c4 01 19 19 fb e6 93 ..B.V.H>........ 04a0 4c 4b 16 a5 02 80 14 aa 93 1c 08 f9 1f f8 09 56 LK.............V 04b0 72 a7 05 65 8d ba f1 66 a7 da 53 c6 0f 95 e5 f8 r..e...f..S..... 04c0 7f f0 80 e6 dd d0 52 4d df 73 75 62 f4 26 d0 45 ......RM.sub.&.E 04d0 0c a7 71 fd 6c 66 4c 04 87 b2 fc a9 fd 1a ab ce ..q.lfL......... 04e0 cf 56 a1 9e 88 57 91 ca 3c f7 00 fc d4 f7 cd b5 .V...W..<....... 04f0 3a 9b 80 61 af ca 1d 2c ef 07 93 a3 a4 03 10 06 :..a...,........ 0500 08 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0510 01 02 02 02 01 11 00 10 00 ff ff 23 cc 80 52 f5 ...........#..R. 0520 11 8e 97 d5 c0 8b c6 85 58 99 46 88 c7 dc 56 8a ........X.F...V. 0530 26 81 d2 &.. No. Time Source Destination Protocol Info 24 8.762849 172.31.1.104 172.31.1.101 TCP perf-port > blackjack [ACK] Seq=1802 Ack=344 Win=63897 Len=0 Frame 24 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1802, Ack: 344, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 db a9 40 00 80 06 c4 1a ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 cb 04 01 05 7f 63 62 fd 8c 8c f0 50 10 .e......cb....P. 0030 f9 99 5c 04 00 00 05 00 00 03 10 00 ..\......... No. Time Source Destination Protocol Info 25 8.852922 172.31.1.101 172.31.1.104 TCP 1147 > blackjack [ACK] Seq=1901 Ack=1277 Win=62963 Len=0 Frame 25 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: 1147 (1147), Dst Port: blackjack (1025), Seq: 1901, Ack: 1277, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2d 54 40 00 80 06 72 70 ac 1f 01 65 ac 1f .(-T@...rp...e.. 0020 01 68 04 7b 04 01 b5 9c 33 ad 70 f0 12 4a 50 10 .h.{....3.p..JP. 0030 f5 f3 e9 d4 00 00 4c 4f 43 4c c5 d3 ......LOCL.. No. Time Source Destination Protocol Info 26 12.969996 172.31.1.104 172.31.1.101 NTP NTP Frame 26 (110 bytes on wire, 110 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Network Time Protocol 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 60 db b5 00 00 80 11 03 cc ac 1f 01 68 ac 1f .`...........h.. 0020 01 65 00 7b 00 7b 00 4c 10 4c 19 02 0a fa 00 00 .e.{.{.L.L...... 0030 00 00 00 0b 0f e2 ac 1f 01 65 c5 d5 46 a7 0b fb .........e..F... 0040 b3 6a c5 d5 46 e7 00 00 00 00 c5 d5 46 e7 0b f9 .j..F.......F... 0050 98 dd c5 d5 47 27 0b fb b3 6a 5b 04 00 00 00 00 ....G'...j[..... 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. No. Time Source Destination Protocol Info 27 12.973441 172.31.1.101 172.31.1.104 NTP NTP Frame 27 (110 bytes on wire, 110 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Network Time Protocol 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 60 2d 55 00 00 80 11 b2 2c ac 1f 01 65 ac 1f .`-U.....,...e.. 0020 01 68 00 7b 00 7b 00 4c f5 53 1c 01 06 fa 00 00 .h.{.{.L.S...... 0030 00 00 00 0a fd b6 4c 4f 43 4c c5 d3 fd f1 04 20 ......LOCL..... 0040 c4 9b c5 d5 47 27 0b fb b3 6a c5 d5 47 27 14 00 ....G'...j..G'.. 0050 00 00 c5 d5 47 27 14 00 00 00 00 00 00 00 2a 39 ....G'........*9 0060 ed 27 fd 07 ed 25 9d db ed 32 2c 19 aa 13 .'...%...2,... No. Time Source Destination Protocol Info 28 24.445953 172.31.1.104 172.31.1.101 TCP lipsinc > blackjack [ACK] Seq=0 Ack=0 Win=62915 Len=1 Frame 28 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: lipsinc (1968), Dst Port: blackjack (1025), Seq: 0, Ack: 0, Len: 1 Data (1 byte) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 29 db c2 40 00 80 06 c4 00 ac 1f 01 68 ac 1f .)..@........h.. 0020 01 65 07 b0 04 01 4a 48 91 5b b4 03 4f 10 50 10 .e....JH.[..O.P. 0030 f5 c3 74 9b 00 00 00 1f 01 65 c5 d5 ..t......e.. No. Time Source Destination Protocol Info 29 24.446357 172.31.1.101 172.31.1.104 TCP blackjack > lipsinc [ACK] Seq=0 Ack=1 Win=63302 Len=0 Frame 29 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: lipsinc (1968), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2d b2 40 00 80 06 72 12 ac 1f 01 65 ac 1f .(-.@...r....e.. 0020 01 68 04 01 07 b0 b4 03 4f 10 4a 48 91 5c 50 10 .h......O.JH.\P. 0030 f7 46 73 18 00 00 4c 4f 43 4c c5 d3 .Fs...LOCL.. No. Time Source Destination Protocol Info 30 44.288759 172.31.1.104 172.31.1.101 DNS Standard query SRV _ldap._tcp.Standardname-des-ersten-Standorts._sites.w2k3-104.sub1.w2k3.vmnet1.vm.base Frame 30 (145 bytes on wire, 145 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: domain (53) Domain Name System (query) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 83 dc fa 00 00 80 11 02 64 ac 1f 01 68 ac 1f .........d...h.. 0020 01 65 04 05 00 35 00 6f 2b be 3a 00 01 00 00 01 .e...5.o+.:..... 0030 00 00 00 00 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 08 77 32 6b 33 2d rts._sites.w2k3- 0070 31 30 34 04 73 75 62 31 04 77 32 6b 33 06 76 6d 104.sub1.w2k3.vm 0080 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 21 00 net1.vm.base..!. 0090 01 . No. Time Source Destination Protocol Info 31 44.289802 172.31.1.101 172.31.1.104 DNS Standard query response, No such name Frame 31 (219 bytes on wire, 219 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: domain (53), Dst Port: 1029 (1029) Domain Name System (response) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 cd 2d c5 00 00 80 11 b1 4f ac 1f 01 65 ac 1f ..-......O...e.. 0020 01 68 00 35 04 05 00 b9 6b be 3a 00 85 83 00 01 .h.5....k.:..... 0030 00 00 00 01 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 08 77 32 6b 33 2d rts._sites.w2k3- 0070 31 30 34 04 73 75 62 31 04 77 32 6b 33 06 76 6d 104.sub1.w2k3.vm 0080 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 21 00 net1.vm.base..!. 0090 01 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 6d ..w2k3.vmnet1.vm 00a0 04 62 61 73 65 00 00 06 00 01 00 00 0e 10 00 2b .base..........+ 00b0 08 77 32 6b 33 2d 31 30 31 c0 67 0a 68 6f 73 74 .w2k3-101.g.host 00c0 6d 61 73 74 65 72 00 00 00 01 37 00 00 03 84 00 master....7..... 00d0 00 02 58 00 01 51 80 00 00 0e 10 ..X..Q..... No. Time Source Destination Protocol Info 32 44.293570 172.31.1.104 172.31.1.101 DNS Standard query SRV _ldap._tcp.w2k3-104.sub1.w2k3.vmnet1.vm.base Frame 32 (104 bytes on wire, 104 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: domain (53) Domain Name System (query) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 5a dc fb 00 00 80 11 02 8c ac 1f 01 68 ac 1f .Z...........h.. 0020 01 65 04 05 00 35 00 46 ec 4d de 03 01 00 00 01 .e...5.F.M...... 0030 00 00 00 00 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 08 77 32 6b 33 2d 31 30 34 04 73 75 62 31 04 p.w2k3-104.sub1. 0050 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 6d 04 62 w2k3.vmnet1.vm.b 0060 61 73 65 00 00 21 00 01 ase..!.. No. Time Source Destination Protocol Info 33 44.294403 172.31.1.101 172.31.1.104 DNS Standard query response, No such name Frame 33 (178 bytes on wire, 178 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: domain (53), Dst Port: 1029 (1029) Domain Name System (response) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 a4 2d c6 00 00 80 11 b1 77 ac 1f 01 65 ac 1f ..-......w...e.. 0020 01 68 00 35 04 05 00 90 80 23 de 03 85 83 00 01 .h.5.....#...... 0030 00 00 00 01 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 08 77 32 6b 33 2d 31 30 34 04 73 75 62 31 04 p.w2k3-104.sub1. 0050 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 6d 04 62 w2k3.vmnet1.vm.b 0060 61 73 65 00 00 21 00 01 04 77 32 6b 33 06 76 6d ase..!...w2k3.vm 0070 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 06 00 net1.vm.base.... 0080 01 00 00 0e 10 00 2b 08 77 32 6b 33 2d 31 30 31 ......+.w2k3-101 0090 c0 3e 0a 68 6f 73 74 6d 61 73 74 65 72 00 00 00 .>.hostmaster... 00a0 01 37 00 00 03 84 00 00 02 58 00 01 51 80 00 00 .7.......X..Q... 00b0 0e 10 .. No. Time Source Destination Protocol Info 34 61.330347 172.31.1.104 172.31.1.101 CLDAP MsgId=227 Search Request, Base DN=(null) Frame 34 (176 bytes on wire, 176 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: xribs (2025), Dst Port: ldap (389) Lightweight Directory Access Protocol, Search Request Message Id: 227 Message Type: Search Request (0x03) Message Length: 118 Response In: 35 Base DN: (null) Scope: Base (0x00) Dereference: Never (0x00) Size Limit: 0 Time Limit: 0 Attributes Only: False Filter: (&(DnsDomain=w2k3.vmnet1.vm.base)(Host=W2K3-104)(NtVer=\006) Attribute: Netlogon 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 a2 df d1 00 00 80 11 ff 6d ac 1f 01 68 ac 1f .........m...h.. 0020 01 65 07 e9 01 85 00 8e bf 7a 30 84 00 00 00 80 .e.......z0..... 0030 02 02 00 e3 63 84 00 00 00 76 04 00 0a 01 00 0a ....c....v...... 0040 01 00 02 01 00 02 01 00 01 01 00 a0 84 00 00 00 ................ 0050 4f a3 84 00 00 00 20 04 09 44 6e 73 44 6f 6d 61 O..... ..DnsDoma 0060 69 6e 04 13 77 32 6b 33 2e 76 6d 6e 65 74 31 2e in..w2k3.vmnet1. 0070 76 6d 2e 62 61 73 65 a3 84 00 00 00 10 04 04 48 vm.base........H 0080 6f 73 74 04 08 57 32 4b 33 2d 31 30 34 a3 84 00 ost..W2K3-104... 0090 00 00 0d 04 05 4e 74 56 65 72 04 04 06 00 00 01 .....NtVer...... 00a0 30 84 00 00 00 0a 04 08 4e 65 74 6c 6f 67 6f 6e 0.......Netlogon No. Time Source Destination Protocol Info 35 61.331373 172.31.1.101 172.31.1.104 CLDAP MsgId=227 Search Entry, 1 result Frame 35 (233 bytes on wire, 233 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: ldap (389), Dst Port: xribs (2025) Lightweight Directory Access Protocol, Search Entry Message Id: 227 Message Type: Search Entry (0x04) Message Length: 152 Response To: 34 Time: 0.001026000 seconds Distinguished Name: (null) Attribute: netlogon Lightweight Directory Access Protocol, Search Result Message Id: 227 Message Type: Search Result (0x05) Message Length: 7 Response To: 34 Time: 0.001026000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 db 2d c7 00 00 80 11 b1 3f ac 1f 01 65 ac 1f ..-......?...e.. 0020 01 68 01 85 07 e9 00 c7 f8 7e 30 84 00 00 00 a2 .h.......~0..... 0030 02 02 00 e3 64 84 00 00 00 98 04 00 30 84 00 00 ....d.......0... 0040 00 90 30 84 00 00 00 8a 04 08 6e 65 74 6c 6f 67 ..0.......netlog 0050 6f 6e 31 84 00 00 00 7a 04 78 17 00 00 00 fd 03 on1....z.x...... 0060 00 00 89 d3 ef 99 2f 50 3f 4d ae fb e7 a1 d9 ac ....../P?M...... 0070 fb 2f 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 ./.w2k3.vmnet1.v 0080 6d 04 62 61 73 65 00 c0 18 08 77 32 6b 33 2d 31 m.base....w2k3-1 0090 30 31 c0 18 04 57 32 4b 33 00 08 57 32 4b 33 2d 01...W2K3..W2K3- 00a0 31 30 31 00 00 21 53 74 61 6e 64 61 72 64 6e 61 101..!Standardna 00b0 6d 65 2d 64 65 73 2d 65 72 73 74 65 6e 2d 53 74 me-des-ersten-St 00c0 61 6e 64 6f 72 74 73 00 c0 4b 05 00 00 00 ff ff andorts..K...... 00d0 ff ff 30 84 00 00 00 11 02 02 00 e3 65 84 00 00 ..0.........e... 00e0 00 07 0a 01 00 04 00 04 00 ......... No. Time Source Destination Protocol Info 36 61.462351 172.31.1.104 172.31.1.101 DNS Standard query SRV _ldap._tcp.Standardname-des-ersten-Standorts._sites.w2k3.vmnet1.vm.base Frame 36 (131 bytes on wire, 131 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: domain (53) Domain Name System (query) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 75 df d2 00 00 80 11 ff 99 ac 1f 01 68 ac 1f .u...........h.. 0020 01 65 04 05 00 35 00 61 0c 88 02 3d 01 00 00 01 .e...5.a...=.... 0030 00 00 00 00 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 04 77 32 6b 33 06 rts._sites.w2k3. 0070 76 6d 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 vmnet1.vm.base.. 0080 21 00 01 !.. No. Time Source Destination Protocol Info 37 61.463082 172.31.1.101 172.31.1.104 DNS Standard query response SRV 0 100 389 w2k3-101.w2k3.vmnet1.vm.base Frame 37 (195 bytes on wire, 195 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: domain (53), Dst Port: 1029 (1029) Domain Name System (response) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 b5 2d c8 00 00 80 11 b1 64 ac 1f 01 65 ac 1f ..-......d...e.. 0020 01 68 00 35 04 05 00 a1 a5 46 02 3d 85 80 00 01 .h.5.....F.=.... 0030 00 01 00 00 00 01 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 04 77 32 6b 33 06 rts._sites.w2k3. 0070 76 6d 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 vmnet1.vm.base.. 0080 21 00 01 c0 0c 00 21 00 01 00 00 02 58 00 24 00 !.....!.....X.$. 0090 00 00 64 01 85 08 77 32 6b 33 2d 31 30 31 04 77 ..d...w2k3-101.w 00a0 32 6b 33 06 76 6d 6e 65 74 31 02 76 6d 04 62 61 2k3.vmnet1.vm.ba 00b0 73 65 00 c0 6b 00 01 00 01 00 00 0e 10 00 04 ac se..k........... 00c0 1f 01 65 ..e No. Time Source Destination Protocol Info 38 61.464421 172.31.1.104 172.31.1.101 CLDAP MsgId=228 Search Request, Base DN=(null) Frame 38 (176 bytes on wire, 176 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: scrabble (2026), Dst Port: ldap (389) Lightweight Directory Access Protocol, Search Request Message Id: 228 Message Type: Search Request (0x03) Message Length: 118 Response In: 39 Base DN: (null) Scope: Base (0x00) Dereference: Never (0x00) Size Limit: 0 Time Limit: 0 Attributes Only: False Filter: (&(DnsDomain=w2k3.vmnet1.vm.base)(Host=W2K3-104)(NtVer=\006) Attribute: Netlogon 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 a2 df d3 00 00 80 11 ff 6b ac 1f 01 68 ac 1f .........k...h.. 0020 01 65 07 ea 01 85 00 8e bf 58 30 84 00 00 00 80 .e.......X0..... 0030 02 02 00 e4 63 84 00 00 00 76 04 00 0a 01 00 0a ....c....v...... 0040 01 00 02 01 00 02 01 00 01 01 00 a0 84 00 00 00 ................ 0050 4f a3 84 00 00 00 20 04 09 44 6e 73 44 6f 6d 61 O..... ..DnsDoma 0060 69 6e 04 13 77 32 6b 33 2e 76 6d 6e 65 74 31 2e in..w2k3.vmnet1. 0070 76 6d 2e 62 61 73 65 a3 84 00 00 00 10 04 04 48 vm.base........H 0080 6f 73 74 04 08 57 32 4b 33 2d 31 30 34 a3 84 00 ost..W2K3-104... 0090 00 00 0d 04 05 4e 74 56 65 72 04 04 06 00 00 21 .....NtVer.....! 00a0 30 84 00 00 00 0a 04 08 4e 65 74 6c 6f 67 6f 6e 0.......Netlogon No. Time Source Destination Protocol Info 39 61.465111 172.31.1.101 172.31.1.104 CLDAP MsgId=228 Search Entry, 1 result Frame 39 (233 bytes on wire, 233 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: ldap (389), Dst Port: scrabble (2026) Lightweight Directory Access Protocol, Search Entry Message Id: 228 Message Type: Search Entry (0x04) Message Length: 152 Response To: 38 Time: 0.000690000 seconds Distinguished Name: (null) Attribute: netlogon Lightweight Directory Access Protocol, Search Result Message Id: 228 Message Type: Search Result (0x05) Message Length: 7 Response To: 38 Time: 0.000690000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 db 2d c9 00 00 80 11 b1 3d ac 1f 01 65 ac 1f ..-......=...e.. 0020 01 68 01 85 07 ea 00 c7 f8 7b 30 84 00 00 00 a2 .h.......{0..... 0030 02 02 00 e4 64 84 00 00 00 98 04 00 30 84 00 00 ....d.......0... 0040 00 90 30 84 00 00 00 8a 04 08 6e 65 74 6c 6f 67 ..0.......netlog 0050 6f 6e 31 84 00 00 00 7a 04 78 17 00 00 00 fd 03 on1....z.x...... 0060 00 00 89 d3 ef 99 2f 50 3f 4d ae fb e7 a1 d9 ac ....../P?M...... 0070 fb 2f 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 ./.w2k3.vmnet1.v 0080 6d 04 62 61 73 65 00 c0 18 08 77 32 6b 33 2d 31 m.base....w2k3-1 0090 30 31 c0 18 04 57 32 4b 33 00 08 57 32 4b 33 2d 01...W2K3..W2K3- 00a0 31 30 31 00 00 21 53 74 61 6e 64 61 72 64 6e 61 101..!Standardna 00b0 6d 65 2d 64 65 73 2d 65 72 73 74 65 6e 2d 53 74 me-des-ersten-St 00c0 61 6e 64 6f 72 74 73 00 c0 4b 05 00 00 00 ff ff andorts..K...... 00d0 ff ff 30 84 00 00 00 11 02 02 00 e4 65 84 00 00 ..0.........e... 00e0 00 07 0a 01 00 04 00 04 00 ......... No. Time Source Destination Protocol Info 40 61.571414 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 Frame 40 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 0, Ack: 0, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 30 df d4 40 00 80 06 bf e7 ac 1f 01 68 ac 1f .0..@........h.. 0020 01 65 07 eb 01 85 c4 68 44 98 00 00 00 00 70 02 .e.....hD.....p. 0030 fa f0 1a b2 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 41 61.571856 172.31.1.101 172.31.1.104 TCP ldap > shadowserver [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 Frame 41 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 30 2d ca 40 00 80 06 71 f2 ac 1f 01 65 ac 1f .0-.@...q....e.. 0020 01 68 01 85 07 eb f8 ed f2 87 c4 68 44 99 70 12 .h.........hD.p. 0030 fa f0 2f 2b 00 00 02 04 05 b4 01 01 04 02 ../+.......... No. Time Source Destination Protocol Info 42 61.572159 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=1 Ack=1 Win=64240 Len=0 Frame 42 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df d5 40 00 80 06 bf ee ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 44 99 f8 ed f2 88 50 10 .e.....hD.....P. 0030 fa f0 5b ef 00 00 05 00 00 03 10 00 ..[......... No. Time Source Destination Protocol Info 43 61.572985 172.31.1.104 172.31.1.101 LDAP MsgId=213 Search Request, Base DN=(null) Frame 43 (405 bytes on wire, 405 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 351 Lightweight Directory Access Protocol, Search Request Message Id: 213 Message Type: Search Request (0x03) Message Length: 335 Response In: 45 Base DN: (null) Scope: Base (0x00) Dereference: Never (0x00) Size Limit: 0 Time Limit: 120 Attributes Only: False Filter: (objectclass=*) Attribute: subschemaSubentry Attribute: dsServiceName Attribute: namingContexts Attribute: defaultNamingContext Attribute: schemaNamingContext Attribute: configurationNamingContext Attribute: rootDomainNamingContext Attribute: supportedControl Attribute: supportedLDAPVersion Attribute: supportedLDAPPolicies Attribute: supportedSASLMechanisms Attribute: dnsHostName Attribute: ldapServiceName Attribute: serverName Attribute: supportedCapabilities 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 87 df d6 40 00 80 06 be 8e ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 eb 01 85 c4 68 44 99 f8 ed f2 88 50 18 .e.....hD.....P. 0030 fa f0 3a 05 00 00 30 84 00 00 01 59 02 02 00 d5 ..:...0....Y.... 0040 63 84 00 00 01 4f 04 00 0a 01 00 0a 01 00 02 01 c....O.......... 0050 00 02 01 78 01 01 00 87 0b 6f 62 6a 65 63 74 63 ...x.....objectc 0060 6c 61 73 73 30 84 00 00 01 2b 04 11 73 75 62 73 lass0....+..subs 0070 63 68 65 6d 61 53 75 62 65 6e 74 72 79 04 0d 64 chemaSubentry..d 0080 73 53 65 72 76 69 63 65 4e 61 6d 65 04 0e 6e 61 sServiceName..na 0090 6d 69 6e 67 43 6f 6e 74 65 78 74 73 04 14 64 65 mingContexts..de 00a0 66 61 75 6c 74 4e 61 6d 69 6e 67 43 6f 6e 74 65 faultNamingConte 00b0 78 74 04 13 73 63 68 65 6d 61 4e 61 6d 69 6e 67 xt..schemaNaming 00c0 43 6f 6e 74 65 78 74 04 1a 63 6f 6e 66 69 67 75 Context..configu 00d0 72 61 74 69 6f 6e 4e 61 6d 69 6e 67 43 6f 6e 74 rationNamingCont 00e0 65 78 74 04 17 72 6f 6f 74 44 6f 6d 61 69 6e 4e ext..rootDomainN 00f0 61 6d 69 6e 67 43 6f 6e 74 65 78 74 04 10 73 75 amingContext..su 0100 70 70 6f 72 74 65 64 43 6f 6e 74 72 6f 6c 04 14 pportedControl.. 0110 73 75 70 70 6f 72 74 65 64 4c 44 41 50 56 65 72 supportedLDAPVer 0120 73 69 6f 6e 04 15 73 75 70 70 6f 72 74 65 64 4c sion..supportedL 0130 44 41 50 50 6f 6c 69 63 69 65 73 04 17 73 75 70 DAPPolicies..sup 0140 70 6f 72 74 65 64 53 41 53 4c 4d 65 63 68 61 6e portedSASLMechan 0150 69 73 6d 73 04 0b 64 6e 73 48 6f 73 74 4e 61 6d isms..dnsHostNam 0160 65 04 0f 6c 64 61 70 53 65 72 76 69 63 65 4e 61 e..ldapServiceNa 0170 6d 65 04 0a 73 65 72 76 65 72 4e 61 6d 65 04 15 me..serverName.. 0180 73 75 70 70 6f 72 74 65 64 43 61 70 61 62 69 6c supportedCapabil 0190 69 74 69 65 73 ities No. Time Source Destination Protocol Info 44 61.573720 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 44 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 1, Ack: 352, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d cb 40 00 80 06 6c 45 ac 1f 01 65 ac 1f ..-.@...lE...e.. 0020 01 68 01 85 07 eb f8 ed f2 88 c4 68 45 f8 50 10 .h.........hE.P. 0030 f9 91 6c 39 00 00 30 84 00 00 08 7b 02 02 00 d5 ..l9..0....{.... 0040 64 84 00 00 08 71 04 00 30 84 00 00 08 69 30 84 d....q..0....i0. 0050 00 00 00 62 04 11 73 75 62 73 63 68 65 6d 61 53 ...b..subschemaS 0060 75 62 65 6e 74 72 79 31 84 00 00 00 49 04 47 43 ubentry1....I.GC 0070 4e 3d 41 67 67 72 65 67 61 74 65 2c 43 4e 3d 53 N=Aggregate,CN=S 0080 63 68 65 6d 61 2c 43 4e 3d 43 6f 6e 66 69 67 75 chema,CN=Configu 0090 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 ration,DC=w2k3,D 00a0 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 C=vmnet1,DC=vm,D 00b0 43 3d 62 61 73 65 30 84 00 00 00 a1 04 0d 64 73 C=base0.......ds 00c0 53 65 72 76 69 63 65 4e 61 6d 65 31 84 00 00 00 ServiceName1.... 00d0 8c 04 84 00 00 00 86 43 4e 3d 4e 54 44 53 20 53 .......CN=NTDS S 00e0 65 74 74 69 6e 67 73 2c 43 4e 3d 57 32 4b 33 2d ettings,CN=W2K3- 00f0 31 30 31 2c 43 4e 3d 53 65 72 76 65 72 73 2c 43 101,CN=Servers,C 0100 4e 3d 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 N=Standardname-d 0110 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0120 72 74 73 2c 43 4e 3d 53 69 74 65 73 2c 43 4e 3d rts,CN=Sites,CN= 0130 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2c 44 43 Configuration,DC 0140 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 2c =w2k3,DC=vmnet1, 0150 44 43 3d 76 6d 2c 44 43 3d 62 61 73 65 30 84 00 DC=vm,DC=base0.. 0160 00 01 0b 04 0e 6e 61 6d 69 6e 67 43 6f 6e 74 65 .....namingConte 0170 78 74 73 31 84 00 00 00 f5 04 1f 44 43 3d 77 32 xts1.......DC=w2 0180 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d k3,DC=vmnet1,DC= 0190 76 6d 2c 44 43 3d 62 61 73 65 04 30 43 4e 3d 43 vm,DC=base.0CN=C 01a0 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2c 44 43 3d onfiguration,DC= 01b0 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 w2k3,DC=vmnet1,D 01c0 43 3d 76 6d 2c 44 43 3d 62 61 73 65 04 3a 43 4e C=vm,DC=base.:CN 01d0 3d 53 63 68 65 6d 61 2c 43 4e 3d 43 6f 6e 66 69 =Schema,CN=Confi 01e0 67 75 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 guration,DC=w2k3 01f0 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d ,DC=vmnet1,DC=vm 0200 2c 44 43 3d 62 61 73 65 04 31 44 43 3d 44 6f 6d ,DC=base.1DC=Dom 0210 61 69 6e 44 6e 73 5a 6f 6e 65 73 2c 44 43 3d 77 ainDnsZones,DC=w 0220 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 2k3,DC=vmnet1,DC 0230 3d 76 6d 2c 44 43 3d 62 61 73 65 04 31 44 43 3d =vm,DC=base.1DC= 0240 46 6f 72 65 73 74 44 6e 73 5a 6f 6e 65 73 2c 44 ForestDnsZones,D 0250 43 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 C=w2k3,DC=vmnet1 0260 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 73 65 30 84 ,DC=vm,DC=base0. 0270 00 00 00 3d 04 14 64 65 66 61 75 6c 74 4e 61 6d ...=..defaultNam 0280 69 6e 67 43 6f 6e 74 65 78 74 31 84 00 00 00 21 ingContext1....! 0290 04 1f 44 43 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e ..DC=w2k3,DC=vmn 02a0 65 74 31 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 73 et1,DC=vm,DC=bas 02b0 65 30 84 00 00 00 57 04 13 73 63 68 65 6d 61 4e e0....W..schemaN 02c0 61 6d 69 6e 67 43 6f 6e 74 65 78 74 31 84 00 00 amingContext1... 02d0 00 3c 04 3a 43 4e 3d 53 63 68 65 6d 61 2c 43 4e .<.:CN=Schema,CN 02e0 3d 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e 2c 44 =Configuration,D 02f0 43 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 C=w2k3,DC=vmnet1 0300 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 73 65 30 84 ,DC=vm,DC=base0. 0310 00 00 00 54 04 1a 63 6f 6e 66 69 67 75 72 61 74 ...T..configurat 0320 69 6f 6e 4e 61 6d 69 6e 67 43 6f 6e 74 65 78 74 ionNamingContext 0330 31 84 00 00 00 32 04 30 43 4e 3d 43 6f 6e 66 69 1....2.0CN=Confi 0340 67 75 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 guration,DC=w2k3 0350 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d ,DC=vmnet1,DC=vm 0360 2c 44 43 3d 62 61 73 65 30 84 00 00 00 40 04 17 ,DC=base0....@.. 0370 72 6f 6f 74 44 6f 6d 61 69 6e 4e 61 6d 69 6e 67 rootDomainNaming 0380 43 6f 6e 74 65 78 74 31 84 00 00 00 21 04 1f 44 Context1....!..D 0390 43 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 C=w2k3,DC=vmnet1 03a0 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 73 65 30 84 ,DC=vm,DC=base0. 03b0 00 00 02 19 04 10 73 75 70 70 6f 72 74 65 64 43 ......supportedC 03c0 6f 6e 74 72 6f 6c 31 84 00 00 02 01 04 16 31 2e ontrol1.......1. 03d0 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 03e0 2e 33 31 39 04 16 31 2e 32 2e 38 34 30 2e 31 31 .319..1.2.840.11 03f0 33 35 35 36 2e 31 2e 34 2e 38 30 31 04 16 31 2e 3556.1.4.801..1. 0400 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 0410 2e 34 37 33 04 16 31 2e 32 2e 38 34 30 2e 31 31 .473..1.2.840.11 0420 33 35 35 36 2e 31 2e 34 2e 35 32 38 04 16 31 2e 3556.1.4.528..1. 0430 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 0440 2e 34 31 37 04 16 31 2e 32 2e 38 34 30 2e 31 31 .417..1.2.840.11 0450 33 35 35 36 2e 31 2e 34 2e 36 31 39 04 16 31 2e 3556.1.4.619..1. 0460 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 0470 2e 38 34 31 04 16 31 2e 32 2e 38 34 30 2e 31 31 .841..1.2.840.11 0480 33 35 35 36 2e 31 2e 34 2e 35 32 39 04 16 31 2e 3556.1.4.529..1. 0490 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 04a0 2e 38 30 35 04 16 31 2e 32 2e 38 34 30 2e 31 31 .805..1.2.840.11 04b0 33 35 35 36 2e 31 2e 34 2e 35 32 31 04 16 31 2e 3556.1.4.521..1. 04c0 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 04d0 2e 39 37 30 04 17 31 2e 32 2e 38 34 30 2e 31 31 .970..1.2.840.11 04e0 33 35 35 36 2e 31 2e 34 2e 31 33 33 38 04 16 31 3556.1.4.1338..1 04f0 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e .2.840.113556.1. 0500 34 2e 34 37 34 04 17 31 2e 32 2e 38 34 30 2e 31 4.474..1.2.840.1 0510 31 33 35 35 36 2e 31 2e 34 2e 31 33 33 39 04 17 13556.1.4.1339.. 0520 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 0530 2e 34 2e 31 33 34 30 04 17 31 2e 32 2e 38 34 30 .4.1340..1.2.840 0540 2e 31 31 33 35 35 36 2e 31 2e 34 2e 31 34 31 33 .113556.1.4.1413 0550 04 17 32 2e 31 36 2e 38 34 30 2e 31 2e 31 31 33 ..2.16.840.1.113 0560 37 33 30 2e 33 2e 34 2e 39 04 18 32 2e 31 36 2e 730.3.4.9..2.16. 0570 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e 34 840.1.113730.3.4 0580 2e 31 30 04 17 31 2e 32 2e 38 34 30 2e 31 31 33 .10..1.2.840.113 0590 35 35 36 2e 31 2e 34 2e 31 35 30 34 04 17 31 2e 556.1.4.1504..1. 05a0 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2.840.113556.1.4 05b0 2e 31 38 35 32 04 16 31 2e 32 2e 38 34 30 2e 31 .1852..1.2.840.1 05c0 31 33 35 35 36 2e 31 2e 34 2e 38 30 32 30 84 00 13556.1.4.8020.. 05d0 00 00 22 04 14 73 75 70 70 6f 72 74 65 64 4c 44 .."..supportedLD 05e0 41 50 56 65 72 73 69 6f 6e 31 APVersion1 No. Time Source Destination Protocol Info 45 61.573841 172.31.1.101 172.31.1.104 LDAP MsgId=213 Search Entry, 1 result Frame 45 (794 bytes on wire, 794 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 1461, Ack: 352, Len: 740 Lightweight Directory Access Protocol, Search Entry Message Id: 213 Message Type: Search Entry (0x04) Message Length: 2161 Response To: 43 Time: 0.000856000 seconds Distinguished Name: (null) Attribute: subschemaSubentry Attribute: dsServiceName Attribute: namingContexts Attribute: defaultNamingContext Attribute: schemaNamingContext Attribute: configurationNamingContext Attribute: rootDomainNamingContext Attribute: supportedControl Attribute: supportedLDAPVersion Attribute: supportedLDAPPolicies Attribute: supportedSASLMechanisms Attribute: dnsHostName Attribute: ldapServiceName Attribute: serverName Attribute: supportedCapabilities Lightweight Directory Access Protocol, Search Result Message Id: 213 Message Type: Search Result (0x05) Message Length: 7 Response To: 43 Time: 0.000856000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) Frame (794 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 0c 2d cc 40 00 80 06 6f 14 ac 1f 01 65 ac 1f ..-.@...o....e.. 0020 01 68 01 85 07 eb f8 ed f8 3c c4 68 45 f8 50 18 .h.......<.hE.P. 0030 f9 91 f0 ac 00 00 84 00 00 00 06 04 01 33 04 01 .............3.. 0040 32 30 84 00 00 00 ea 04 15 73 75 70 70 6f 72 74 20.......support 0050 65 64 4c 44 41 50 50 6f 6c 69 63 69 65 73 31 84 edLDAPPolicies1. 0060 00 00 00 cd 04 0e 4d 61 78 50 6f 6f 6c 54 68 72 ......MaxPoolThr 0070 65 61 64 73 04 0f 4d 61 78 44 61 74 61 67 72 61 eads..MaxDatagra 0080 6d 52 65 63 76 04 10 4d 61 78 52 65 63 65 69 76 mRecv..MaxReceiv 0090 65 42 75 66 66 65 72 04 0f 49 6e 69 74 52 65 63 eBuffer..InitRec 00a0 76 54 69 6d 65 6f 75 74 04 0e 4d 61 78 43 6f 6e vTimeout..MaxCon 00b0 6e 65 63 74 69 6f 6e 73 04 0f 4d 61 78 43 6f 6e nections..MaxCon 00c0 6e 49 64 6c 65 54 69 6d 65 04 0b 4d 61 78 50 61 nIdleTime..MaxPa 00d0 67 65 53 69 7a 65 04 10 4d 61 78 51 75 65 72 79 geSize..MaxQuery 00e0 44 75 72 61 74 69 6f 6e 04 10 4d 61 78 54 65 6d Duration..MaxTem 00f0 70 54 61 62 6c 65 53 69 7a 65 04 10 4d 61 78 52 pTableSize..MaxR 0100 65 73 75 6c 74 53 65 74 53 69 7a 65 04 16 4d 61 esultSetSize..Ma 0110 78 4e 6f 74 69 66 69 63 61 74 69 6f 6e 50 65 72 xNotificationPer 0120 43 6f 6e 6e 04 0b 4d 61 78 56 61 6c 52 61 6e 67 Conn..MaxValRang 0130 65 30 84 00 00 00 49 04 17 73 75 70 70 6f 72 74 e0....I..support 0140 65 64 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 edSASLMechanisms 0150 31 84 00 00 00 2a 04 06 47 53 53 41 50 49 04 0a 1....*..GSSAPI.. 0160 47 53 53 2d 53 50 4e 45 47 4f 04 08 45 58 54 45 GSS-SPNEGO..EXTE 0170 52 4e 41 4c 04 0a 44 49 47 45 53 54 2d 4d 44 35 RNAL..DIGEST-MD5 0180 30 84 00 00 00 31 04 0b 64 6e 73 48 6f 73 74 4e 0....1..dnsHostN 0190 61 6d 65 31 84 00 00 00 1e 04 1c 77 32 6b 33 2d ame1.......w2k3- 01a0 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 2e 101.w2k3.vmnet1. 01b0 76 6d 2e 62 61 73 65 30 84 00 00 00 4a 04 0f 6c vm.base0....J..l 01c0 64 61 70 53 65 72 76 69 63 65 4e 61 6d 65 31 84 dapServiceName1. 01d0 00 00 00 33 04 31 77 32 6b 33 2e 76 6d 6e 65 74 ...3.1w2k3.vmnet 01e0 31 2e 76 6d 2e 62 61 73 65 3a 77 32 6b 33 2d 31 1.vm.base:w2k3-1 01f0 30 31 24 40 57 32 4b 33 2e 56 4d 4e 45 54 31 2e 01$@W2K3.VMNET1. 0200 56 4d 2e 42 41 53 45 30 84 00 00 00 89 04 0a 73 VM.BASE0.......s 0210 65 72 76 65 72 4e 61 6d 65 31 84 00 00 00 77 04 erverName1....w. 0220 75 43 4e 3d 57 32 4b 33 2d 31 30 31 2c 43 4e 3d uCN=W2K3-101,CN= 0230 53 65 72 76 65 72 73 2c 43 4e 3d 53 74 61 6e 64 Servers,CN=Stand 0240 61 72 64 6e 61 6d 65 2d 64 65 73 2d 65 72 73 74 ardname-des-erst 0250 65 6e 2d 53 74 61 6e 64 6f 72 74 73 2c 43 4e 3d en-Standorts,CN= 0260 53 69 74 65 73 2c 43 4e 3d 43 6f 6e 66 69 67 75 Sites,CN=Configu 0270 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 ration,DC=w2k3,D 0280 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 C=vmnet1,DC=vm,D 0290 43 3d 62 61 73 65 30 84 00 00 00 67 04 15 73 75 C=base0....g..su 02a0 70 70 6f 72 74 65 64 43 61 70 61 62 69 6c 69 74 pportedCapabilit 02b0 69 65 73 31 84 00 00 00 4a 04 16 31 2e 32 2e 38 ies1....J..1.2.8 02c0 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 38 30 40.113556.1.4.80 02d0 30 04 17 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 0..1.2.840.11355 02e0 36 2e 31 2e 34 2e 31 36 37 30 04 17 31 2e 32 2e 6.1.4.1670..1.2. 02f0 38 34 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 31 840.113556.1.4.1 0300 37 39 31 30 84 00 00 00 11 02 02 00 d5 65 84 00 7910.........e.. 0310 00 00 07 0a 01 00 04 00 04 00 .......... Reassembled TCP (2200 bytes): 0000 30 84 00 00 08 7b 02 02 00 d5 64 84 00 00 08 71 0....{....d....q 0010 04 00 30 84 00 00 08 69 30 84 00 00 00 62 04 11 ..0....i0....b.. 0020 73 75 62 73 63 68 65 6d 61 53 75 62 65 6e 74 72 subschemaSubentr 0030 79 31 84 00 00 00 49 04 47 43 4e 3d 41 67 67 72 y1....I.GCN=Aggr 0040 65 67 61 74 65 2c 43 4e 3d 53 63 68 65 6d 61 2c egate,CN=Schema, 0050 43 4e 3d 43 6f 6e 66 69 67 75 72 61 74 69 6f 6e CN=Configuration 0060 2c 44 43 3d 77 32 6b 33 2c 44 43 3d 76 6d 6e 65 ,DC=w2k3,DC=vmne 0070 74 31 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 73 65 t1,DC=vm,DC=base 0080 30 84 00 00 00 a1 04 0d 64 73 53 65 72 76 69 63 0.......dsServic 0090 65 4e 61 6d 65 31 84 00 00 00 8c 04 84 00 00 00 eName1.......... 00a0 86 43 4e 3d 4e 54 44 53 20 53 65 74 74 69 6e 67 .CN=NTDS Setting 00b0 73 2c 43 4e 3d 57 32 4b 33 2d 31 30 31 2c 43 4e s,CN=W2K3-101,CN 00c0 3d 53 65 72 76 65 72 73 2c 43 4e 3d 53 74 61 6e =Servers,CN=Stan 00d0 64 61 72 64 6e 61 6d 65 2d 64 65 73 2d 65 72 73 dardname-des-ers 00e0 74 65 6e 2d 53 74 61 6e 64 6f 72 74 73 2c 43 4e ten-Standorts,CN 00f0 3d 53 69 74 65 73 2c 43 4e 3d 43 6f 6e 66 69 67 =Sites,CN=Config 0100 75 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 2c uration,DC=w2k3, 0110 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c DC=vmnet1,DC=vm, 0120 44 43 3d 62 61 73 65 30 84 00 00 01 0b 04 0e 6e DC=base0.......n 0130 61 6d 69 6e 67 43 6f 6e 74 65 78 74 73 31 84 00 amingContexts1.. 0140 00 00 f5 04 1f 44 43 3d 77 32 6b 33 2c 44 43 3d .....DC=w2k3,DC= 0150 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 43 3d vmnet1,DC=vm,DC= 0160 62 61 73 65 04 30 43 4e 3d 43 6f 6e 66 69 67 75 base.0CN=Configu 0170 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 ration,DC=w2k3,D 0180 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 C=vmnet1,DC=vm,D 0190 43 3d 62 61 73 65 04 3a 43 4e 3d 53 63 68 65 6d C=base.:CN=Schem 01a0 61 2c 43 4e 3d 43 6f 6e 66 69 67 75 72 61 74 69 a,CN=Configurati 01b0 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 43 3d 76 6d on,DC=w2k3,DC=vm 01c0 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 net1,DC=vm,DC=ba 01d0 73 65 04 31 44 43 3d 44 6f 6d 61 69 6e 44 6e 73 se.1DC=DomainDns 01e0 5a 6f 6e 65 73 2c 44 43 3d 77 32 6b 33 2c 44 43 Zones,DC=w2k3,DC 01f0 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 43 =vmnet1,DC=vm,DC 0200 3d 62 61 73 65 04 31 44 43 3d 46 6f 72 65 73 74 =base.1DC=Forest 0210 44 6e 73 5a 6f 6e 65 73 2c 44 43 3d 77 32 6b 33 DnsZones,DC=w2k3 0220 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d ,DC=vmnet1,DC=vm 0230 2c 44 43 3d 62 61 73 65 30 84 00 00 00 3d 04 14 ,DC=base0....=.. 0240 64 65 66 61 75 6c 74 4e 61 6d 69 6e 67 43 6f 6e defaultNamingCon 0250 74 65 78 74 31 84 00 00 00 21 04 1f 44 43 3d 77 text1....!..DC=w 0260 32 6b 33 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 2k3,DC=vmnet1,DC 0270 3d 76 6d 2c 44 43 3d 62 61 73 65 30 84 00 00 00 =vm,DC=base0.... 0280 57 04 13 73 63 68 65 6d 61 4e 61 6d 69 6e 67 43 W..schemaNamingC 0290 6f 6e 74 65 78 74 31 84 00 00 00 3c 04 3a 43 4e ontext1....<.:CN 02a0 3d 53 63 68 65 6d 61 2c 43 4e 3d 43 6f 6e 66 69 =Schema,CN=Confi 02b0 67 75 72 61 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 guration,DC=w2k3 02c0 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d ,DC=vmnet1,DC=vm 02d0 2c 44 43 3d 62 61 73 65 30 84 00 00 00 54 04 1a ,DC=base0....T.. 02e0 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 4e 61 6d configurationNam 02f0 69 6e 67 43 6f 6e 74 65 78 74 31 84 00 00 00 32 ingContext1....2 0300 04 30 43 4e 3d 43 6f 6e 66 69 67 75 72 61 74 69 .0CN=Configurati 0310 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 43 3d 76 6d on,DC=w2k3,DC=vm 0320 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 43 3d 62 61 net1,DC=vm,DC=ba 0330 73 65 30 84 00 00 00 40 04 17 72 6f 6f 74 44 6f se0....@..rootDo 0340 6d 61 69 6e 4e 61 6d 69 6e 67 43 6f 6e 74 65 78 mainNamingContex 0350 74 31 84 00 00 00 21 04 1f 44 43 3d 77 32 6b 33 t1....!..DC=w2k3 0360 2c 44 43 3d 76 6d 6e 65 74 31 2c 44 43 3d 76 6d ,DC=vmnet1,DC=vm 0370 2c 44 43 3d 62 61 73 65 30 84 00 00 02 19 04 10 ,DC=base0....... 0380 73 75 70 70 6f 72 74 65 64 43 6f 6e 74 72 6f 6c supportedControl 0390 31 84 00 00 02 01 04 16 31 2e 32 2e 38 34 30 2e 1.......1.2.840. 03a0 31 31 33 35 35 36 2e 31 2e 34 2e 33 31 39 04 16 113556.1.4.319.. 03b0 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 03c0 2e 34 2e 38 30 31 04 16 31 2e 32 2e 38 34 30 2e .4.801..1.2.840. 03d0 31 31 33 35 35 36 2e 31 2e 34 2e 34 37 33 04 16 113556.1.4.473.. 03e0 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 03f0 2e 34 2e 35 32 38 04 16 31 2e 32 2e 38 34 30 2e .4.528..1.2.840. 0400 31 31 33 35 35 36 2e 31 2e 34 2e 34 31 37 04 16 113556.1.4.417.. 0410 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 0420 2e 34 2e 36 31 39 04 16 31 2e 32 2e 38 34 30 2e .4.619..1.2.840. 0430 31 31 33 35 35 36 2e 31 2e 34 2e 38 34 31 04 16 113556.1.4.841.. 0440 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 0450 2e 34 2e 35 32 39 04 16 31 2e 32 2e 38 34 30 2e .4.529..1.2.840. 0460 31 31 33 35 35 36 2e 31 2e 34 2e 38 30 35 04 16 113556.1.4.805.. 0470 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 0480 2e 34 2e 35 32 31 04 16 31 2e 32 2e 38 34 30 2e .4.521..1.2.840. 0490 31 31 33 35 35 36 2e 31 2e 34 2e 39 37 30 04 17 113556.1.4.970.. 04a0 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 1.2.840.113556.1 04b0 2e 34 2e 31 33 33 38 04 16 31 2e 32 2e 38 34 30 .4.1338..1.2.840 04c0 2e 31 31 33 35 35 36 2e 31 2e 34 2e 34 37 34 04 .113556.1.4.474. 04d0 17 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e .1.2.840.113556. 04e0 31 2e 34 2e 31 33 33 39 04 17 31 2e 32 2e 38 34 1.4.1339..1.2.84 04f0 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 31 33 34 0.113556.1.4.134 0500 30 04 17 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 0..1.2.840.11355 0510 36 2e 31 2e 34 2e 31 34 31 33 04 17 32 2e 31 36 6.1.4.1413..2.16 0520 2e 38 34 30 2e 31 2e 31 31 33 37 33 30 2e 33 2e .840.1.113730.3. 0530 34 2e 39 04 18 32 2e 31 36 2e 38 34 30 2e 31 2e 4.9..2.16.840.1. 0540 31 31 33 37 33 30 2e 33 2e 34 2e 31 30 04 17 31 113730.3.4.10..1 0550 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e 31 2e .2.840.113556.1. 0560 34 2e 31 35 30 34 04 17 31 2e 32 2e 38 34 30 2e 4.1504..1.2.840. 0570 31 31 33 35 35 36 2e 31 2e 34 2e 31 38 35 32 04 113556.1.4.1852. 0580 16 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e .1.2.840.113556. 0590 31 2e 34 2e 38 30 32 30 84 00 00 00 22 04 14 73 1.4.8020...."..s 05a0 75 70 70 6f 72 74 65 64 4c 44 41 50 56 65 72 73 upportedLDAPVers 05b0 69 6f 6e 31 84 00 00 00 06 04 01 33 04 01 32 30 ion1.......3..20 05c0 84 00 00 00 ea 04 15 73 75 70 70 6f 72 74 65 64 .......supported 05d0 4c 44 41 50 50 6f 6c 69 63 69 65 73 31 84 00 00 LDAPPolicies1... 05e0 00 cd 04 0e 4d 61 78 50 6f 6f 6c 54 68 72 65 61 ....MaxPoolThrea 05f0 64 73 04 0f 4d 61 78 44 61 74 61 67 72 61 6d 52 ds..MaxDatagramR 0600 65 63 76 04 10 4d 61 78 52 65 63 65 69 76 65 42 ecv..MaxReceiveB 0610 75 66 66 65 72 04 0f 49 6e 69 74 52 65 63 76 54 uffer..InitRecvT 0620 69 6d 65 6f 75 74 04 0e 4d 61 78 43 6f 6e 6e 65 imeout..MaxConne 0630 63 74 69 6f 6e 73 04 0f 4d 61 78 43 6f 6e 6e 49 ctions..MaxConnI 0640 64 6c 65 54 69 6d 65 04 0b 4d 61 78 50 61 67 65 dleTime..MaxPage 0650 53 69 7a 65 04 10 4d 61 78 51 75 65 72 79 44 75 Size..MaxQueryDu 0660 72 61 74 69 6f 6e 04 10 4d 61 78 54 65 6d 70 54 ration..MaxTempT 0670 61 62 6c 65 53 69 7a 65 04 10 4d 61 78 52 65 73 ableSize..MaxRes 0680 75 6c 74 53 65 74 53 69 7a 65 04 16 4d 61 78 4e ultSetSize..MaxN 0690 6f 74 69 66 69 63 61 74 69 6f 6e 50 65 72 43 6f otificationPerCo 06a0 6e 6e 04 0b 4d 61 78 56 61 6c 52 61 6e 67 65 30 nn..MaxValRange0 06b0 84 00 00 00 49 04 17 73 75 70 70 6f 72 74 65 64 ....I..supported 06c0 53 41 53 4c 4d 65 63 68 61 6e 69 73 6d 73 31 84 SASLMechanisms1. 06d0 00 00 00 2a 04 06 47 53 53 41 50 49 04 0a 47 53 ...*..GSSAPI..GS 06e0 53 2d 53 50 4e 45 47 4f 04 08 45 58 54 45 52 4e S-SPNEGO..EXTERN 06f0 41 4c 04 0a 44 49 47 45 53 54 2d 4d 44 35 30 84 AL..DIGEST-MD50. 0700 00 00 00 31 04 0b 64 6e 73 48 6f 73 74 4e 61 6d ...1..dnsHostNam 0710 65 31 84 00 00 00 1e 04 1c 77 32 6b 33 2d 31 30 e1.......w2k3-10 0720 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 2e 76 6d 1.w2k3.vmnet1.vm 0730 2e 62 61 73 65 30 84 00 00 00 4a 04 0f 6c 64 61 .base0....J..lda 0740 70 53 65 72 76 69 63 65 4e 61 6d 65 31 84 00 00 pServiceName1... 0750 00 33 04 31 77 32 6b 33 2e 76 6d 6e 65 74 31 2e .3.1w2k3.vmnet1. 0760 76 6d 2e 62 61 73 65 3a 77 32 6b 33 2d 31 30 31 vm.base:w2k3-101 0770 24 40 57 32 4b 33 2e 56 4d 4e 45 54 31 2e 56 4d $@W2K3.VMNET1.VM 0780 2e 42 41 53 45 30 84 00 00 00 89 04 0a 73 65 72 .BASE0.......ser 0790 76 65 72 4e 61 6d 65 31 84 00 00 00 77 04 75 43 verName1....w.uC 07a0 4e 3d 57 32 4b 33 2d 31 30 31 2c 43 4e 3d 53 65 N=W2K3-101,CN=Se 07b0 72 76 65 72 73 2c 43 4e 3d 53 74 61 6e 64 61 72 rvers,CN=Standar 07c0 64 6e 61 6d 65 2d 64 65 73 2d 65 72 73 74 65 6e dname-des-ersten 07d0 2d 53 74 61 6e 64 6f 72 74 73 2c 43 4e 3d 53 69 -Standorts,CN=Si 07e0 74 65 73 2c 43 4e 3d 43 6f 6e 66 69 67 75 72 61 tes,CN=Configura 07f0 74 69 6f 6e 2c 44 43 3d 77 32 6b 33 2c 44 43 3d tion,DC=w2k3,DC= 0800 76 6d 6e 65 74 31 2c 44 43 3d 76 6d 2c 44 43 3d vmnet1,DC=vm,DC= 0810 62 61 73 65 30 84 00 00 00 67 04 15 73 75 70 70 base0....g..supp 0820 6f 72 74 65 64 43 61 70 61 62 69 6c 69 74 69 65 ortedCapabilitie 0830 73 31 84 00 00 00 4a 04 16 31 2e 32 2e 38 34 30 s1....J..1.2.840 0840 2e 31 31 33 35 35 36 2e 31 2e 34 2e 38 30 30 04 .113556.1.4.800. 0850 17 31 2e 32 2e 38 34 30 2e 31 31 33 35 35 36 2e .1.2.840.113556. 0860 31 2e 34 2e 31 36 37 30 04 17 31 2e 32 2e 38 34 1.4.1670..1.2.84 0870 30 2e 31 31 33 35 35 36 2e 31 2e 34 2e 31 37 39 0.113556.1.4.179 0880 31 30 84 00 00 00 11 02 02 00 d5 65 84 00 00 00 10.........e.... 0890 07 0a 01 00 04 00 04 00 ........ No. Time Source Destination Protocol Info 46 61.574313 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=352 Ack=2201 Win=64240 Len=0 Frame 46 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 352, Ack: 2201, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df d7 40 00 80 06 bf ec ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 45 f8 f8 ed fb 20 50 10 .e.....hE.... P. 0030 fa f0 51 f8 00 00 ac 1f 01 65 c5 d5 ..Q......e.. No. Time Source Destination Protocol Info 47 61.599161 172.31.1.104 172.31.1.101 CLDAP MsgId=229 Search Request, Base DN=(null) Frame 47 (176 bytes on wire, 176 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: submitserver (2028), Dst Port: ldap (389) Lightweight Directory Access Protocol, Search Request Message Id: 229 Message Type: Search Request (0x03) Message Length: 118 Response In: 48 Base DN: (null) Scope: Base (0x00) Dereference: Never (0x00) Size Limit: 0 Time Limit: 0 Attributes Only: False Filter: (&(DnsDomain=W2K3.VMNET1.VM.BASE)(Host=W2K3-104)(NtVer=\006) Attribute: Netlogon 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 a2 df d8 00 00 80 11 ff 66 ac 1f 01 68 ac 1f .........f...h.. 0020 01 65 07 ec 01 85 00 8e a0 16 30 84 00 00 00 80 .e........0..... 0030 02 02 00 e5 63 84 00 00 00 76 04 00 0a 01 00 0a ....c....v...... 0040 01 00 02 01 00 02 01 00 01 01 00 a0 84 00 00 00 ................ 0050 4f a3 84 00 00 00 20 04 09 44 6e 73 44 6f 6d 61 O..... ..DnsDoma 0060 69 6e 04 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e in..W2K3.VMNET1. 0070 56 4d 2e 42 41 53 45 a3 84 00 00 00 10 04 04 48 VM.BASE........H 0080 6f 73 74 04 08 57 32 4b 33 2d 31 30 34 a3 84 00 ost..W2K3-104... 0090 00 00 0d 04 05 4e 74 56 65 72 04 04 06 00 00 21 .....NtVer.....! 00a0 30 84 00 00 00 0a 04 08 4e 65 74 6c 6f 67 6f 6e 0.......Netlogon No. Time Source Destination Protocol Info 48 61.599955 172.31.1.101 172.31.1.104 CLDAP MsgId=229 Search Entry, 1 result Frame 48 (233 bytes on wire, 233 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: ldap (389), Dst Port: submitserver (2028) Lightweight Directory Access Protocol, Search Entry Message Id: 229 Message Type: Search Entry (0x04) Message Length: 152 Response To: 47 Time: 0.000794000 seconds Distinguished Name: (null) Attribute: netlogon Lightweight Directory Access Protocol, Search Result Message Id: 229 Message Type: Search Result (0x05) Message Length: 7 Response To: 47 Time: 0.000794000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 db 2d cd 00 00 80 11 b1 39 ac 1f 01 65 ac 1f ..-......9...e.. 0020 01 68 01 85 07 ec 00 c7 f8 77 30 84 00 00 00 a2 .h.......w0..... 0030 02 02 00 e5 64 84 00 00 00 98 04 00 30 84 00 00 ....d.......0... 0040 00 90 30 84 00 00 00 8a 04 08 6e 65 74 6c 6f 67 ..0.......netlog 0050 6f 6e 31 84 00 00 00 7a 04 78 17 00 00 00 fd 03 on1....z.x...... 0060 00 00 89 d3 ef 99 2f 50 3f 4d ae fb e7 a1 d9 ac ....../P?M...... 0070 fb 2f 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 76 ./.w2k3.vmnet1.v 0080 6d 04 62 61 73 65 00 c0 18 08 77 32 6b 33 2d 31 m.base....w2k3-1 0090 30 31 c0 18 04 57 32 4b 33 00 08 57 32 4b 33 2d 01...W2K3..W2K3- 00a0 31 30 31 00 00 21 53 74 61 6e 64 61 72 64 6e 61 101..!Standardna 00b0 6d 65 2d 64 65 73 2d 65 72 73 74 65 6e 2d 53 74 me-des-ersten-St 00c0 61 6e 64 6f 72 74 73 00 c0 4b 05 00 00 00 ff ff andorts..K...... 00d0 ff ff 30 84 00 00 00 11 02 02 00 e5 65 84 00 00 ..0.........e... 00e0 00 07 0a 01 00 04 00 04 00 ......... No. Time Source Destination Protocol Info 49 61.714118 172.31.1.104 172.31.1.101 KRB5 TGS-REQ Frame 49 (1406 bytes on wire, 1406 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 2029 (2029), Dst Port: kerberos (88) Kerberos TGS-REQ Pvno: 5 MSG Type: TGS-REQ (12) padata: PA-TGS-REQ KDC_REQ_BODY 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 70 df d9 00 00 80 11 fa 97 ac 1f 01 68 ac 1f .p...........h.. 0020 01 65 07 ed 00 58 05 5c 91 01 6c 82 05 50 30 82 .e...X.\..l..P0. 0030 05 4c a1 03 02 01 05 a2 03 02 01 0c a3 82 04 a3 .L.............. 0040 30 82 04 9f 30 82 04 9b a1 03 02 01 01 a2 82 04 0...0........... 0050 92 04 82 04 8e 6e 82 04 8a 30 82 04 86 a0 03 02 .....n...0...... 0060 01 05 a1 03 02 01 0e a2 07 03 05 00 00 00 00 00 ................ 0070 a3 82 03 c6 61 82 03 c2 30 82 03 be a0 03 02 01 ....a...0....... 0080 05 a1 1a 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 .....SUB1.W2K3.V 0090 4d 4e 45 54 31 2e 56 4d 2e 42 41 53 45 a2 28 30 MNET1.VM.BASE.(0 00a0 26 a0 03 02 01 02 a1 1f 30 1d 1b 06 6b 72 62 74 &.......0...krbt 00b0 67 74 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e gt..W2K3.VMNET1. 00c0 56 4d 2e 42 41 53 45 a3 82 03 6f 30 82 03 6b a0 VM.BASE...o0..k. 00d0 03 02 01 17 a2 82 03 62 04 82 03 5e 9c ea 3a 59 .......b...^..:Y 00e0 8f 11 d9 c1 64 78 98 6b 23 da 0d c8 21 c3 d1 3f ....dx.k#...!..? 00f0 ca c6 5d 99 3c 0d ff 83 40 9f f0 12 ab d0 e1 34 ..].<...@......4 0100 81 da de 2f d0 37 54 38 d6 14 d9 10 38 51 37 e5 .../.7T8....8Q7. 0110 87 47 76 ab db 6e 52 69 67 40 f9 dc 9c 51 06 1e .Gv..nRig@...Q.. 0120 f7 42 21 11 2d f4 ef ff e3 af 54 1b 2d 9c e6 13 .B!.-.....T.-... 0130 a4 e8 94 80 59 02 30 3e e9 0e a9 e1 63 15 0e 5c ....Y.0>....c..\ 0140 10 2a 4e bc 35 75 87 5e 24 f1 80 d6 1a 0b 41 46 .*N.5u.^$.....AF 0150 78 f0 87 83 2c 97 73 d7 41 f6 c4 8f 91 fc 04 de x...,.s.A....... 0160 b0 fa 8f f9 2b d4 64 90 fd aa f3 64 67 84 8a 94 ....+.d....dg... 0170 f9 64 9a 40 6f d3 08 e6 e5 5e 6b f8 e9 3a a5 58 .d.@o....^k..:.X 0180 05 e3 0e af 04 c4 a4 8a 90 aa e2 4f ea 7e c8 b7 ...........O.~.. 0190 af 26 2e 66 ad ee be 82 50 30 29 f4 dd 59 66 fc .&.f....P0)..Yf. 01a0 72 cb 95 5b 92 d6 30 87 96 52 77 63 8b 3c 56 a7 r..[..0..Rwc..-.].B2. 02d0 62 e9 9d 65 aa dd 47 e6 38 a5 1c 1e f8 fa 02 8f b..e..G.8....... 02e0 ae 01 95 9f ea 4e fe 3f 8e 89 e3 b5 f8 a2 f1 47 .....N.?.......G 02f0 42 9c d7 5c 2f 02 c2 bf 40 94 59 a6 95 e0 36 bc B..\/...@.Y...6. 0300 c2 de fc d2 e5 15 e9 e8 f0 67 ba 55 f4 f4 c7 6a .........g.U...j 0310 76 f9 f8 e3 9b b8 a7 e5 7f 2e 67 50 06 d2 fa 44 v.........gP...D 0320 62 d0 74 4b 25 54 96 a6 0b d8 41 32 13 8e 2f 0a b.tK%T....A2../. 0330 d4 c2 14 6f d4 49 84 69 46 d1 68 35 53 e6 37 e2 ...o.I.iF.h5S.7. 0340 a9 58 11 fb f3 16 af 81 07 fd b9 e5 f4 13 05 5f .X............._ 0350 0a ad f2 29 48 12 3e 18 70 a3 ae e8 97 79 c5 4c ...)H.>.p....y.L 0360 31 6f 65 37 ae b9 c3 3a fa 28 25 c6 04 39 7e a5 1oe7...:.(%..9~. 0370 63 81 14 1b 53 bb 57 77 ef ba 84 d4 62 5b 6a 93 c...S.Ww....b[j. 0380 1b af 82 72 f9 7f 5a 15 2a 79 02 0e a9 43 e8 34 ...r..Z.*y...C.4 0390 86 ff 7b de ad d5 f1 5e e4 33 ad bc ee f8 a1 c7 ..{....^.3...... 03a0 58 e6 d1 8f 30 89 8f da f1 4f f1 2b d8 de 65 0f X...0....O.+..e. 03b0 fe 0d ac 48 d1 6a 2f da d3 ba 37 c6 e1 1e c8 8c ...H.j/...7..... 03c0 30 d4 fc 39 84 60 84 10 e9 0a d6 3d 90 a0 6f 1e 0..9.`.....=..o. 03d0 95 16 b6 7a 02 20 d2 92 68 9c e0 49 64 40 8e 17 ...z. ..h..Id@.. 03e0 a0 5c d4 a4 97 90 52 91 3b c5 91 bc f2 4a ea fb .\....R.;....J.. 03f0 ad 99 6a 94 a1 b2 ed d2 1d ae 94 8b 0f ab df 35 ..j............5 0400 fa e5 bd 41 00 5a e9 ba 58 58 90 a5 3a fe 7d 6a ...A.Z..XX..:.}j 0410 15 75 41 dc 95 e4 46 a1 47 38 89 07 71 7f 39 c0 .uA...F.G8..q.9. 0420 57 23 f7 1a 2c a0 28 78 c1 4a ab 7a c8 02 75 c7 W#..,.(x.J.z..u. 0430 46 fc f3 9d 63 39 80 a4 1e 85 a4 81 a6 30 81 a3 F...c9.......0.. 0440 a0 03 02 01 17 a2 81 9b 04 81 98 04 22 fa 5c 23 ............".\# 0450 04 2b 12 7c af 9b b5 76 ca 6e 5f 39 2d 0d 50 0a .+.|...v.n_9-.P. 0460 a6 5a 3c 24 92 da dc 7a 85 f6 d1 93 5d 55 dd 35 .Z<$...z....]U.5 0470 80 3e b5 b8 97 48 cb 8c 40 bd b3 7d 2b 2e 78 df .>...H..@..}+.x. 0480 c7 c1 fc cf 7b 71 e9 46 a2 ec 38 8b 10 72 3b 16 ....{q.F..8..r;. 0490 b8 a3 e2 8f 90 59 d7 55 24 26 6a 28 c5 38 a4 6d .....Y.U$&j(.8.m 04a0 ac 02 e1 ba 74 f4 6e b2 b0 bb 1b 46 a2 be 73 b6 ....t.n....F..s. 04b0 2a b0 23 9b 51 1d 7e c8 f5 9d 6e c8 5c 84 54 09 *.#.Q.~...n.\.T. 04c0 48 38 3c e2 4f fb cb 37 9a f3 ca bc 31 f7 23 93 H8<.O..7....1.#. 04d0 95 54 bc 5a 81 8f e2 f5 d3 2d ec 59 05 4b b0 fc .T.Z.....-.Y.K.. 04e0 43 33 64 a4 81 98 30 81 95 a0 07 03 05 00 40 81 C3d...0.......@. 04f0 00 00 a2 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 ......W2K3.VMNET 0500 31 2e 56 4d 2e 42 41 53 45 a3 44 30 42 a0 03 02 1.VM.BASE.D0B... 0510 01 02 a1 3b 30 39 1b 04 6c 64 61 70 1b 1c 77 32 ...;09..ldap..w2 0520 6b 33 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 k3-101.w2k3.vmne 0530 74 31 2e 76 6d 2e 62 61 73 65 1b 13 77 32 6b 33 t1.vm.base..w2k3 0540 2e 76 6d 6e 65 74 31 2e 76 6d 2e 62 61 73 65 a5 .vmnet1.vm.base. 0550 11 18 0f 32 30 33 37 30 39 31 33 30 32 34 38 30 ...2037091302480 0560 35 5a a7 06 02 04 3d 50 c7 15 a8 12 30 10 02 01 5Z....=P....0... 0570 17 02 01 03 02 01 01 02 01 18 02 02 ff 79 .............y No. Time Source Destination Protocol Info 50 61.717859 172.31.1.101 172.31.1.104 KRB5 TGS-REP Frame 50 (1410 bytes on wire, 1410 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: kerberos (88), Dst Port: 2029 (2029) Kerberos TGS-REP Pvno: 5 MSG Type: TGS-REP (13) Client Realm: SUB1.W2K3.VMNET1.VM.BASE Client Name (Principal): Administrator Ticket enc-part rc4-hmac Frame (1410 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 74 2d ce 00 00 80 11 ac 9f ac 1f 01 65 ac 1f .t-..........e.. 0020 01 68 00 58 07 ed 05 60 49 13 6d 82 05 54 30 82 .h.X...`I.m..T0. 0030 05 50 a0 03 02 01 05 a1 03 02 01 0d a3 1a 1b 18 .P.............. 0040 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 SUB1.W2K3.VMNET1 0050 2e 56 4d 2e 42 41 53 45 a4 1a 30 18 a0 03 02 01 .VM.BASE..0..... 0060 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 74 72 ...0...Administr 0070 61 74 6f 72 a5 82 03 e2 61 82 03 de 30 82 03 da ator....a...0... 0080 a0 03 02 01 05 a1 15 1b 13 57 32 4b 33 2e 56 4d .........W2K3.VM 0090 4e 45 54 31 2e 56 4d 2e 42 41 53 45 a2 44 30 42 NET1.VM.BASE.D0B 00a0 a0 03 02 01 02 a1 3b 30 39 1b 04 6c 64 61 70 1b ......;09..ldap. 00b0 1c 77 32 6b 33 2d 31 30 31 2e 77 32 6b 33 2e 76 .w2k3-101.w2k3.v 00c0 6d 6e 65 74 31 2e 76 6d 2e 62 61 73 65 1b 13 77 mnet1.vm.base..w 00d0 32 6b 33 2e 76 6d 6e 65 74 31 2e 76 6d 2e 62 61 2k3.vmnet1.vm.ba 00e0 73 65 a3 82 03 74 30 82 03 70 a0 03 02 01 17 a1 se...t0..p...... 00f0 03 02 01 0a a2 82 03 62 04 82 03 5e d9 a1 1c f6 .......b...^.... 0100 f9 37 05 65 ec a5 7c 87 ef 88 07 97 c1 d2 ee 26 .7.e..|........& 0110 27 d7 ef 86 ac 0b 6b f3 81 d6 2e eb 49 22 b1 9c '.....k.....I".. 0120 8a 57 76 c9 49 7b 6d 2e 8f 38 b0 4a c8 ca a3 82 .Wv.I{m..8.J.... 0130 38 c8 90 c3 6f 50 35 1f 31 f7 7a 3e 63 c7 e1 18 8...oP5.1.z>c... 0140 fd 4a 92 e6 c1 af 9f d4 10 9c 9d 1e bf 9f af a2 .J.............. 0150 e7 91 d5 5a 8c 6c 3c b1 6f 31 94 3e 7a 6b 7a 63 ...Z.l<.o1.>zkzc 0160 d0 c9 d4 8e f1 7d 02 ae 6d b0 33 64 7d d9 d3 8e .....}..m.3d}... 0170 a7 cf 9d 5c ae 12 c7 f7 a7 35 c5 51 d6 25 51 49 ...\.....5.Q.%QI 0180 92 13 34 ef 59 47 03 fd ce 02 dd c0 0d eb 2d 7f ..4.YG........-. 0190 67 74 b9 56 37 da 39 87 a4 d6 88 22 96 cc 89 76 gt.V7.9...."...v 01a0 b7 b5 05 a8 c0 b7 84 0a 7e 10 7d a0 6e 9f b3 4f ........~.}.n..O 01b0 1b 4c 69 f1 a2 0b 8d 94 d5 b1 b3 75 5e ee c4 cf .Li........u^... 01c0 73 a8 73 e4 03 e6 78 a1 f3 37 84 41 98 c8 ad 2b s.s...x..7.A...+ 01d0 98 fa 14 59 0b 5c 52 b3 58 73 d1 3f f0 47 e5 96 ...Y.\R.Xs.?.G.. 01e0 d0 df f6 b8 1f ec 74 fe 17 90 db ba 88 de 7b b3 ......t.......{. 01f0 e7 2d 03 19 98 03 0c 6d 6e 2d f8 1b f2 cf da 02 .-.....mn-...... 0200 4b 10 a8 7c 50 aa 2b ff fc 2c b7 a8 15 8a a9 ae K..|P.+..,...... 0210 5f 9a d2 8e f4 4b ae b6 fa 47 21 d7 56 4e bd d2 _....K...G!.VN.. 0220 c2 69 eb e3 52 1c 70 5d 59 e9 3f 83 7f 49 c2 ce .i..R.p]Y.?..I.. 0230 5a 50 c0 d7 71 a6 4a 0a a7 9d 3b f4 1c 8b 4f 02 ZP..q.J...;...O. 0240 dc 97 5e c9 f7 db 77 2f 9b 79 d4 95 95 65 3d 88 ..^...w/.y...e=. 0250 21 b9 85 cf ee 18 d8 ab 89 87 4c 56 3a fe c9 45 !.........LV:..E 0260 75 72 b8 59 55 c0 11 fe f4 97 a1 c9 45 21 54 af ur.YU.......E!T. 0270 94 e4 6b 08 34 45 ff b7 31 49 84 1f 96 b8 33 84 ..k.4E..1I....3. 0280 6b e4 3e 06 d8 e7 f4 1d 33 de f4 01 e8 64 b3 86 k.>.....3....d.. 0290 24 59 8e 99 4b 1c 04 11 0d 06 88 bf 43 f1 59 b2 $Y..K.......C.Y. 02a0 99 69 00 41 45 32 aa 17 09 d2 ea 6c 80 af 79 99 .i.AE2.....l..y. 02b0 3e 37 d5 ac b7 27 26 f9 a6 18 9a 08 93 c5 cc d0 >7...'&......... 02c0 46 e7 04 b5 21 9c 2b ca 54 c9 8c 44 1c 64 24 3f F...!.+.T..D.d$? 02d0 a2 fb c8 4f 8d 40 be 7a 10 a0 dc b5 bd 4a ec b5 ...O.@.z.....J.. 02e0 9f 7f 76 7a 26 81 82 a5 94 aa 45 bb 1b 44 dd 68 ..vz&.....E..D.h 02f0 bc c9 3e 3e 45 f3 c7 42 35 f4 bd dd 82 1a ad f4 ..>>E..B5....... 0300 aa 2f 1c 89 da 21 70 54 45 8b 48 41 49 a3 52 d9 ./...!pTE.HAI.R. 0310 61 78 00 33 a5 c6 17 f0 8d a3 fe d4 7e 73 d3 9b ax.3........~s.. 0320 4b 14 15 22 03 93 96 85 a9 58 bb dd 7e 95 5d d7 K..".....X..~.]. 0330 86 67 6c a5 17 bd fc a2 0c f2 4e 3f c2 c4 8a 23 .gl.......N?...# 0340 69 94 0d 5a 5b 25 f1 0b f4 f1 24 a3 18 ce 9a 73 i..Z[%....$....s 0350 2f f4 a3 c4 d4 ef c5 79 4e 56 d8 28 7d 14 99 f4 /......yNV.(}... 0360 83 de 79 44 4b f2 bd 07 46 2d 43 e3 cc 74 fd bc ..yDK...F-C..t.. 0370 88 3b 78 c3 80 57 be 57 b5 1d b8 44 cf 2e bd 52 .;x..W.W...D...R 0380 c7 42 3d b6 54 10 0c 2c 66 b9 14 f7 1e fa 55 6e .B=.T..,f.....Un 0390 35 3c 7f 96 e0 f9 55 62 3c 3e a2 33 a3 74 75 c2 5<....Ub<>.3.tu. 03a0 a5 80 f8 f3 c0 19 fb f0 12 3b 25 53 d7 44 c0 ee .........;%S.D.. 03b0 f5 e9 f5 d6 c1 7e a8 6e af 97 5b 68 ed 9f 87 ec .....~.n..[h.... 03c0 22 97 b5 45 ea 34 fa c9 b3 9d c7 6a 4e 37 c7 f8 "..E.4.....jN7.. 03d0 65 53 80 0b e6 ad 47 05 5e b9 fa c2 d7 81 4f 52 eS....G.^.....OR 03e0 3d 8e 3b de 86 e5 35 1a 07 23 e9 ac dd 4e 2c 4c =.;...5..#...N,L 03f0 23 02 bc 80 d2 1f 3f b3 30 b4 91 db 85 02 39 a2 #.....?.0.....9. 0400 83 0f d6 53 4f d3 c4 31 7e 18 92 d1 e2 a9 ba a6 ...SO..1~....... 0410 d6 3a 98 07 4c 1e 4c f7 bf f8 0f 00 b0 8e 6b d1 .:..L.L.......k. 0420 6f f5 e0 cb 7f c7 bc 77 b9 0f c8 50 5b fe ad d2 o......w...P[... 0430 71 d6 81 4e c1 d4 54 a9 ec ac d0 e5 66 be 48 90 q..N..T.....f.H. 0440 6b 12 9b 2e d9 bc 9b 21 d1 38 cc b2 10 6c a7 0b k......!.8...l.. 0450 0b 60 4e 28 6e 33 5e 1c c8 e5 a6 82 01 24 30 82 .`N(n3^......$0. 0460 01 20 a0 03 02 01 17 a2 82 01 17 04 82 01 13 9f . .............. 0470 c4 66 96 49 c0 1b ca f7 6b c2 01 07 e4 01 43 f8 .f.I....k.....C. 0480 00 37 4d b6 60 9f e2 68 fe 45 98 bf 55 73 c2 b4 .7M.`..h.E..Us.. 0490 87 c5 95 79 e1 d6 55 e4 ba 6a 85 3a 98 0c 3b 85 ...y..U..j.:..;. 04a0 56 38 70 1b fd d0 26 03 51 f5 d8 5c 9f 2d 5c 4d V8p...&.Q..\.-\M 04b0 c0 d6 dd 05 38 1f b8 6a c2 0e fd b6 6d 5d b2 b6 ....8..j....m].. 04c0 2b 8b 55 12 13 7f 5e ea b9 3b 87 6f 22 45 46 ef +.U...^..;.o"EF. 04d0 6d 9e f2 d2 1e 15 25 e7 dc 33 14 d4 96 df ee 95 m.....%..3...... 04e0 67 aa e7 d5 dc 76 ce 33 b7 0d 3f b2 c1 af cd 39 g....v.3..?....9 04f0 23 1a d3 20 45 76 d4 39 19 f0 a2 38 df 75 02 ec #.. Ev.9...8.u.. 0500 87 db 2b e6 81 cf f5 cd 8a 05 91 b0 e0 e6 8b d4 ..+............. 0510 4a de d4 55 27 09 cc 22 e9 d7 77 e3 21 5b 1a 89 J..U'.."..w.![.. 0520 80 c0 0a 8d d7 c5 40 c7 d7 c7 6d 4c 2b f2 4d 13 ......@...mL+.M. 0530 16 f5 f8 14 79 a4 68 39 3f 60 90 40 36 ec b0 01 ....y.h9?`.@6... 0540 2e a1 39 5a 9e eb d4 a2 80 c4 1f 19 d9 80 89 42 ..9Z...........B 0550 ea fc de 6a 0b 85 27 85 9d c8 af 92 ac 19 f3 4e ...j..'........N 0560 7b ec 10 2e f0 9e 86 90 72 0f ac 2b c8 cf 71 43 {.......r..+..qC 0570 d2 c3 12 a2 bd 85 62 d6 98 b3 cc c5 06 bb 3d 19 ......b.......=. 0580 10 14 .. Decrypted Krb5 (862 bytes): 0000 63 82 03 42 30 82 03 3e a0 07 03 05 00 40 a4 00 c..B0..>.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 fb 75 ...0...........u 0020 a3 6a d8 e6 01 7c b4 64 bd da 1a dc 09 28 a2 1a .j...|.d.....(.. 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 1a 30 18 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 .....0...Adminis 0060 74 72 61 74 6f 72 a4 0b 30 09 a0 03 02 01 01 a1 trator..0....... 0070 02 04 00 a5 11 18 0f 32 30 30 35 30 33 30 36 30 .......200503060 0080 39 30 38 33 35 5a a6 11 18 0f 32 30 30 35 30 33 90835Z....200503 0090 30 36 30 39 30 39 34 33 5a a7 11 18 0f 32 30 30 06090943Z....200 00a0 35 30 33 30 36 31 39 30 38 33 35 5a a8 11 18 0f 50306190835Z.... 00b0 32 30 30 35 30 33 31 33 30 39 30 38 33 35 5a aa 20050313090835Z. 00c0 82 02 83 30 82 02 7f 30 82 02 7b a0 03 02 01 01 ...0...0..{..... 00d0 a1 82 02 72 04 82 02 6e 30 82 02 6a 30 82 02 66 ...r...n0..j0..f 00e0 a0 04 02 02 00 80 a1 82 02 5c 04 82 02 58 04 00 .........\...X.. 00f0 00 00 00 00 00 00 01 00 00 00 b8 01 00 00 48 00 ..............H. 0100 00 00 00 00 00 00 0a 00 00 00 24 00 00 00 00 02 ..........$..... 0110 00 00 00 00 00 00 06 00 00 00 14 00 00 00 28 02 ..............(. 0120 00 00 00 00 00 00 07 00 00 00 14 00 00 00 40 02 ..............@. 0130 00 00 00 00 00 00 01 10 08 00 cc cc cc cc a8 01 ................ 0140 00 00 00 00 00 00 00 00 02 00 12 96 28 c4 6c 12 ............(.l. 0150 c5 01 ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ................ 0160 ff 7f ae 05 77 89 40 72 c4 01 ae c5 e0 b3 09 73 ....w.@r.......s 0170 c4 01 ff ff ff ff ff ff ff 7f 1a 00 1a 00 04 00 ................ 0180 02 00 00 00 00 00 08 00 02 00 00 00 00 00 0c 00 ................ 0190 02 00 00 00 00 00 10 00 02 00 00 00 00 00 14 00 ................ 01a0 02 00 00 00 00 00 18 00 02 00 0f 00 00 00 f4 01 ................ 01b0 00 00 01 02 00 00 03 00 00 00 1c 00 02 00 20 00 .............. . 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 10 00 12 00 20 00 02 00 08 00 0a 00 24 00 ...... .......$. 01e0 02 00 28 00 02 00 00 00 00 00 00 00 00 00 10 02 ..(............. 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 41 00 ..............A. 0230 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 d.m.i.n.i.s.t.r. 0240 61 00 74 00 6f 00 72 00 00 00 00 00 00 00 00 00 a.t.o.r......... 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280 00 00 00 00 00 00 03 00 00 00 00 02 00 00 07 00 ................ 0290 00 00 08 02 00 00 07 00 00 00 01 02 00 00 07 00 ................ 02a0 00 00 09 00 00 00 00 00 00 00 08 00 00 00 57 00 ..............W. 02b0 32 00 4b 00 33 00 2d 00 31 00 30 00 34 00 05 00 2.K.3.-.1.0.4... 02c0 00 00 00 00 00 00 04 00 00 00 53 00 55 00 42 00 ..........S.U.B. 02d0 31 00 04 00 00 00 01 04 00 00 00 00 00 05 15 00 1............... 02e0 00 00 39 15 ce fd e9 c3 37 9b 6f 15 38 1a 80 eb ..9.....7.o.8... 02f0 70 13 2c 22 c5 01 1a 00 41 00 64 00 6d 00 69 00 p.,"....A.d.m.i. 0300 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 n.i.s.t.r.a.t.o. 0310 72 00 00 00 00 00 76 ff ff ff d5 af 37 d7 1b 7e r.....v.....7..~ 0320 3b 3d db 15 2c 67 5b 6e 8f fe 00 00 00 00 76 ff ;=..,g[n......v. 0330 ff ff 19 01 28 c4 3c 29 04 39 1f 56 1a 2f 0e a0 ....(.<).9.V./.. 0340 e5 78 00 00 00 00 76 ff ff ff 19 01 31 00 00 00 .x....v.....1... 0350 f0 d1 5f 08 f0 57 1b 41 e5 78 00 00 00 00 .._..W.A.x.... No. Time Source Destination Protocol Info 51 61.719760 172.31.1.104 172.31.1.101 LDAP MsgId=215 Bind Request, DN=(null) Frame 51 (1415 bytes on wire, 1415 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 352, Ack: 2201, Len: 1361 Lightweight Directory Access Protocol, Bind Request Message Id: 215 Message Type: Bind Request (0x00) Message Length: 1345 Response In: 52 Version: 3 DN: (null) Auth Type: SASL (0x03) Mechanism: GSS-SPNEGO GSS-API Token GSS-API OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) SPNEGO negTokenInit mechType mechToken krb5_blob: 608204E006092A864886F71201020201006E8204CF308204... OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_tok_id: KRB5_AP_REQ (0x0001) Kerberos AP-REQ Pvno: 5 MSG Type: AP-REQ (14) Padding: 0 APOptions: 20000000 (Mutual required) Ticket Authenticator rc4-hmac Encryption type: rc4-hmac (23) Authenticator data: 2DC09668FF56CD93F127B34DED0035BBD5DE99155545BC02... [Decrypted using: key learnt from frame 51] Authenticator Authenticator vno: 5 Client Realm: SUB1.W2K3.VMNET1.VM.BASE Client Name (Principal): Administrator Checksum cusec: 429176 ctime: 2005-03-06 09:09:43 (Z) Subkey rc4-hmac Key type: rc4-hmac (23) Key value: 424DADC425CAD9F72FC0738503FD1A12 Seq Number: 1027618070 Frame (1415 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 79 df da 40 00 80 06 ba 98 ac 1f 01 68 ac 1f .y..@........h.. 0020 01 65 07 eb 01 85 c4 68 45 f8 f8 ed fb 20 50 18 .e.....hE.... P. 0030 fa f0 f5 2c 00 00 30 84 00 00 05 4b 02 02 00 d7 ...,..0....K.... 0040 60 84 00 00 05 41 02 01 03 04 00 a3 84 00 00 05 `....A.......... 0050 36 04 0a 47 53 53 2d 53 50 4e 45 47 4f 04 82 05 6..GSS-SPNEGO... 0060 26 60 82 05 22 06 06 2b 06 01 05 05 02 a0 82 05 &`.."..+........ 0070 16 30 82 05 12 a0 24 30 22 06 09 2a 86 48 82 f7 .0....$0"..*.H.. 0080 12 01 02 02 06 09 2a 86 48 86 f7 12 01 02 02 06 ......*.H....... 0090 0a 2b 06 01 04 01 82 37 02 02 0a a2 82 04 e8 04 .+.....7........ 00a0 82 04 e4 60 82 04 e0 06 09 2a 86 48 86 f7 12 01 ...`.....*.H.... 00b0 02 02 01 00 6e 82 04 cf 30 82 04 cb a0 03 02 01 ....n...0....... 00c0 05 a1 03 02 01 0e a2 07 03 05 00 20 00 00 00 a3 ........... .... 00d0 82 03 e2 61 82 03 de 30 82 03 da a0 03 02 01 05 ...a...0........ 00e0 a1 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e ....W2K3.VMNET1. 00f0 56 4d 2e 42 41 53 45 a2 44 30 42 a0 03 02 01 02 VM.BASE.D0B..... 0100 a1 3b 30 39 1b 04 6c 64 61 70 1b 1c 77 32 6b 33 .;09..ldap..w2k3 0110 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 -101.w2k3.vmnet1 0120 2e 76 6d 2e 62 61 73 65 1b 13 77 32 6b 33 2e 76 .vm.base..w2k3.v 0130 6d 6e 65 74 31 2e 76 6d 2e 62 61 73 65 a3 82 03 mnet1.vm.base... 0140 74 30 82 03 70 a0 03 02 01 17 a1 03 02 01 0a a2 t0..p........... 0150 82 03 62 04 82 03 5e d9 a1 1c f6 f9 37 05 65 ec ..b...^.....7.e. 0160 a5 7c 87 ef 88 07 97 c1 d2 ee 26 27 d7 ef 86 ac .|........&'.... 0170 0b 6b f3 81 d6 2e eb 49 22 b1 9c 8a 57 76 c9 49 .k.....I"...Wv.I 0180 7b 6d 2e 8f 38 b0 4a c8 ca a3 82 38 c8 90 c3 6f {m..8.J....8...o 0190 50 35 1f 31 f7 7a 3e 63 c7 e1 18 fd 4a 92 e6 c1 P5.1.z>c....J... 01a0 af 9f d4 10 9c 9d 1e bf 9f af a2 e7 91 d5 5a 8c ..............Z. 01b0 6c 3c b1 6f 31 94 3e 7a 6b 7a 63 d0 c9 d4 8e f1 l<.o1.>zkzc..... 01c0 7d 02 ae 6d b0 33 64 7d d9 d3 8e a7 cf 9d 5c ae }..m.3d}......\. 01d0 12 c7 f7 a7 35 c5 51 d6 25 51 49 92 13 34 ef 59 ....5.Q.%QI..4.Y 01e0 47 03 fd ce 02 dd c0 0d eb 2d 7f 67 74 b9 56 37 G........-.gt.V7 01f0 da 39 87 a4 d6 88 22 96 cc 89 76 b7 b5 05 a8 c0 .9...."...v..... 0200 b7 84 0a 7e 10 7d a0 6e 9f b3 4f 1b 4c 69 f1 a2 ...~.}.n..O.Li.. 0210 0b 8d 94 d5 b1 b3 75 5e ee c4 cf 73 a8 73 e4 03 ......u^...s.s.. 0220 e6 78 a1 f3 37 84 41 98 c8 ad 2b 98 fa 14 59 0b .x..7.A...+...Y. 0230 5c 52 b3 58 73 d1 3f f0 47 e5 96 d0 df f6 b8 1f \R.Xs.?.G....... 0240 ec 74 fe 17 90 db ba 88 de 7b b3 e7 2d 03 19 98 .t.......{..-... 0250 03 0c 6d 6e 2d f8 1b f2 cf da 02 4b 10 a8 7c 50 ..mn-......K..|P 0260 aa 2b ff fc 2c b7 a8 15 8a a9 ae 5f 9a d2 8e f4 .+..,......_.... 0270 4b ae b6 fa 47 21 d7 56 4e bd d2 c2 69 eb e3 52 K...G!.VN...i..R 0280 1c 70 5d 59 e9 3f 83 7f 49 c2 ce 5a 50 c0 d7 71 .p]Y.?..I..ZP..q 0290 a6 4a 0a a7 9d 3b f4 1c 8b 4f 02 dc 97 5e c9 f7 .J...;...O...^.. 02a0 db 77 2f 9b 79 d4 95 95 65 3d 88 21 b9 85 cf ee .w/.y...e=.!.... 02b0 18 d8 ab 89 87 4c 56 3a fe c9 45 75 72 b8 59 55 .....LV:..Eur.YU 02c0 c0 11 fe f4 97 a1 c9 45 21 54 af 94 e4 6b 08 34 .......E!T...k.4 02d0 45 ff b7 31 49 84 1f 96 b8 33 84 6b e4 3e 06 d8 E..1I....3.k.>.. 02e0 e7 f4 1d 33 de f4 01 e8 64 b3 86 24 59 8e 99 4b ...3....d..$Y..K 02f0 1c 04 11 0d 06 88 bf 43 f1 59 b2 99 69 00 41 45 .......C.Y..i.AE 0300 32 aa 17 09 d2 ea 6c 80 af 79 99 3e 37 d5 ac b7 2.....l..y.>7... 0310 27 26 f9 a6 18 9a 08 93 c5 cc d0 46 e7 04 b5 21 '&.........F...! 0320 9c 2b ca 54 c9 8c 44 1c 64 24 3f a2 fb c8 4f 8d .+.T..D.d$?...O. 0330 40 be 7a 10 a0 dc b5 bd 4a ec b5 9f 7f 76 7a 26 @.z.....J....vz& 0340 81 82 a5 94 aa 45 bb 1b 44 dd 68 bc c9 3e 3e 45 .....E..D.h..>>E 0350 f3 c7 42 35 f4 bd dd 82 1a ad f4 aa 2f 1c 89 da ..B5......../... 0360 21 70 54 45 8b 48 41 49 a3 52 d9 61 78 00 33 a5 !pTE.HAI.R.ax.3. 0370 c6 17 f0 8d a3 fe d4 7e 73 d3 9b 4b 14 15 22 03 .......~s..K..". 0380 93 96 85 a9 58 bb dd 7e 95 5d d7 86 67 6c a5 17 ....X..~.]..gl.. 0390 bd fc a2 0c f2 4e 3f c2 c4 8a 23 69 94 0d 5a 5b .....N?...#i..Z[ 03a0 25 f1 0b f4 f1 24 a3 18 ce 9a 73 2f f4 a3 c4 d4 %....$....s/.... 03b0 ef c5 79 4e 56 d8 28 7d 14 99 f4 83 de 79 44 4b ..yNV.(}.....yDK 03c0 f2 bd 07 46 2d 43 e3 cc 74 fd bc 88 3b 78 c3 80 ...F-C..t...;x.. 03d0 57 be 57 b5 1d b8 44 cf 2e bd 52 c7 42 3d b6 54 W.W...D...R.B=.T 03e0 10 0c 2c 66 b9 14 f7 1e fa 55 6e 35 3c 7f 96 e0 ..,f.....Un5<... 03f0 f9 55 62 3c 3e a2 33 a3 74 75 c2 a5 80 f8 f3 c0 .Ub<>.3.tu...... 0400 19 fb f0 12 3b 25 53 d7 44 c0 ee f5 e9 f5 d6 c1 ....;%S.D....... 0410 7e a8 6e af 97 5b 68 ed 9f 87 ec 22 97 b5 45 ea ~.n..[h...."..E. 0420 34 fa c9 b3 9d c7 6a 4e 37 c7 f8 65 53 80 0b e6 4.....jN7..eS... 0430 ad 47 05 5e b9 fa c2 d7 81 4f 52 3d 8e 3b de 86 .G.^.....OR=.;.. 0440 e5 35 1a 07 23 e9 ac dd 4e 2c 4c 23 02 bc 80 d2 .5..#...N,L#.... 0450 1f 3f b3 30 b4 91 db 85 02 39 a2 83 0f d6 53 4f .?.0.....9....SO 0460 d3 c4 31 7e 18 92 d1 e2 a9 ba a6 d6 3a 98 07 4c ..1~........:..L 0470 1e 4c f7 bf f8 0f 00 b0 8e 6b d1 6f f5 e0 cb 7f .L.......k.o.... 0480 c7 bc 77 b9 0f c8 50 5b fe ad d2 71 d6 81 4e c1 ..w...P[...q..N. 0490 d4 54 a9 ec ac d0 e5 66 be 48 90 6b 12 9b 2e d9 .T.....f.H.k.... 04a0 bc 9b 21 d1 38 cc b2 10 6c a7 0b 0b 60 4e 28 6e ..!.8...l...`N(n 04b0 33 5e 1c c8 e5 a4 81 cf 30 81 cc a0 03 02 01 17 3^......0....... 04c0 a2 81 c4 04 81 c1 2d c0 96 68 ff 56 cd 93 f1 27 ......-..h.V...' 04d0 b3 4d ed 00 35 bb d5 de 99 15 55 45 bc 02 28 be .M..5.....UE..(. 04e0 ad cb ef d1 79 ea 26 5c 37 e3 b2 08 ec ce dc 94 ....y.&\7....... 04f0 90 8c ab a4 c2 3f f3 b6 56 2a 86 3a 96 49 4f ff .....?..V*.:.IO. 0500 6e fd 33 a0 e5 ab 00 d9 f5 90 02 b9 44 ce 0e 2f n.3.........D../ 0510 af 51 2d 0c 8b 4c f9 53 f9 61 92 82 24 a7 a5 95 .Q-..L.S.a..$... 0520 1d 78 ac f4 df 23 02 85 d4 91 94 b5 4a c4 1e ae .x...#......J... 0530 1c a5 a1 22 53 86 06 64 7a 1b ff 8e d3 ef 06 5f ..."S..dz......_ 0540 60 6c 45 c2 71 e1 2f 73 a0 7c 3e 68 78 07 66 bb `lE.q./s.|>hx.f. 0550 fa c9 f5 1b 07 9c 70 90 93 08 40 ef 60 e2 ce d9 ......p...@.`... 0560 8f b9 d1 19 6f 7c 97 a4 e2 ce 22 1a 23 bd 92 7c ....o|....".#..| 0570 dc 0f 7c 4c f9 41 48 d8 a0 fb f8 c1 a2 09 a5 4c ..|L.AH........L 0580 56 43 cc 20 54 e6 27 VC. T.' Decrypted Krb5 (862 bytes): 0000 63 82 03 42 30 82 03 3e a0 07 03 05 00 40 a4 00 c..B0..>.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 fb 75 ...0...........u 0020 a3 6a d8 e6 01 7c b4 64 bd da 1a dc 09 28 a2 1a .j...|.d.....(.. 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 1a 30 18 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 .....0...Adminis 0060 74 72 61 74 6f 72 a4 0b 30 09 a0 03 02 01 01 a1 trator..0....... 0070 02 04 00 a5 11 18 0f 32 30 30 35 30 33 30 36 30 .......200503060 0080 39 30 38 33 35 5a a6 11 18 0f 32 30 30 35 30 33 90835Z....200503 0090 30 36 30 39 30 39 34 33 5a a7 11 18 0f 32 30 30 06090943Z....200 00a0 35 30 33 30 36 31 39 30 38 33 35 5a a8 11 18 0f 50306190835Z.... 00b0 32 30 30 35 30 33 31 33 30 39 30 38 33 35 5a aa 20050313090835Z. 00c0 82 02 83 30 82 02 7f 30 82 02 7b a0 03 02 01 01 ...0...0..{..... 00d0 a1 82 02 72 04 82 02 6e 30 82 02 6a 30 82 02 66 ...r...n0..j0..f 00e0 a0 04 02 02 00 80 a1 82 02 5c 04 82 02 58 04 00 .........\...X.. 00f0 00 00 00 00 00 00 01 00 00 00 b8 01 00 00 48 00 ..............H. 0100 00 00 00 00 00 00 0a 00 00 00 24 00 00 00 00 02 ..........$..... 0110 00 00 00 00 00 00 06 00 00 00 14 00 00 00 28 02 ..............(. 0120 00 00 00 00 00 00 07 00 00 00 14 00 00 00 40 02 ..............@. 0130 00 00 00 00 00 00 01 10 08 00 cc cc cc cc a8 01 ................ 0140 00 00 00 00 00 00 00 00 02 00 12 96 28 c4 6c 12 ............(.l. 0150 c5 01 ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ................ 0160 ff 7f ae 05 77 89 40 72 c4 01 ae c5 e0 b3 09 73 ....w.@r.......s 0170 c4 01 ff ff ff ff ff ff ff 7f 1a 00 1a 00 04 00 ................ 0180 02 00 00 00 00 00 08 00 02 00 00 00 00 00 0c 00 ................ 0190 02 00 00 00 00 00 10 00 02 00 00 00 00 00 14 00 ................ 01a0 02 00 00 00 00 00 18 00 02 00 0f 00 00 00 f4 01 ................ 01b0 00 00 01 02 00 00 03 00 00 00 1c 00 02 00 20 00 .............. . 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 10 00 12 00 20 00 02 00 08 00 0a 00 24 00 ...... .......$. 01e0 02 00 28 00 02 00 00 00 00 00 00 00 00 00 10 02 ..(............. 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 41 00 ..............A. 0230 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 d.m.i.n.i.s.t.r. 0240 61 00 74 00 6f 00 72 00 00 00 00 00 00 00 00 00 a.t.o.r......... 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280 00 00 00 00 00 00 03 00 00 00 00 02 00 00 07 00 ................ 0290 00 00 08 02 00 00 07 00 00 00 01 02 00 00 07 00 ................ 02a0 00 00 09 00 00 00 00 00 00 00 08 00 00 00 57 00 ..............W. 02b0 32 00 4b 00 33 00 2d 00 31 00 30 00 34 00 05 00 2.K.3.-.1.0.4... 02c0 00 00 00 00 00 00 04 00 00 00 53 00 55 00 42 00 ..........S.U.B. 02d0 31 00 04 00 00 00 01 04 00 00 00 00 00 05 15 00 1............... 02e0 00 00 39 15 ce fd e9 c3 37 9b 6f 15 38 1a 80 eb ..9.....7.o.8... 02f0 70 13 2c 22 c5 01 1a 00 41 00 64 00 6d 00 69 00 p.,"....A.d.m.i. 0300 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 n.i.s.t.r.a.t.o. 0310 72 00 00 00 00 00 76 ff ff ff d5 af 37 d7 1b 7e r.....v.....7..~ 0320 3b 3d db 15 2c 67 5b 6e 8f fe 00 00 00 00 76 ff ;=..,g[n......v. 0330 ff ff 19 01 28 c4 3c 29 04 39 1f 56 1a 2f 0e a0 ....(.<).9.V./.. 0340 e5 78 00 00 00 00 76 ff ff ff 19 01 69 00 00 00 .x....v.....i... 0350 d0 bc 5f 08 28 58 1b 41 64 20 4b 72 62 35 .._.(X.Ad Krb5 Decrypted Krb5 (193 bytes): 0000 62 81 a6 30 81 a3 a0 03 02 01 05 a1 1a 1b 18 53 b..0...........S 0010 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 2e UB1.W2K3.VMNET1. 0020 56 4d 2e 42 41 53 45 a2 1a 30 18 a0 03 02 01 01 VM.BASE..0...... 0030 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 74 72 61 ..0...Administra 0040 74 6f 72 a3 25 30 23 a0 05 02 03 00 80 03 a1 1a tor.%0#......... 0050 04 18 10 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 00 00 00 00 3e 40 00 00 a4 05 02 03 06 8c ......>@........ 0070 78 a5 11 18 0f 32 30 30 35 30 33 30 36 30 39 30 x....20050306090 0080 39 34 33 5a a6 1b 30 19 a0 03 02 01 17 a1 12 04 943Z..0......... 0090 10 42 4d ad c4 25 ca d9 f7 2f c0 73 85 03 fd 1a .BM..%.../.s.... 00a0 12 a7 06 02 04 3d 40 35 16 42 4d ad 29 00 00 00 .....=@5.BM.)... 00b0 58 3b 60 08 e8 57 1b 41 12 a7 06 02 04 3d 40 35 X;`..W.A.....=@5 00c0 16 . No. Time Source Destination Protocol Info 52 61.723159 172.31.1.101 172.31.1.104 LDAP MsgId=215 Bind Result Frame 52 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 2201, Ack: 1713, Len: 191 Lightweight Directory Access Protocol, Bind Result Message Id: 215 Message Type: Bind Result (0x01) Message Length: 175 Response To: 51 Time: 0.003399000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) GSS-API Token GSS-API SPNEGO negTokenTarg Frame (245 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d cf 40 00 80 06 71 36 ac 1f 01 65 ac 1f ..-.@...q6...e.. 0020 01 68 01 85 07 eb f8 ed fb 20 c4 68 4b 49 50 18 .h....... .hKIP. 0030 fa f0 9b 0e 00 00 30 84 00 00 00 b9 02 02 00 d7 ......0......... 0040 61 84 00 00 00 af 0a 01 00 04 00 04 00 87 82 00 a............... 0050 a4 a1 81 a1 30 81 9e a0 03 0a 01 00 a1 0b 06 09 ....0........... 0060 2a 86 48 82 f7 12 01 02 02 a2 81 89 04 81 86 60 *.H............` 0070 81 83 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f ....*.H........o 0080 74 30 72 a0 03 02 01 05 a1 03 02 01 0f a2 66 30 t0r...........f0 0090 64 a0 03 02 01 17 a2 5d 04 5b 78 5b d8 dd 6e 1d d......].[x[..n. 00a0 0f ba 5d 14 c0 6b f9 22 9c 7e d3 b2 dd ff 22 89 ..]..k.".~....". 00b0 36 af 9c 3d 71 96 46 1f 51 38 79 98 e5 70 d5 2f 6..=q.F.Q8y..p./ 00c0 d4 14 5c 8a c1 27 72 d2 3e f8 d1 d7 f6 01 ed c3 ..\..'r.>....... 00d0 42 75 4d 30 f2 3c 07 41 ec 5e d1 e8 8e 9f c1 57 BuM0.<.A.^.....W 00e0 c8 1b e4 17 0f 40 89 59 47 17 3a 33 1f 00 92 cd .....@.YG.:3.... 00f0 a6 d7 20 37 d5 .. 7. Decrypted Krb5 (91 bytes): 0000 7b 41 30 3f a0 11 18 0f 32 30 30 35 30 33 30 36 {A0?....20050306 0010 30 39 30 39 34 33 5a a1 05 02 03 06 8c 78 a2 1b 090943Z......x.. 0020 30 19 a0 03 02 01 17 a1 12 04 10 42 4d ad c4 25 0..........BM..% 0030 ca d9 f7 2f c0 73 85 03 fd 1a 12 a3 06 02 04 3d .../.s.........= 0040 4e 85 26 42 21 00 00 00 44 65 63 72 79 70 74 65 N.&B!...Decrypte 0050 64 20 4b 72 62 35 20 28 39 31 20 d Krb5 (91 No. Time Source Destination Protocol Info 53 61.776759 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 53 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1713, Ack: 2392, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE3D834CCAF2D115421738D7A70858552... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E3D834CCAF2D1154 krb5_sgn_cksum: 21738D7A70858552 krb5_confounder: 8669EBBDE62C1238 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e df db 40 00 80 06 bf 82 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 eb 01 85 c4 68 4b 49 f8 ed fb df 50 18 .e.....hKI....P. 0030 fa 31 a1 e1 00 00 00 00 00 62 60 60 06 09 2a 86 .1.......b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff e3 H............... 0050 d8 34 cc af 2d 11 54 21 73 8d 7a 70 85 85 52 86 .4..-.T!s.zp..R. 0060 69 eb bd e6 2c 12 38 d9 d0 49 c6 58 2c 77 b0 5e i...,.8..I.X,w.^ 0070 23 14 26 6f d0 5c af 4c 6e 80 66 52 36 b1 9b b1 #.&o.\.Ln.fR6... 0080 47 6b 4f 50 91 0b 32 74 15 dd 44 76 ef eb 07 8b GkOP..2t..Dv.... 0090 e9 1c d5 db 17 a7 a9 75 3d 80 0e 10 .......u=... No. Time Source Destination Protocol Info 54 61.777900 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 54 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 2392, Ack: 1815, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d d0 40 00 80 06 6c 40 ac 1f 01 65 ac 1f ..-.@...l@...e.. 0020 01 68 01 85 07 eb f8 ed fb df c4 68 4b af 50 10 .h.........hK.P. 0030 fa 8a fd 8d 00 00 00 00 09 dd 60 82 09 d9 06 09 ..........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 01 52 a0 87 6a 08 fc 6f 99 e9 27 0d 3b e3 53 ..R..j..o..'.;.S 0060 91 69 e8 d4 b8 61 97 b2 b7 99 7b 78 19 3d e1 0e .i...a....{x.=.. 0070 ad 20 6a 8f 93 d1 1a 2d 11 4c 65 a0 f5 22 82 07 . j....-.Le..".. 0080 97 65 a2 2d 72 fe 81 28 2c 0d a7 e0 f4 43 d7 32 .e.-r..(,....C.2 0090 92 d3 1e 0a d4 c6 9c 17 4f f4 3f b4 26 cc 1d 6b ........O.?.&..k 00a0 d6 8f 85 13 d3 7c f1 81 7d 02 0b 29 3c 70 a7 29 .....|..}..)A.4...+....... 0120 42 75 d8 91 87 7c 4f da d6 4e f6 38 4e 0d 1c d9 Bu...|O..N.8N... 0130 f6 e1 61 9e a0 cf 9c 69 60 fe 9a 6d 3e 14 9b a0 ..a....i`..m>... 0140 ec bd b3 e1 03 9f 6d 24 92 9c f5 bd 27 73 c3 e1 ......m$....'s.. 0150 7c 54 3b 8a 42 da 3c e2 a8 4e e4 d8 ad 3d 9d 3b |T;.B.<..N...=.; 0160 2d 87 c5 e7 a2 66 4c 15 f6 85 ac b0 c6 89 bf 4e -....fL........N 0170 52 64 c3 95 38 2b 40 78 e8 bd 6e 5e 75 58 3e 82 Rd..8+@x..n^uX>. 0180 81 29 cb 4b a7 2a 6f eb 2e c8 8b 9b ee 93 6b 48 .).K.*o.......kH 0190 0c fd e4 2c 74 7f d7 f1 04 6c df aa 8f 04 c1 c3 ...,t....l...... 01a0 73 3d 3d c2 a7 56 e2 24 85 d8 16 8a ee f8 fe e3 s==..V.$........ 01b0 ce b8 8c 3a 0f 01 fc ef 19 43 8b 4a 7f 81 48 79 ...:.....C.J..Hy 01c0 f3 c1 68 35 cb a1 f0 8d 16 15 34 2e 52 fb 33 09 ..h5......4.R.3. 01d0 2b 4e fd 54 1b fb b4 97 56 89 68 92 ac 96 ce 3e +N.T....V.h....> 01e0 ca a3 60 bd 78 b8 b4 40 e5 30 2b 2a 5a 92 c9 a0 ..`.x..@.0+*Z... 01f0 ce 7d d7 9e 25 90 5f e2 96 b0 13 09 b6 46 4d ad .}..%._......FM. 0200 8f 15 6d b4 2e 92 cc fe ed 59 f2 f9 57 c3 d7 ce ..m......Y..W... 0210 27 45 60 cf b9 1c c5 82 eb 2b 1b f9 c3 15 fd 56 'E`......+.....V 0220 bf 38 5f 23 6a 33 84 20 6a bb 5b 24 30 fc bd 2a .8_#j3. j.[$0..* 0230 ae 4a 47 88 07 54 70 23 73 37 68 7e b5 d4 b4 35 .JG..Tp#s7h~...5 0240 cc 10 65 75 bf ca cd 13 3b 9c de 58 73 d0 c8 36 ..eu....;..Xs..6 0250 eb ed 25 fa 70 0e a7 26 18 fc 01 f9 7d 20 e9 86 ..%.p..&....} .. 0260 8a af cc 6b 06 42 3d 09 e2 c3 c0 70 5f 89 8b 19 ...k.B=....p_... 0270 34 32 9c bd eb a2 9c 57 9e 89 94 9e 7c b9 fa 6a 42.....W....|..j 0280 5b 16 91 8e 36 16 ab 62 f2 17 5b 82 59 21 ba b6 [...6..b..[.Y!.. 0290 47 6f f7 d2 3d 60 ab e9 76 ba 54 5b e2 4f c4 94 Go..=`..v.T[.O.. 02a0 92 dd d1 62 27 24 a1 41 97 58 99 ff 6b 89 1f 08 ...b'$.A.X..k... 02b0 af 90 04 4a 1b a4 24 ce a0 bd d2 c5 aa 14 3c 08 ...J..$.......<. 02c0 0d 63 80 cf b6 74 8b 25 92 30 bb e9 d2 11 5a c6 .c...t.%.0....Z. 02d0 23 54 1b 59 0f b6 ec fb 7a c7 7b b7 03 da a6 8f #T.Y....z.{..... 02e0 96 e9 9b 28 ad 1c 63 16 5a 54 55 cb eb ee 38 1c ...(..c.ZTU...8. 02f0 da 29 7e 17 53 d1 3e 92 77 70 2c 23 a6 cd 23 2e .)~.S.>.wp,#..#. 0300 72 1d 45 ab 25 64 d6 b2 17 38 6a 6b d3 ac 23 f3 r.E.%d...8jk..#. 0310 3e 70 f1 dd 96 3c 38 8a 65 b9 ae 90 2d 67 82 c6 >p...<8.e...-g.. 0320 c5 b5 34 5b 95 0b 9e 4a a9 ee 21 26 df 27 20 22 ..4[...J..!&.' " 0330 bc 5a 28 a5 bc 00 6d eb 35 67 e9 ef e0 73 7b 4e .Z(...m.5g...s{N 0340 10 a4 5c ae 49 0b c8 bf 1b e7 b5 31 5e 17 07 2b ..\.I......1^..+ 0350 ed 34 58 02 27 f6 ec fd c3 96 3e 8e 1c c4 70 19 .4X.'.....>...p. 0360 42 d2 be 0d 5e f4 cb 30 68 fa c8 d0 f2 7e 9a 23 B...^..0h....~.# 0370 fa f1 b4 4c 55 d6 83 75 59 c3 50 1e d2 b4 b6 a2 ...LU..uY.P..... 0380 f2 3b 3b 57 9d 95 e5 88 ec cf 9a 75 0f bd 1d a7 .;;W.......u.... 0390 b9 48 f3 5c 83 2a ec 1a cc 91 75 a7 45 4d 2a 7c .H.\.*....u.EM*| 03a0 b1 92 ea fe 46 93 9a 31 78 a4 24 00 93 62 e7 7a ....F..1x.$..b.z 03b0 5d 8b db 75 df 2a 0f 63 ce a4 6f 7d 22 fc 9f c6 ]..u.*.c..o}"... 03c0 e7 1f f8 d3 77 31 b4 55 60 2f 7e 50 a2 9c 30 af ....w1.U`/~P..0. 03d0 29 f7 f0 e0 c2 47 ee a5 49 60 4d b4 94 01 45 bf )....G..I`M...E. 03e0 b9 34 dd 8b f4 04 b0 8f 8f ba 9f 9c 15 07 5c f6 .4............\. 03f0 3e 8e 4e 41 7f f7 7c f3 2d 40 4d c3 ea cb 04 d8 >.NA..|.-@M..... 0400 17 06 cf b9 73 3f 68 95 a2 b0 7a 6e fe ce ba 61 ....s?h...zn...a 0410 3d 96 20 04 8a 18 27 c3 08 75 b6 57 01 17 73 ca =. ...'..u.W..s. 0420 11 3b 74 85 f9 27 d2 cf ec 0e 4a 6e 6d a2 75 6b .;t..'....Jnm.uk 0430 8c ac b2 93 8f 28 d2 9d 4b d2 6b a6 1d c9 35 ea .....(..K.k...5. 0440 58 87 c5 c9 e1 97 01 77 56 23 4e f5 1e bc c9 f6 X......wV#N..... 0450 e7 a4 f7 cf 79 28 fd 38 57 7c e2 d3 b0 50 2c e4 ....y(.8W|...P,. 0460 97 b5 17 23 bd 20 34 8c 07 a5 93 5e 75 92 cf 26 ...#. 4....^u..& 0470 7b 42 be 7d 11 b0 ed 51 e6 e0 e7 71 f6 9e d0 f6 {B.}...Q...q.... 0480 eb a5 06 1e be 39 cb 2c e6 0c b7 98 43 05 2f 89 .....9.,....C./. 0490 63 26 2f 8c 5c 78 ee 76 cb 78 a4 69 81 6b 2a a3 c&/.\x.v.x.i.k*. 04a0 86 29 8b 51 ea 89 cf 51 58 a1 ae 2f 98 67 af ab .).Q...QX../.g.. 04b0 ea 04 02 40 2a a4 3f 58 5c b1 37 ed b7 ce c5 ba ...@*.?X\.7..... 04c0 8c 77 22 f7 d9 2f dc 57 9b bb c6 e1 a4 86 fd 02 .w"../.W........ 04d0 48 88 f3 51 55 b2 15 de 79 c5 fc c4 54 a5 df b0 H..QU...y...T... 04e0 74 ac 1c b0 59 be 70 ec 8c 2b 1b f9 61 55 70 53 t...Y.p..+..aUpS 04f0 bf 42 fe 0e 66 5f 6b 65 58 59 bb 49 ec 90 0e b4 .B..f_keXY.I.... 0500 dd bd fb 68 45 03 41 b6 81 c8 2e cd e1 2f 6a 1f ...hE.A....../j. 0510 5d 17 31 1c 96 4e 14 ba 5d a6 7a ed ff 16 8c dc ].1..N..].z..... 0520 97 e8 5d 15 4f b8 17 e5 b2 f3 73 90 57 41 12 e8 ..].O.....s.WA.. 0530 d1 90 ca 02 73 1c 90 19 22 38 72 8e 4d f7 e6 61 ....s..."8r.M..a 0540 49 15 3d 1f 82 fa 26 c4 1a 72 0f 96 ae e1 49 0d I.=...&..r....I. 0550 fc 77 7a 07 b1 d7 2e 9e 5d 3a b9 06 eb 55 1a de .wz.....]:...U.. 0560 07 2d 7b dd 42 e1 dd 0b 97 b2 ec e4 88 73 65 82 .-{.B........se. 0570 9a d3 83 03 71 d1 32 25 15 01 82 3a 44 ce 69 de ....q.2%...:D.i. 0580 43 4b 48 74 a9 10 f7 9b cd 25 ad 79 50 2d c5 39 CKHt.....%.yP-.9 0590 2e a7 49 19 10 cb 97 37 2d c3 1c 46 d1 48 90 b7 ..I....7-..F.H.. 05a0 9d 1c f4 46 1b cc 4d 6e 85 86 2a f1 d6 8a 43 6c ...F..Mn..*...Cl 05b0 39 bd d4 f7 d3 7d ea 14 b5 05 6a b8 79 70 74 22 9....}....j.ypt" 05c0 32 d5 53 76 38 26 09 e9 3f 37 79 ed 03 b9 4f 2b 2.Sv8&..?7y...O+ 05d0 f6 1c d1 d7 62 d0 ff 9c 40 b2 74 18 87 b0 aa 3b ....b...@.t....; 05e0 1a ff b9 78 da 0e b7 81 96 74 ...x.....t No. Time Source Destination Protocol Info 55 61.778053 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 55 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 3852, Ack: 1815, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF0152A0876A08FC6F99E9270D3BE35391... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 0152A0876A08FC6F krb5_sgn_cksum: 99E9270D3BE35391 krb5_confounder: 69E8D4B86197B2B7 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2d d1 40 00 80 06 6d c6 ac 1f 01 65 ac 1f .U-.@...m....e.. 0020 01 68 01 85 07 eb f8 ee 01 93 c4 68 4b af 50 18 .h.........hK.P. 0030 fa 8a e7 35 00 00 ac 93 07 42 ac de 0c 87 2d f3 ...5.....B....-. 0040 9f 36 72 75 68 4b 37 8f 8d 14 5d 44 24 43 0d 11 .6ruhK7...]D$C.. 0050 38 46 f5 e7 41 1c 81 15 9a bd 6b 60 05 4a 4e a3 8F..A.....k`.JN. 0060 a4 2f 25 66 83 44 a7 e3 a9 2e 84 b0 0a f4 1e 51 ./%f.D.........Q 0070 58 d6 63 bf 7c 66 99 68 c5 e9 6a 37 a2 ec 92 eb X.c.|f.h..j7.... 0080 cb 6c 77 51 8d bd 5e 3b 4b 07 61 e4 f6 c3 2a 4c .lwQ..^;K.a...*L 0090 0c 8b 5f 2f 97 c8 86 f7 09 7a 4f 29 37 e0 0b 54 .._/.....zO)7..T 00a0 32 52 65 0f 97 60 42 1b 00 f9 ca c8 c9 f7 92 b5 2Re..`B......... 00b0 0f 1a 39 4b 43 17 3d c1 c2 7a de fc 44 b2 62 15 ..9KC.=..z..D.b. 00c0 b2 87 18 bd ca f8 41 45 bd 86 b9 69 67 e0 92 1f ......AE...ig... 00d0 01 2b 13 f4 e5 20 61 4a a2 86 4c 9a df 33 18 0c .+... aJ..L..3.. 00e0 47 2a d2 bd 99 de 52 94 d9 9d 3b b5 6d d0 db b6 G*....R...;.m... 00f0 6a 3e eb 6f f2 9f 95 03 58 94 65 fa 75 0f 9a 96 j>.o....X.e.u... 0100 b0 fa cc 03 3e 14 b9 a0 38 f7 04 c2 1c 1e df 51 ....>...8......Q 0110 72 88 ac 8f 47 32 41 d2 86 6e 53 6a 5b f2 42 2f r...G2A..nSj[.B/ 0120 c1 07 b6 06 66 5c 92 7b ba 75 15 83 fc 95 e4 b1 ....f\.{.u...... 0130 d3 56 93 b6 e7 59 b3 ec 57 14 e9 8b 73 33 48 96 .V...Y..W...s3H. 0140 4d c9 3d a4 c3 d5 a8 d0 f5 10 ef 43 d1 2b b2 cd M.=........C.+.. 0150 1f f7 14 7a 04 b8 62 81 3e c7 27 17 c4 31 f2 28 ...z..b.>.'..1.( 0160 21 1e 72 06 95 c2 74 4c ac de 77 2b a7 07 d3 36 !.r...tL..w+...6 0170 fb 5a 57 ff fa ea 4f 8b 99 ac 19 b9 2e a0 c8 e8 .ZW...O......... 0180 bd 65 1e 01 7d c5 ba 36 b8 dc 01 75 8a 8f 57 88 .e..}..6...u..W. 0190 95 ff e7 19 f5 45 a6 fc e6 d6 38 7c 58 6f 73 27 .....E....8|Xos' 01a0 87 74 c1 8a 29 b8 ee 0b 71 9a d4 4a d0 bf 7b 83 .t..)...q..J..{. 01b0 5a 2e 0f cf e1 71 cf e0 15 d2 cc 25 7d 4f 6d 53 Z....q.....%}OmS 01c0 41 47 65 5e 43 15 fa b8 05 c5 6a 08 6a ec 5a 39 AGe^C.....j.j.Z9 01d0 b1 c4 26 96 fa 07 80 32 30 5b 7d 5a 38 ba b7 9d ..&....20[}Z8... 01e0 0c f6 1a 87 4d 5c cd 0a 87 ba 72 58 9f bf 5a 6e ....M\....rX..Zn 01f0 6c b7 81 f0 4c b7 6d d2 b3 ad 32 0b b5 ae b1 ce l...L.m...2..... 0200 58 69 cc 94 e0 cf c6 da 42 ae bd e6 d5 eb 5f f5 Xi......B....._. 0210 53 d9 e4 e3 93 6c 4d ed ce b9 1c 56 44 bb 6c 9c S....lM....VD.l. 0220 fd ef 71 a3 5e 09 8e 5b 98 b6 fd 8d 8d ee ed 2b ..q.^..[.......+ 0230 84 2a e6 23 09 78 96 6c 59 c0 4c 44 9a e3 06 a6 .*.#.x.lY.LD.... 0240 e7 86 6c 51 5d b0 9b 66 c5 e9 73 b0 f9 7d 6b 12 ..lQ]..f..s..}k. 0250 fa 88 39 75 28 48 c0 23 5a 43 77 9c ba 23 ba c1 ..9u(H.#ZCw..#.. 0260 72 58 2d 9e 91 a4 16 a7 3c e1 c4 ff 9e 4f 19 8b rX-.....<....O.. 0270 be ff 00 f2 f0 36 5d 81 20 66 cd 56 94 b0 f0 45 .....6]. f.V...E 0280 3a e1 e4 70 f1 06 06 23 db df b5 45 6c 0a 7b c6 :..p...#...El.{. 0290 60 6b 23 66 ad 99 2f b9 77 09 86 31 23 6e 9c 01 `k#f../.w..1#n.. 02a0 8b b4 74 80 8e fd 30 bd 31 88 ac f6 78 7f f1 14 ..t...0.1...x... 02b0 ad 39 77 df 50 4a 66 fa fc 49 20 50 fa e8 1f 4e .9w.PJf..I P...N 02c0 f0 78 7c 2a 14 80 35 ab b1 a1 53 36 12 80 b6 5c .x|*..5...S6...\ 02d0 62 47 7d 0a 0d b9 e6 2b 5d e8 e7 a0 51 76 46 a4 bG}....+]...QvF. 02e0 d3 b3 36 69 e2 fc bf b0 76 82 d2 0b 36 95 f6 a1 ..6i....v...6... 02f0 3f 36 45 9f d4 8a 4c b9 b2 a5 57 64 99 4c 27 34 ?6E...L...Wd.L'4 0300 72 87 53 c2 de ee 72 8d a1 e5 20 7b e1 07 06 75 r.S...r... {...u 0310 18 87 e8 da 1e b1 9d 79 4d e5 f3 1c 08 30 c1 c4 .......yM....0.. 0320 e6 5d 4c 4d 22 03 97 52 76 37 3b 60 73 fa 79 2d .]LM"..Rv7;`s.y- 0330 04 61 e7 93 ce 2f b2 aa bd 5d 72 7e 3b 65 18 75 .a.../...]r~;e.u 0340 10 11 d7 10 18 7a 45 d6 ef cd a1 6b 35 92 ab cb .....zE....k5... 0350 36 a0 96 22 c5 74 2b 5f 07 69 91 3d ec 1f 08 64 6..".t+_.i.=...d 0360 7f 12 47 70 91 18 63 47 48 68 67 52 ae 43 20 45 ..Gp..cGHhgR.C E 0370 f6 15 2c 91 d9 a3 58 9c 63 84 3d 74 36 3e dc ba ..,...X.c.=t6>.. 0380 56 0e 0c 51 af 32 77 99 f7 60 ef 45 48 07 13 6a V..Q.2w..`.EH..j 0390 7d 4e 3e 7a 93 07 62 ed aa 27 ce 66 7d 69 09 ba }N>z..b..'.f}i.. 03a0 11 97 f5 7b 12 76 1c de be d7 bd ee c9 ce b6 7b ...{.v.........{ 03b0 a1 e0 97 25 65 d3 3c 52 fa 78 56 69 fa c9 02 29 ...%e.A.4. 00e0 fd f5 2b fa eb e6 05 8c f1 8e 42 75 d8 91 87 7c ..+.......Bu...| 00f0 4f da d6 4e f6 38 4e 0d 1c d9 f6 e1 61 9e a0 cf O..N.8N.....a... 0100 9c 69 60 fe 9a 6d 3e 14 9b a0 ec bd b3 e1 03 9f .i`..m>......... 0110 6d 24 92 9c f5 bd 27 73 c3 e1 7c 54 3b 8a 42 da m$....'s..|T;.B. 0120 3c e2 a8 4e e4 d8 ad 3d 9d 3b 2d 87 c5 e7 a2 66 <..N...=.;-....f 0130 4c 15 f6 85 ac b0 c6 89 bf 4e 52 64 c3 95 38 2b L........NRd..8+ 0140 40 78 e8 bd 6e 5e 75 58 3e 82 81 29 cb 4b a7 2a @x..n^uX>..).K.* 0150 6f eb 2e c8 8b 9b ee 93 6b 48 0c fd e4 2c 74 7f o.......kH...,t. 0160 d7 f1 04 6c df aa 8f 04 c1 c3 73 3d 3d c2 a7 56 ...l......s==..V 0170 e2 24 85 d8 16 8a ee f8 fe e3 ce b8 8c 3a 0f 01 .$...........:.. 0180 fc ef 19 43 8b 4a 7f 81 48 79 f3 c1 68 35 cb a1 ...C.J..Hy..h5.. 0190 f0 8d 16 15 34 2e 52 fb 33 09 2b 4e fd 54 1b fb ....4.R.3.+N.T.. 01a0 b4 97 56 89 68 92 ac 96 ce 3e ca a3 60 bd 78 b8 ..V.h....>..`.x. 01b0 b4 40 e5 30 2b 2a 5a 92 c9 a0 ce 7d d7 9e 25 90 .@.0+*Z....}..%. 01c0 5f e2 96 b0 13 09 b6 46 4d ad 8f 15 6d b4 2e 92 _......FM...m... 01d0 cc fe ed 59 f2 f9 57 c3 d7 ce 27 45 60 cf b9 1c ...Y..W...'E`... 01e0 c5 82 eb 2b 1b f9 c3 15 fd 56 bf 38 5f 23 6a 33 ...+.....V.8_#j3 01f0 84 20 6a bb 5b 24 30 fc bd 2a ae 4a 47 88 07 54 . j.[$0..*.JG..T 0200 70 23 73 37 68 7e b5 d4 b4 35 cc 10 65 75 bf ca p#s7h~...5..eu.. 0210 cd 13 3b 9c de 58 73 d0 c8 36 eb ed 25 fa 70 0e ..;..Xs..6..%.p. 0220 a7 26 18 fc 01 f9 7d 20 e9 86 8a af cc 6b 06 42 .&....} .....k.B 0230 3d 09 e2 c3 c0 70 5f 89 8b 19 34 32 9c bd eb a2 =....p_...42.... 0240 9c 57 9e 89 94 9e 7c b9 fa 6a 5b 16 91 8e 36 16 .W....|..j[...6. 0250 ab 62 f2 17 5b 82 59 21 ba b6 47 6f f7 d2 3d 60 .b..[.Y!..Go..=` 0260 ab e9 76 ba 54 5b e2 4f c4 94 92 dd d1 62 27 24 ..v.T[.O.....b'$ 0270 a1 41 97 58 99 ff 6b 89 1f 08 af 90 04 4a 1b a4 .A.X..k......J.. 0280 24 ce a0 bd d2 c5 aa 14 3c 08 0d 63 80 cf b6 74 $.......<..c...t 0290 8b 25 92 30 bb e9 d2 11 5a c6 23 54 1b 59 0f b6 .%.0....Z.#T.Y.. 02a0 ec fb 7a c7 7b b7 03 da a6 8f 96 e9 9b 28 ad 1c ..z.{........(.. 02b0 63 16 5a 54 55 cb eb ee 38 1c da 29 7e 17 53 d1 c.ZTU...8..)~.S. 02c0 3e 92 77 70 2c 23 a6 cd 23 2e 72 1d 45 ab 25 64 >.wp,#..#.r.E.%d 02d0 d6 b2 17 38 6a 6b d3 ac 23 f3 3e 70 f1 dd 96 3c ...8jk..#.>p...< 02e0 38 8a 65 b9 ae 90 2d 67 82 c6 c5 b5 34 5b 95 0b 8.e...-g....4[.. 02f0 9e 4a a9 ee 21 26 df 27 20 22 bc 5a 28 a5 bc 00 .J..!&.' ".Z(... 0300 6d eb 35 67 e9 ef e0 73 7b 4e 10 a4 5c ae 49 0b m.5g...s{N..\.I. 0310 c8 bf 1b e7 b5 31 5e 17 07 2b ed 34 58 02 27 f6 .....1^..+.4X.'. 0320 ec fd c3 96 3e 8e 1c c4 70 19 42 d2 be 0d 5e f4 ....>...p.B...^. 0330 cb 30 68 fa c8 d0 f2 7e 9a 23 fa f1 b4 4c 55 d6 .0h....~.#...LU. 0340 83 75 59 c3 50 1e d2 b4 b6 a2 f2 3b 3b 57 9d 95 .uY.P......;;W.. 0350 e5 88 ec cf 9a 75 0f bd 1d a7 b9 48 f3 5c 83 2a .....u.....H.\.* 0360 ec 1a cc 91 75 a7 45 4d 2a 7c b1 92 ea fe 46 93 ....u.EM*|....F. 0370 9a 31 78 a4 24 00 93 62 e7 7a 5d 8b db 75 df 2a .1x.$..b.z]..u.* 0380 0f 63 ce a4 6f 7d 22 fc 9f c6 e7 1f f8 d3 77 31 .c..o}".......w1 0390 b4 55 60 2f 7e 50 a2 9c 30 af 29 f7 f0 e0 c2 47 .U`/~P..0.)....G 03a0 ee a5 49 60 4d b4 94 01 45 bf b9 34 dd 8b f4 04 ..I`M...E..4.... 03b0 b0 8f 8f ba 9f 9c 15 07 5c f6 3e 8e 4e 41 7f f7 ........\.>.NA.. 03c0 7c f3 2d 40 4d c3 ea cb 04 d8 17 06 cf b9 73 3f |.-@M.........s? 03d0 68 95 a2 b0 7a 6e fe ce ba 61 3d 96 20 04 8a 18 h...zn...a=. ... 03e0 27 c3 08 75 b6 57 01 17 73 ca 11 3b 74 85 f9 27 '..u.W..s..;t..' 03f0 d2 cf ec 0e 4a 6e 6d a2 75 6b 8c ac b2 93 8f 28 ....Jnm.uk.....( 0400 d2 9d 4b d2 6b a6 1d c9 35 ea 58 87 c5 c9 e1 97 ..K.k...5.X..... 0410 01 77 56 23 4e f5 1e bc c9 f6 e7 a4 f7 cf 79 28 .wV#N.........y( 0420 fd 38 57 7c e2 d3 b0 50 2c e4 97 b5 17 23 bd 20 .8W|...P,....#. 0430 34 8c 07 a5 93 5e 75 92 cf 26 7b 42 be 7d 11 b0 4....^u..&{B.}.. 0440 ed 51 e6 e0 e7 71 f6 9e d0 f6 eb a5 06 1e be 39 .Q...q.........9 0450 cb 2c e6 0c b7 98 43 05 2f 89 63 26 2f 8c 5c 78 .,....C./.c&/.\x 0460 ee 76 cb 78 a4 69 81 6b 2a a3 86 29 8b 51 ea 89 .v.x.i.k*..).Q.. 0470 cf 51 58 a1 ae 2f 98 67 af ab ea 04 02 40 2a a4 .QX../.g.....@*. 0480 3f 58 5c b1 37 ed b7 ce c5 ba 8c 77 22 f7 d9 2f ?X\.7......w"../ 0490 dc 57 9b bb c6 e1 a4 86 fd 02 48 88 f3 51 55 b2 .W........H..QU. 04a0 15 de 79 c5 fc c4 54 a5 df b0 74 ac 1c b0 59 be ..y...T...t...Y. 04b0 70 ec 8c 2b 1b f9 61 55 70 53 bf 42 fe 0e 66 5f p..+..aUpS.B..f_ 04c0 6b 65 58 59 bb 49 ec 90 0e b4 dd bd fb 68 45 03 keXY.I.......hE. 04d0 41 b6 81 c8 2e cd e1 2f 6a 1f 5d 17 31 1c 96 4e A....../j.].1..N 04e0 14 ba 5d a6 7a ed ff 16 8c dc 97 e8 5d 15 4f b8 ..].z.......].O. 04f0 17 e5 b2 f3 73 90 57 41 12 e8 d1 90 ca 02 73 1c ....s.WA......s. 0500 90 19 22 38 72 8e 4d f7 e6 61 49 15 3d 1f 82 fa .."8r.M..aI.=... 0510 26 c4 1a 72 0f 96 ae e1 49 0d fc 77 7a 07 b1 d7 &..r....I..wz... 0520 2e 9e 5d 3a b9 06 eb 55 1a de 07 2d 7b dd 42 e1 ..]:...U...-{.B. 0530 dd 0b 97 b2 ec e4 88 73 65 82 9a d3 83 03 71 d1 .......se.....q. 0540 32 25 15 01 82 3a 44 ce 69 de 43 4b 48 74 a9 10 2%...:D.i.CKHt.. 0550 f7 9b cd 25 ad 79 50 2d c5 39 2e a7 49 19 10 cb ...%.yP-.9..I... 0560 97 37 2d c3 1c 46 d1 48 90 b7 9d 1c f4 46 1b cc .7-..F.H.....F.. 0570 4d 6e 85 86 2a f1 d6 8a 43 6c 39 bd d4 f7 d3 7d Mn..*...Cl9....} 0580 ea 14 b5 05 6a b8 79 70 74 22 32 d5 53 76 38 26 ....j.ypt"2.Sv8& 0590 09 e9 3f 37 79 ed 03 b9 4f 2b f6 1c d1 d7 62 d0 ..?7y...O+....b. 05a0 ff 9c 40 b2 74 18 87 b0 aa 3b 1a ff b9 78 da 0e ..@.t....;...x.. 05b0 b7 81 96 74 ac 93 07 42 ac de 0c 87 2d f3 9f 36 ...t...B....-..6 05c0 72 75 68 4b 37 8f 8d 14 5d 44 24 43 0d 11 38 46 ruhK7...]D$C..8F 05d0 f5 e7 41 1c 81 15 9a bd 6b 60 05 4a 4e a3 a4 2f ..A.....k`.JN../ 05e0 25 66 83 44 a7 e3 a9 2e 84 b0 0a f4 1e 51 58 d6 %f.D.........QX. 05f0 63 bf 7c 66 99 68 c5 e9 6a 37 a2 ec 92 eb cb 6c c.|f.h..j7.....l 0600 77 51 8d bd 5e 3b 4b 07 61 e4 f6 c3 2a 4c 0c 8b wQ..^;K.a...*L.. 0610 5f 2f 97 c8 86 f7 09 7a 4f 29 37 e0 0b 54 32 52 _/.....zO)7..T2R 0620 65 0f 97 60 42 1b 00 f9 ca c8 c9 f7 92 b5 0f 1a e..`B........... 0630 39 4b 43 17 3d c1 c2 7a de fc 44 b2 62 15 b2 87 9KC.=..z..D.b... 0640 18 bd ca f8 41 45 bd 86 b9 69 67 e0 92 1f 01 2b ....AE...ig....+ 0650 13 f4 e5 20 61 4a a2 86 4c 9a df 33 18 0c 47 2a ... aJ..L..3..G* 0660 d2 bd 99 de 52 94 d9 9d 3b b5 6d d0 db b6 6a 3e ....R...;.m...j> 0670 eb 6f f2 9f 95 03 58 94 65 fa 75 0f 9a 96 b0 fa .o....X.e.u..... 0680 cc 03 3e 14 b9 a0 38 f7 04 c2 1c 1e df 51 72 88 ..>...8......Qr. 0690 ac 8f 47 32 41 d2 86 6e 53 6a 5b f2 42 2f c1 07 ..G2A..nSj[.B/.. 06a0 b6 06 66 5c 92 7b ba 75 15 83 fc 95 e4 b1 d3 56 ..f\.{.u.......V 06b0 93 b6 e7 59 b3 ec 57 14 e9 8b 73 33 48 96 4d c9 ...Y..W...s3H.M. 06c0 3d a4 c3 d5 a8 d0 f5 10 ef 43 d1 2b b2 cd 1f f7 =........C.+.... 06d0 14 7a 04 b8 62 81 3e c7 27 17 c4 31 f2 28 21 1e .z..b.>.'..1.(!. 06e0 72 06 95 c2 74 4c ac de 77 2b a7 07 d3 36 fb 5a r...tL..w+...6.Z 06f0 57 ff fa ea 4f 8b 99 ac 19 b9 2e a0 c8 e8 bd 65 W...O..........e 0700 1e 01 7d c5 ba 36 b8 dc 01 75 8a 8f 57 88 95 ff ..}..6...u..W... 0710 e7 19 f5 45 a6 fc e6 d6 38 7c 58 6f 73 27 87 74 ...E....8|Xos'.t 0720 c1 8a 29 b8 ee 0b 71 9a d4 4a d0 bf 7b 83 5a 2e ..)...q..J..{.Z. 0730 0f cf e1 71 cf e0 15 d2 cc 25 7d 4f 6d 53 41 47 ...q.....%}OmSAG 0740 65 5e 43 15 fa b8 05 c5 6a 08 6a ec 5a 39 b1 c4 e^C.....j.j.Z9.. 0750 26 96 fa 07 80 32 30 5b 7d 5a 38 ba b7 9d 0c f6 &....20[}Z8..... 0760 1a 87 4d 5c cd 0a 87 ba 72 58 9f bf 5a 6e 6c b7 ..M\....rX..Znl. 0770 81 f0 4c b7 6d d2 b3 ad 32 0b b5 ae b1 ce 58 69 ..L.m...2.....Xi 0780 cc 94 e0 cf c6 da 42 ae bd e6 d5 eb 5f f5 53 d9 ......B....._.S. 0790 e4 e3 93 6c 4d ed ce b9 1c 56 44 bb 6c 9c fd ef ...lM....VD.l... 07a0 71 a3 5e 09 8e 5b 98 b6 fd 8d 8d ee ed 2b 84 2a q.^..[.......+.* 07b0 e6 23 09 78 96 6c 59 c0 4c 44 9a e3 06 a6 e7 86 .#.x.lY.LD...... 07c0 6c 51 5d b0 9b 66 c5 e9 73 b0 f9 7d 6b 12 fa 88 lQ]..f..s..}k... 07d0 39 75 28 48 c0 23 5a 43 77 9c ba 23 ba c1 72 58 9u(H.#ZCw..#..rX 07e0 2d 9e 91 a4 16 a7 3c e1 c4 ff 9e 4f 19 8b be ff -.....<....O.... 07f0 00 f2 f0 36 5d 81 20 66 cd 56 94 b0 f0 45 3a e1 ...6]. f.V...E:. 0800 e4 70 f1 06 06 23 db df b5 45 6c 0a 7b c6 60 6b .p...#...El.{.`k 0810 23 66 ad 99 2f b9 77 09 86 31 23 6e 9c 01 8b b4 #f../.w..1#n.... 0820 74 80 8e fd 30 bd 31 88 ac f6 78 7f f1 14 ad 39 t...0.1...x....9 0830 77 df 50 4a 66 fa fc 49 20 50 fa e8 1f 4e f0 78 w.PJf..I P...N.x 0840 7c 2a 14 80 35 ab b1 a1 53 36 12 80 b6 5c 62 47 |*..5...S6...\bG 0850 7d 0a 0d b9 e6 2b 5d e8 e7 a0 51 76 46 a4 d3 b3 }....+]...QvF... 0860 36 69 e2 fc bf b0 76 82 d2 0b 36 95 f6 a1 3f 36 6i....v...6...?6 0870 45 9f d4 8a 4c b9 b2 a5 57 64 99 4c 27 34 72 87 E...L...Wd.L'4r. 0880 53 c2 de ee 72 8d a1 e5 20 7b e1 07 06 75 18 87 S...r... {...u.. 0890 e8 da 1e b1 9d 79 4d e5 f3 1c 08 30 c1 c4 e6 5d .....yM....0...] 08a0 4c 4d 22 03 97 52 76 37 3b 60 73 fa 79 2d 04 61 LM"..Rv7;`s.y-.a 08b0 e7 93 ce 2f b2 aa bd 5d 72 7e 3b 65 18 75 10 11 .../...]r~;e.u.. 08c0 d7 10 18 7a 45 d6 ef cd a1 6b 35 92 ab cb 36 a0 ...zE....k5...6. 08d0 96 22 c5 74 2b 5f 07 69 91 3d ec 1f 08 64 7f 12 .".t+_.i.=...d.. 08e0 47 70 91 18 63 47 48 68 67 52 ae 43 20 45 f6 15 Gp..cGHhgR.C E.. 08f0 2c 91 d9 a3 58 9c 63 84 3d 74 36 3e dc ba 56 0e ,...X.c.=t6>..V. 0900 0c 51 af 32 77 99 f7 60 ef 45 48 07 13 6a 7d 4e .Q.2w..`.EH..j}N 0910 3e 7a 93 07 62 ed aa 27 ce 66 7d 69 09 ba 11 97 >z..b..'.f}i.... 0920 f5 7b 12 76 1c de be d7 bd ee c9 ce b6 7b a1 e0 .{.v.........{.. 0930 97 25 65 d3 3c 52 fa 78 56 69 fa c9 02 29 20 d5 .%e. ldap [ACK] Seq=1815 Ack=4921 Win=64240 Len=0 Frame 56 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1815, Ack: 4921, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df dc 40 00 80 06 bf e7 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 4b af f8 ee 05 c0 50 10 .e.....hK.....P. 0030 fa f0 41 a1 00 00 ac 1f 01 65 c5 d5 ..A......e.. No. Time Source Destination Protocol Info 57 61.780066 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 57 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1815, Ack: 4921, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF3BA37583BDB267DF6209C37E26C25EB1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 3BA37583BDB267DF krb5_sgn_cksum: 6209C37E26C25EB1 krb5_confounder: B67628C0E4193D86 GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb df dd 40 00 80 06 bf 53 ac 1f 01 68 ac 1f ....@....S...h.. 0020 01 65 07 eb 01 85 c4 68 4b af f8 ee 05 c0 50 18 .e.....hK.....P. 0030 fa f0 ec 01 00 00 00 00 00 8f 60 81 8c 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 3b a3 75 83 bd b2 67 df 62 09 c3 7e 26 c2 5e b1 ;.u...g.b..~&.^. 0060 b6 76 28 c0 e4 19 3d 86 e5 36 23 b4 83 d8 b1 64 .v(...=..6#....d 0070 29 f0 73 36 43 e6 3f d8 d6 70 b3 10 f0 21 7b e8 ).s6C.?..p...!{. 0080 9e c9 69 bd d7 89 15 77 70 4b bb d8 fd 74 e8 dc ..i....wpK...t.. 0090 c1 bb 74 ce 51 2b 5d 4f bf 3e d4 de 0f 85 3a 88 ..t.Q+]O.>....:. 00a0 2f f3 34 7f 71 ff 58 b5 d1 d5 b8 08 ef 58 8d db /.4.q.X......X.. 00b0 25 4b 82 61 a6 fd 40 97 8f dc 17 8d af e7 1b c4 %K.a..@......... 00c0 9a 81 37 8a f3 96 6e f8 0b ..7...n.. No. Time Source Destination Protocol Info 58 61.780977 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 58 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 4921, Ack: 1962, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFEB024DE35B14BB1F8A2625B291CA3E25... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: EB024DE35B14BB1F krb5_sgn_cksum: 8A2625B291CA3E25 krb5_confounder: 21DBDEE24455ACEF GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d d2 40 00 80 06 71 40 ac 1f 01 65 ac 1f ..-.@...q@...e.. 0020 01 68 01 85 07 eb f8 ee 05 c0 c4 68 4c 42 50 18 .h.........hLBP. 0030 f9 f7 a6 55 00 00 00 00 00 ae 60 81 ab 06 09 2a ...U......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 eb 02 4d e3 5b 14 bb 1f 8a 26 25 b2 91 ca 3e 25 ..M.[....&%...>% 0060 21 db de e2 44 55 ac ef f9 af 66 b3 30 50 1f 22 !...DU....f.0P." 0070 91 27 5d 38 30 99 41 a8 df ed af bd e5 1f 10 0a .']80.A......... 0080 dc 13 8f 67 eb 99 56 71 4c 46 c1 4f 97 58 46 3f ...g..VqLF.O.XF? 0090 bc f1 2f 04 b6 14 53 80 5a 5c 8b 2d 4e af 15 29 ../...S.Z\.-N..) 00a0 28 09 bd 38 fc 1e 0a cc c0 72 d2 f6 dd de 57 6c (..8.....r....Wl 00b0 d2 99 4c ed eb 25 d6 11 84 71 9a 78 cb a7 79 c5 ..L..%...q.x..y. 00c0 9c d8 10 fb d8 f4 67 1d 94 c7 fb 9c 31 5d ed f5 ......g.....1].. 00d0 64 07 76 4f a6 6e 8c 8c 3c 66 da 28 4a 3e 8b f5 d.vO.n.... 00e0 dc 41 b2 0f 86 49 6d 39 .A...Im9 No. Time Source Destination Protocol Info 59 61.781753 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (113 bytes) Frame 59 (217 bytes on wire, 217 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 1962, Ack: 5099, Len: 163 Lightweight Directory Access Protocol SASL Buffer Length: 159 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4CBA58A02FA3B77E351ECB305AA34DBF... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4CBA58A02FA3B77E krb5_sgn_cksum: 351ECB305AA34DBF krb5_confounder: FF335F0AA6471E7C GSS-API Encrypted payload (113 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cb df de 40 00 80 06 bf 42 ac 1f 01 68 ac 1f ....@....B...h.. 0020 01 65 07 eb 01 85 c4 68 4c 42 f8 ee 06 72 50 18 .e.....hLB...rP. 0030 fa 3e 90 11 00 00 00 00 00 9f 60 81 9c 06 09 2a .>........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 4c ba 58 a0 2f a3 b7 7e 35 1e cb 30 5a a3 4d bf L.X./..~5..0Z.M. 0060 ff 33 5f 0a a6 47 1e 7c 2d 88 0e db 9f a3 92 a2 .3_..G.|-....... 0070 0a c0 62 3a c6 f2 65 29 80 68 70 ab df e6 e0 cb ..b:..e).hp..... 0080 f2 1e 9d c1 ec 2a a6 55 49 34 5c 93 9a 20 ff 98 .....*.UI4\.. .. 0090 10 4c 7a 96 94 f5 cb 02 9d 3b c9 c1 9d 7c 5e ca .Lz......;...|^. 00a0 c1 73 d3 5b 0c 08 36 26 77 ff d6 81 58 40 87 65 .s.[..6&w...X@.e 00b0 76 5e f6 17 8e 81 41 0a de 9c ca ab bf d0 4c 77 v^....A.......Lw 00c0 82 3d bf 79 c0 74 1e db 84 ae 2e 03 86 c3 e6 2f .=.y.t........./ 00d0 6c d1 56 34 15 4c c5 4c cf l.V4.L.L. No. Time Source Destination Protocol Info 60 61.782247 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (804 bytes) Frame 60 (909 bytes on wire, 909 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 5099, Ack: 2125, Len: 855 Lightweight Directory Access Protocol SASL Buffer Length: 851 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFB2E955C8423DEBD20DDAAA2FDBAF5713... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: B2E955C8423DEBD2 krb5_sgn_cksum: 0DDAAA2FDBAF5713 krb5_confounder: 62BE196A5B9E815F GSS-API Encrypted payload (804 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 7f 2d d3 40 00 80 06 6e 9a ac 1f 01 65 ac 1f ..-.@...n....e.. 0020 01 68 01 85 07 eb f8 ee 06 72 c4 68 4c e5 50 18 .h.......r.hL.P. 0030 f9 54 06 8e 00 00 00 00 03 53 60 82 03 4f 06 09 .T.......S`..O.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff b2 e9 55 c8 42 3d eb d2 0d da aa 2f db af 57 ...U.B=...../..W 0060 13 62 be 19 6a 5b 9e 81 5f d7 12 b3 3b 11 c3 15 .b..j[.._...;... 0070 85 f0 86 74 42 1a 58 28 7e a6 43 46 3c e7 ca fb ...tB.X(~.CF<... 0080 71 e7 66 a5 c0 c6 d5 1a f6 2c fb f1 98 96 f4 6b q.f......,.....k 0090 5e d4 6b 66 77 ff 94 98 8e 68 71 c2 2c 98 58 1b ^.kfw....hq.,.X. 00a0 fd 85 dd a1 1a 07 23 02 3d bf ac 37 da 0c d7 60 ......#.=..7...` 00b0 91 93 23 91 b8 1b 23 ed 04 d0 1f d3 3d b3 58 df ..#...#.....=.X. 00c0 fa 6c 40 fb e9 4b f7 2e 77 74 23 ba b7 b9 e7 02 .l@..K..wt#..... 00d0 45 fb 03 b0 fd 29 e9 6d c7 27 f2 5b 3b ac 01 11 E....).m.'.[;... 00e0 bc 38 2f 45 5f 32 4e 18 fe 4f 03 51 25 ef 8f fc .8/E_2N..O.Q%... 00f0 17 e7 63 72 6a a0 e5 bd 04 db 5b 53 c0 e3 16 e5 ..crj.....[S.... 0100 e9 02 2c b8 a9 a7 df 03 9d e0 06 8a bf ac 35 54 ..,...........5T 0110 5d 0a 24 a2 6b 71 af 5b c8 62 c6 95 ef 36 0d e6 ].$.kq.[.b...6.. 0120 e6 9c 41 aa ec de 9b 9f 86 37 71 36 d5 2e 58 bb ..A......7q6..X. 0130 dd ef 6d 87 0f 2b 6f b5 6f 31 9a 8d c0 31 54 99 ..m..+o.o1...1T. 0140 89 5f 0d 56 07 b2 c7 35 a5 35 fb 7e 68 90 f4 e0 ._.V...5.5.~h... 0150 88 16 0f 04 d0 db f8 bd 53 a2 c8 1d 2d 77 e7 d3 ........S...-w.. 0160 e2 8b da 44 c7 f8 fd d6 0e 20 e2 c0 51 00 67 b7 ...D..... ..Q.g. 0170 7e 2a 6a 35 7d b0 b4 c4 0d c9 87 8b 6a 4e e9 1b ~*j5}.......jN.. 0180 52 37 e0 17 f9 10 2f 21 63 2e 12 0b fe 32 be 9d R7..../!c....2.. 0190 8b 76 3f 02 a9 6b e2 d6 2f cf ca 15 8d 25 9b fc .v?..k../....%.. 01a0 34 86 7f 63 c3 f6 92 43 2c c9 35 ea 08 e1 27 b3 4..c...C,.5...'. 01b0 aa 06 22 f8 b5 3d 70 9e 21 b9 61 f6 ad 72 83 c5 .."..=p.!.a..r.. 01c0 af 15 77 ce 39 1a 5a 34 0c 4b 07 90 5f 03 67 f1 ..w.9.Z4.K.._.g. 01d0 49 82 6a a5 29 c1 19 40 19 24 09 7c a5 80 b1 2c I.j.)..@.$.|..., 01e0 a9 80 e3 49 eb fd 34 b0 85 f9 e6 38 36 67 cc e5 ...I..4....86g.. 01f0 b4 60 b9 58 d2 24 ed cb 61 b9 04 41 3d 4e 16 68 .`.X.$..a..A=N.h 0200 12 59 f4 64 8c 36 43 60 cd d8 62 ee 57 77 1f dd .Y.d.6C`..b.Ww.. 0210 de ad 22 a7 06 a8 85 33 e1 38 7b 0e 70 75 a5 2b .."....3.8{.pu.+ 0220 85 3e a5 27 e1 8c d4 01 77 01 72 fd 6a 87 16 03 .>.'....w.r.j... 0230 86 d7 25 2d 77 93 a0 1f 27 ea cc db a5 3e 35 01 ..%-w...'....>5. 0240 6b 12 9c 28 95 81 34 2c 4b 26 6a fa 83 e7 c3 78 k..(..4,K&j....x 0250 96 3a 24 27 6f ac 94 e8 ee 56 9f 47 14 6a 3c 44 .:$'o....V.G.j.Z.S.}. 0290 03 d1 b6 3a 6b 34 8d 58 cd 17 14 7a b5 f8 0e 83 ...:k4.X...z.... 02a0 74 f4 a3 95 79 38 44 70 ba 14 38 ce 6e 64 41 ce t...y8Dp..8.ndA. 02b0 ca ae 00 80 f2 44 60 c3 65 9b 0c 4c 48 c5 0a 75 .....D`.e..LH..u 02c0 06 45 5d 71 3c 06 09 3e 28 2c 18 58 fa 3e d8 1e .E]q<..>(,.X.>.. 02d0 9a 75 cd 87 41 08 40 bf 7b 01 0c 74 82 b9 35 7d .u..A.@.{..t..5} 02e0 5e 64 95 1f a2 f5 80 67 68 7d 40 88 f7 4b 2e e7 ^d.....gh}@..K.. 02f0 bf 0e 26 6c ca af df e0 5c 5b 07 d5 45 ee 1c 28 ..&l....\[..E..( 0300 09 45 ab 48 42 58 6a ca e2 54 5d eb 0f 45 14 54 .E.HBXj..T]..E.T 0310 61 c4 a5 08 50 14 77 db 5c 17 ee 7f 18 9e dd 26 a...P.w.\......& 0320 a8 1d 68 16 2d 43 44 90 c1 2b 97 4b aa 56 19 44 ..h.-CD..+.K.V.D 0330 d1 e2 26 aa 36 3c f3 3a 4f 20 61 5b 46 d0 a9 c2 ..&.6<.:O a[F... 0340 d2 8e 92 8b 56 51 40 ab 42 26 06 34 84 be 56 0b ....VQ@.B&.4..V. 0350 6c c2 7b d0 d5 37 e7 cf 56 a3 67 8e a7 6b 7d ea l.{..7..V.g..k}. 0360 6e f5 93 12 9b 14 c6 6d 48 60 1e 0b 1a 2a 26 a9 n......mH`...*&. 0370 da 2d 9d f6 43 7a b4 f0 73 9f e4 b0 6f 53 55 96 .-..Cz..s...oSU. 0380 60 9b 51 7a 5a c2 d7 24 f0 a6 b1 ec 05 `.QzZ..$..... No. Time Source Destination Protocol Info 61 61.784758 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (131 bytes) Frame 61 (235 bytes on wire, 235 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2125, Ack: 5954, Len: 181 Lightweight Directory Access Protocol SASL Buffer Length: 177 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFC163E31BB1E13DCDF95EF915306CD4B1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: C163E31BB1E13DCD krb5_sgn_cksum: F95EF915306CD4B1 krb5_confounder: 0B37550B43CB64A7 GSS-API Encrypted payload (131 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 dd df df 40 00 80 06 bf 2f ac 1f 01 68 ac 1f ....@..../...h.. 0020 01 65 07 eb 01 85 c4 68 4c e5 f8 ee 09 c9 50 18 .e.....hL.....P. 0030 f6 e7 ea 7b 00 00 00 00 00 b1 60 81 ae 06 09 2a ...{......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 c1 63 e3 1b b1 e1 3d cd f9 5e f9 15 30 6c d4 b1 .c....=..^..0l.. 0060 0b 37 55 0b 43 cb 64 a7 45 97 e7 38 24 84 5b 3c .7U.C.d.E..8$.[< 0070 a7 d9 4f cd b0 4c ad 49 50 20 d6 4f 2c f6 c3 b7 ..O..L.IP .O,... 0080 83 d8 f1 db 73 56 80 8d e5 3f a4 f1 23 dd 3f 1f ....sV...?..#.?. 0090 bb 4a c9 28 57 85 ac 7d 32 92 e8 59 b0 15 29 e9 .J.(W..}2..Y..). 00a0 1d f6 4c 76 6e 7b df 4c 40 d5 c5 0b 8b 57 d2 80 ..Lvn{.L@....W.. 00b0 63 93 58 72 ce 35 81 a2 3e 54 f5 76 d9 cb 5a 00 c.Xr.5..>T.v..Z. 00c0 92 38 7e e2 2e 72 da 69 9f c2 ed c0 12 33 0d c9 .8~..r.i.....3.. 00d0 56 26 ca 92 2d b4 1d c9 33 01 24 9d f8 a6 fe 26 V&..-...3.$....& 00e0 95 f5 d2 90 8a bb 0c 77 4d ca 18 .......wM.. No. Time Source Destination Protocol Info 62 61.806732 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 62 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 5954, Ack: 2306, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d d4 40 00 80 06 6c 3c ac 1f 01 65 ac 1f ..-.@...l<...e.. 0020 01 68 01 85 07 eb f8 ee 09 c9 c4 68 4d 9a 50 10 .h.........hM.P. 0030 f8 9f 88 f5 00 00 00 00 15 45 60 82 15 41 06 09 .........E`..A.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 9c e3 fd b2 20 00 52 4b 77 f9 2f 2d a9 d3 6c ..... .RKw./-..l 0060 9e 28 33 88 ca b3 9e 9c 68 1c 46 20 4c bf 9b 10 .(3.....h.F L... 0070 72 09 3c 6a 72 0f fe 59 2b 02 20 65 c1 76 13 43 r..... .+.N.. 0090 8c 1c 0e b1 ea 20 fd 36 42 f8 68 7a c5 87 c8 96 ..... .6B.hz.... 00a0 63 6e c6 d0 c6 9a 44 2a 89 38 48 0a 77 74 27 36 cn....D*.8H.wt'6 00b0 04 58 12 47 5c 45 c5 73 3e a5 27 1d 30 f5 cd b2 .X.G\E.s>.'.0... 00c0 a1 2f b9 d2 7e cd 12 5c 54 70 c9 6b f8 2e 09 e9 ./..~..\Tp.k.... 00d0 37 41 73 2c 75 8c a9 e9 6f 16 af 7a 2c e9 61 3b 7As,u...o..z,.a; 00e0 21 81 d0 79 ed c1 2b dd f6 3b f1 f3 1c 89 05 97 !..y..+..;...... 00f0 b8 65 7b b3 10 be d0 65 65 43 02 9e 79 c9 cd a3 .e{....eeC..y... 0100 c7 c6 0d 3d 04 3a b8 1e 86 b3 43 e2 47 16 91 c4 ...=.:....C.G... 0110 0f 98 e6 61 d9 6b d5 6b ee a0 db 04 84 98 71 2c ...a.k.k......q, 0120 59 33 36 d1 c8 46 19 89 d2 df 41 ff 72 39 a7 5f Y36..F....A.r9._ 0130 c1 30 c5 a6 81 43 dc 14 27 1f dc be c1 87 a4 26 .0...C..'......& 0140 87 62 1f 4a e5 fd 09 12 76 de 68 fb 17 e1 14 3a .b.J....v.h....: 0150 cd cc a2 95 0b fd b6 90 86 d5 b5 8c 3d e9 5d 96 ............=.]. 0160 4c 81 4a 63 3a cb f4 6a 94 65 34 d0 13 e8 87 9a L.Jc:..j.e4..... 0170 70 fb 38 2b 55 d4 61 36 9a aa c8 43 a3 29 0d 48 p.8+U.a6...C.).H 0180 3e 66 20 77 8a 70 c5 3b e2 7c a6 65 fa bd aa e2 >f w.p.;.|.e.... 0190 10 a4 74 42 df a9 f9 4b 75 bb d4 dc a8 fd 34 a5 ..tB...Ku.....4. 01a0 78 02 5b 72 19 56 24 4d 3e c5 5a 8f 34 4d 51 05 x.[r.V$M>.Z.4MQ. 01b0 9e 65 b9 48 21 e1 ca a6 3f 4c 01 19 fa f1 47 2a .e.H!...?L....G* 01c0 ce f7 27 ad 61 7b 1e 5b a3 68 ce 55 01 29 b1 45 ..'.a{.[.h.U.).E 01d0 06 fc 59 ca 39 1c a5 bb f6 39 86 d6 c7 77 e2 df ..Y.9....9...w.. 01e0 4b 51 d6 76 d8 ff 4e c4 75 68 5f 43 75 a9 9d 65 KQ.v..N.uh_Cu..e 01f0 f7 d8 70 74 da d0 0f 28 c3 72 b5 f1 a5 03 4f 33 ..pt...(.r....O3 0200 ee 75 80 68 80 44 47 60 1b 06 c6 3d 23 2e a8 41 .u.h.DG`...=#..A 0210 38 eb 9a ab 81 cc db 4f 97 61 d8 2d 99 db 29 7f 8......O.a.-..). 0220 dc 45 07 30 22 9f 47 10 fc c6 91 64 33 65 fc 09 .E.0".G....d3e.. 0230 00 f4 d6 96 dc 6b 3f 88 50 7e 77 5a 2e f3 60 ca .....k?.P~wZ..`. 0240 4e b2 9a 37 10 c1 90 a9 21 4b 2b ee 26 11 00 f2 N..7....!K+.&... 0250 00 93 61 08 3f a3 44 4e c1 55 19 92 ce 24 f5 33 ..a.?.DN.U...$.3 0260 77 87 67 ae 85 f8 9a 3e 00 e2 7e a4 c7 08 9c af w.g....>..~..... 0270 f2 9e ed 9c 22 2f 27 86 1d bf 73 86 92 7c 63 55 ...."/'...s..|cU 0280 f3 71 16 72 bd f5 6e 80 4f cf 9d a3 01 7e 5b e4 .q.r..n.O....~[. 0290 c5 40 af 3a 85 41 7c 57 24 44 73 f6 b1 e3 41 95 .@.:.A|W$Ds...A. 02a0 fe bf 31 17 c2 5e 08 fe 9d 53 94 56 a2 dc f8 58 ..1..^...S.V...X 02b0 76 5f 76 fa 76 aa ae 2e 71 a5 7b 2d 43 42 38 17 v_v.v...q.{-CB8. 02c0 91 6a a4 c5 4c 4b e2 98 f1 4f cb 42 51 97 fd da .j..LK...O.BQ... 02d0 dc e0 8c 5d 37 2e d3 29 f1 ad 95 49 50 63 72 01 ...]7..)...IPcr. 02e0 b7 cf 48 18 b5 64 88 64 39 a2 9f 24 bd ec 53 32 ..H..d.d9..$..S2 02f0 54 89 40 74 57 3f 32 1d 9e 04 23 be 00 06 be 20 T.@tW?2...#.... 0300 b3 54 ba 9c 5d cc 19 53 be b0 be 66 52 03 6d 17 .T..]..S...fR.m. 0310 97 d3 9e 4b a5 0f ce 54 d3 50 24 8a 5b 48 58 1c ...K...T.P$.[HX. 0320 aa f4 8f 2c 9d 07 0f 63 67 84 02 1f 02 45 11 c8 ...,...cg....E.. 0330 ec 92 98 4d b8 98 a4 57 ca 7f f5 ec 9f 53 0b 9a ...M...W.....S.. 0340 e3 a3 88 8a 0c 48 f1 d9 9a e4 20 69 b7 b8 8f 43 .....H.... i...C 0350 4e 7a 08 3e e9 b0 97 c9 d1 9d 35 bf 0c 45 59 92 Nz.>......5..EY. 0360 f9 b6 74 0e 28 f1 c3 69 fe c0 b8 a2 00 11 53 72 ..t.(..i......Sr 0370 cf 95 48 f0 da 3b d6 22 c8 d9 c6 09 b5 63 e0 18 ..H..;.".....c.. 0380 ac 82 a9 bf 93 c2 b8 ab cd 5a e7 46 31 4f 99 5b .........Z.F1O.[ 0390 5d 1c 97 da 84 5e 40 b2 70 08 87 61 12 89 10 cd ]....^@.p..a.... 03a0 80 7d 39 d5 2f b6 42 de 00 10 09 81 1e 51 dc 13 .}9./.B......Q.. 03b0 6d d0 dd 06 a8 c9 4d 27 a0 4a a4 26 92 ae 88 36 m.....M'.J.&...6 03c0 64 31 e1 e3 b2 9f d5 1c 8e 8c 02 15 e7 4f 8b cf d1...........O.. 03d0 a3 e7 5f f7 cb 67 bf 40 6c 40 82 9a da 59 8e 88 .._..g.@l@...Y.. 03e0 05 67 d8 d1 0c 8f b5 50 5a 07 84 8a c0 c8 b0 2d .g.....PZ......- 03f0 b9 d3 ae 4d 30 0c d8 09 9a 36 e0 a1 49 0e ad fc ...M0....6..I... 0400 85 66 64 63 e6 16 11 1d bd bf 9a f8 98 b7 0f 8d .fdc............ 0410 24 2e 64 a7 d6 f6 98 59 c4 f8 8b 07 04 80 d9 9e $.d....Y........ 0420 ba 4b 7b f6 3f eb 12 66 6f 04 93 26 52 44 4f b6 .K{.?..fo..&RDO. 0430 5d c0 98 3c 03 31 ec 7c 93 a1 44 08 da d3 37 7e ]..<.1.|..D...7~ 0440 91 c9 e4 d2 29 68 5a 27 15 e4 24 04 c6 ce 70 5b ....)hZ'..$...p[ 0450 83 d3 f0 09 43 84 50 58 46 44 89 be 89 7c 1d 7d ....C.PXFD...|.} 0460 42 e1 9c bf 52 d8 7a 65 1f 6a 23 91 81 4f 2f 7b B...R.ze.j#..O/{ 0470 cf 09 38 cd 2b 0d 98 50 5b 51 18 43 ec 5d 32 4b ..8.+..P[Q.C.]2K 0480 25 d2 31 0b c2 e7 f7 b7 39 d7 32 ea db 3f bb 37 %.1.....9.2..?.7 0490 f7 ea 16 1c d9 d8 4c 9e 09 ef fb 82 74 81 b9 8e ......L.....t... 04a0 06 41 1d 97 2d 1c 5d 9c 90 8e 08 b5 74 12 ab 56 .A..-.].....t..V 04b0 85 10 31 8a a2 cd d5 b0 eb 9a c6 ff a0 eb f2 f3 ..1............. 04c0 bf 0c 2c 0a 9c cf d0 e4 18 fb 54 79 37 f2 0e 6d ..,.......Ty7..m 04d0 4b c2 a9 7c 3c 76 e2 d2 8a 7e 33 0d 74 c2 60 de K..|..[.!..... 0530 a5 05 f1 8c 25 3f ad 87 ea d0 97 d9 ed 9e fc e6 ....%?.......... 0540 94 c4 05 fd d2 fc 07 ed 2e bf 0b 6e c9 f6 59 ff ...........n..Y. 0550 e5 f9 69 95 ae ed c5 41 44 72 d2 75 82 8b 3a ca ..i....ADr.u..:. 0560 dc f2 a7 24 61 9b f0 45 2b f6 f2 c5 bc 4b c6 43 ...$a..E+....K.C 0570 01 ea 5d 6f ec fe 2b 4c f2 99 2a fd d3 8b ac 6e ..]o..+L..*....n 0580 e0 68 1b dd a0 c2 be e0 19 47 84 b1 31 69 1d 70 .h.......G..1i.p 0590 d1 2f 95 37 39 26 65 fa 2f d1 b2 15 7b d6 14 8f ./.79&e./...{... 05a0 6b 93 37 14 c9 3c 15 28 61 29 a3 35 7a 29 8d 97 k.7..<.(a).5z).. 05b0 95 fa a9 a2 7e 7c ae 62 26 ea 92 df 43 2d 5a 96 ....~|.b&...C-Z. 05c0 44 50 ac 6d 6e 44 fc 8f f8 7f 2c c1 c9 96 ec f8 DP.mnD....,..... 05d0 02 00 21 6f 50 25 a3 12 b0 82 ec e7 d3 cd 33 b3 ..!oP%........3. 05e0 a2 9b 52 c5 13 98 4c 85 df 91 ..R...L... No. Time Source Destination Protocol Info 63 61.806882 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 63 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 7414, Ack: 2306, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d d5 40 00 80 06 6c 3b ac 1f 01 65 ac 1f ..-.@...l;...e.. 0020 01 68 01 85 07 eb f8 ee 0f 7d c4 68 4d 9a 50 10 .h.......}.hM.P. 0030 f8 9f f0 05 00 00 68 62 b6 e2 db 19 42 47 75 65 ......hb....BGue 0040 0a 94 29 ae fb 71 a4 d9 85 1b 6e 42 11 8c 31 a6 ..)..q....nB..1. 0050 52 9a 82 7b cf 86 1e 4a d1 c1 3d 3e 05 d5 01 31 R..{...J..=>...1 0060 80 28 63 59 c4 22 c0 2b e2 ed 04 17 9d ae 1e 5a .(cY.".+.......Z 0070 9f 05 8a 01 87 19 2d 63 07 2a 41 c0 b3 5e 3d 39 ......-c.*A..^=9 0080 27 56 d3 6f 43 32 8c dc 08 55 dd 60 82 69 8d ec 'V.oC2...U.`.i.. 0090 fd 0e 41 0a cb d3 02 2d 92 81 21 71 9c e0 77 0c ..A....-..!q..w. 00a0 a2 42 f4 fd 5f 6f 3c cf 7c 33 09 6e b9 f0 d7 45 .B.._o<.|3.n...E 00b0 7a 30 68 d2 05 bd f8 42 92 24 54 bb 47 70 7d 16 z0h....B.$T.Gp}. 00c0 02 a6 22 f5 ce 0f d8 d2 ac 34 9d 7a d4 f5 ad 27 .."......4.z...' 00d0 76 44 9d 73 95 ae f9 4f 6a c0 2f b2 ed 17 e1 9b vD.s...Oj./..... 00e0 9b 40 07 7b d2 c1 c4 3a 2f d1 6c b1 41 18 3b cb .@.{...:/.l.A.;. 00f0 5e c5 da 9b 09 98 be 6a 29 25 95 41 8b 7b 29 90 ^......j)%.A.{). 0100 33 76 4b 8a 7f fe 71 0a 37 ae 88 32 92 f1 f7 a4 3vK...q.7..2.... 0110 a1 68 8b 7a de a2 f3 11 c9 88 90 a8 2e c8 4f 87 .h.z..........O. 0120 41 04 75 db 73 fb 8f 46 94 b3 58 fe f6 8f 18 4c A.u.s..F..X....L 0130 19 9f 1a 1e 7a 03 44 a3 f5 3a dc d5 40 48 d3 40 ....z.D..:..@H.@ 0140 9b c7 c5 af f1 1f 16 da 54 64 38 6f 84 06 e0 06 ........Td8o.... 0150 98 a4 46 1c 54 3f 8e 5e 1d cc c2 5e 71 a6 04 03 ..F.T?.^...^q... 0160 50 38 f6 92 32 12 8f 42 06 83 16 88 31 5e 80 bc P8..2..B....1^.. 0170 b4 7c 2e ab ad e5 0e 60 8f 34 ad 1a 67 4c a0 f4 .|.....`.4..gL.. 0180 83 10 0e 53 47 aa 7f 0b 8c 17 56 81 4b b3 05 b6 ...SG.....V.K... 0190 60 27 aa 9c ce ea 8d 77 c2 70 84 cb 88 29 d7 3f `'.....w.p...).? 01a0 04 ef e4 bd ff 07 4f b9 3b 4d 7d 97 9d 8e 76 d9 ......O.;M}...v. 01b0 f0 6e 02 96 6a e4 ba 83 ac e0 32 ad ff 0c 93 61 .n..j.....2....a 01c0 37 44 ae de 14 c9 79 c9 72 a8 54 10 40 9e c7 fd 7D....y.r.T.@... 01d0 f5 28 4b 4d 2c c7 ea 73 d9 83 4d 07 25 4b c2 0f .(KM,..s..M.%K.. 01e0 e1 ed 15 7f a6 5c 6b 98 bd 77 12 09 51 20 11 ab .....\k..w..Q .. 01f0 f2 ef 2a dd 56 bb cd 2b 1a 91 99 d3 70 bf 0c 2f ..*.V..+....p../ 0200 f4 b4 dc e8 ac e4 d6 a0 c4 b7 10 68 54 61 68 77 ...........hTahw 0210 69 b2 18 64 3c cb 16 d6 07 1d 11 76 7f a2 95 d8 i..d<......v.... 0220 93 01 17 fb 28 82 d5 67 29 12 14 6a 98 b9 39 50 ....(..g)..j..9P 0230 4a 70 a1 52 d9 0b 56 09 3f a5 53 ae 78 6f 03 e0 Jp.R..V.?.S.xo.. 0240 f8 4a 97 90 1c 65 85 3a a5 81 5d cb 77 a6 5d bd .J...e.:..].w.]. 0250 32 01 61 da 10 93 b6 0d e9 d8 6d a1 56 38 10 6e 2.a.......m.V8.n 0260 24 7e 2e 3a 82 8b 1f 8e c7 39 04 cd 3b 8e f0 7a $~.:.....9..;..z 0270 3a a6 d8 4f ce 50 bb e8 0d 57 b5 b4 23 be 95 74 :..O.P...W..#..t 0280 12 6f 9d 94 f9 7e 12 54 1d cc 95 d9 4e 58 0b 8d .o...~.T....NX.. 0290 3d ed fe 43 2c 97 8b 15 76 a3 e9 d4 49 f1 82 cb =..C,...v...I... 02a0 bc d9 cd 97 bc 1b 20 4a 6f fd b9 f9 63 6b 72 bf ...... Jo...ckr. 02b0 23 c0 ce 58 ae 0b a7 26 ef df c4 47 22 80 72 0f #..X...&...G".r. 02c0 78 4b 1c d2 3d 5f c8 85 0e 3a 7a 3c cd 39 63 c3 xK..=_...:z<.9c. 02d0 50 90 f1 82 b9 56 5c f6 36 9e 0f 9a dd 8f bb 61 P....V\.6......a 02e0 cc 6f 7e b6 57 05 86 77 d9 e1 bb ab 2b c6 d6 76 .o~.W..w....+..v 02f0 bd 48 08 a0 f2 02 02 af 5f 1c 3a e6 3e ad 5e 97 .H......_.:.>.^. 0300 57 7c 7b 6d d2 f8 f9 d6 a8 00 85 37 91 c6 d8 ed W|{m.......7.... 0310 60 0b bb d8 c7 c7 7a 0f c8 1c ba ba 65 e6 ff 2f `.....z.....e../ 0320 ad ee ce 58 e1 89 f7 51 a3 45 13 72 11 2d 44 06 ...X...Q.E.r.-D. 0330 f1 e3 e0 c2 82 bb 03 26 96 a2 3d d6 b8 6c d7 7e .......&..=..l.~ 0340 3f 4c d3 32 51 ef e7 f5 f3 ea 03 64 8f d9 1b 2e ?L.2Q......d.... 0350 48 7f 06 90 79 8a b9 cb 90 c7 d5 a0 62 e8 08 02 H...y.......b... 0360 d1 b9 d3 ab e5 08 c0 c6 cc c9 2c 0a 19 54 40 22 ..........,..T@" 0370 a8 4d a2 55 fe 5f d9 ee a7 29 3a 7d df 14 00 43 .M.U._...):}...C 0380 4f 03 95 ae 1b 61 6e c9 34 ad 57 50 ab dc 4e 6f O....an.4.WP..No 0390 cf 6c d8 9a 8d 26 1a 8e 5f fc 9a 67 9c e6 62 4e .l...&.._..g..bN 03a0 8f 46 a0 17 8c f6 64 74 ef 45 ed 5b 83 86 12 66 .F....dt.E.[...f 03b0 3a c4 c8 58 d0 e1 92 00 7d 35 08 db 58 15 f6 b8 :..X....}5..X... 03c0 b8 33 1b 07 1c 4f d7 78 39 8d 8d 5c ba 79 74 db .3...O.x9..\.yt. 03d0 33 49 fb 91 cc 40 fd fc 3f e2 32 f5 1b 3b 10 63 3I...@..?.2..;.c 03e0 4a 3d c3 0f 3b e0 30 3d b3 85 73 f7 25 d7 4c e4 J=..;.0=..s.%.L. 03f0 48 49 6b f2 70 76 b5 7c ce ee f3 6e 82 f2 75 c7 HIk.pv.|...n..u. 0400 66 6d b7 03 5f fc be 88 03 e3 ac c1 f3 63 e6 78 fm.._........c.x 0410 77 77 c2 f2 35 f6 13 72 d1 2b 13 39 07 ab 44 3a ww..5..r.+.9..D: 0420 0c 38 fc 96 7a f3 dd 8a 42 5f 7e 9a b8 e8 fa be .8..z...B_~..... 0430 dd b2 14 0a 36 01 31 60 ac aa e9 5d 7d 65 b7 f8 ....6.1`...]}e.. 0440 35 05 0b a7 5a 64 c7 fa ca 9c e2 c5 73 34 0d 21 5...Zd......s4.! 0450 70 ca 95 86 53 68 34 c5 78 2c fa 92 5a 0d ae a7 p...Sh4.x,..Z... 0460 63 83 08 cf b6 a7 3b 5c 87 b9 93 23 8e 39 af 3d c.....;\...#.9.= 0470 a2 39 4a 0a 8d 8f 9c 77 7e 9d 79 69 45 10 28 6e .9J....w~.yiE.(n 0480 a7 8f f5 61 c7 9d f1 46 ae d0 46 f1 85 b2 bd 1d ...a...F..F..... 0490 77 b0 49 39 cb 02 56 62 5f 13 8c 5f 62 2e 24 5b w.I9..Vb_.._b.$[ 04a0 19 4a ab 32 76 e0 00 1f 0e 9a ea 21 01 6d c0 3d .J.2v......!.m.= 04b0 4f 1c cc a8 7e 41 b0 d8 0e 2d 6c 69 bf cf c6 28 O...~A...-li...( 04c0 2f 60 7d 73 7e 75 b1 56 c4 16 6b 11 5c 27 16 44 /`}s~u.V..k.\'.D 04d0 6c 30 8b ce 8a 2d f0 9b ee 13 98 21 52 f2 eb ba l0...-.....!R... 04e0 09 53 87 34 fc a0 ee f5 ab 1d fa de e5 85 24 a8 .S.4..........$. 04f0 2b dc e9 f4 d0 c2 ee 4f 8c c4 cf 54 0f 88 61 b7 +......O...T..a. 0500 26 0e fa 64 6f cd 02 83 6e fc a7 d2 31 24 3b 81 &..do...n...1$;. 0510 dd 7e 10 40 ba 0d 76 12 f9 6f 12 84 5a 31 82 5f .~.@..v..o..Z1._ 0520 fb 4d 21 9d 8b 46 21 ff 3e e9 51 f8 b0 81 54 48 .M!..F!.>.Q...TH 0530 5e e1 5a 15 f8 28 07 8f a1 04 f4 f2 13 30 f5 a7 ^.Z..(.......0.. 0540 f4 eb 5d c8 03 23 cb 11 0d d5 c8 0c bd c0 55 a3 ..]..#........U. 0550 58 ca 1b e9 d5 0e 45 c4 0c 0e 8f 5a 35 9c b9 11 X.....E....Z5... 0560 18 6a b2 b3 f4 06 7b ff 6e e5 72 91 49 b3 87 06 .j....{.n.r.I... 0570 c0 ca 85 4b 00 9c 3a 4c fb 4d 07 6b 2c 6a 7d 54 ...K..:L.M.k,j}T 0580 54 22 56 97 0b bc 75 ac 63 8d 7e 1d ed ea 82 fa T"V...u.c.~..... 0590 0e 58 fb b9 0c 1a a2 fc fc 92 bf 31 84 58 e0 19 .X.........1.X.. 05a0 ca 32 71 e6 ec de cd 97 ef 42 f8 6e 61 92 46 0a .2q......B.na.F. 05b0 6a a3 15 b0 6d c5 38 cb f0 bc 9d 7c 83 84 96 50 j...m.8....|...P 05c0 41 a2 3f f8 0f 7f f5 0f c0 c4 38 a5 90 e0 f0 62 A.?.......8....b 05d0 13 fd 0d a6 5b 51 9d 38 2f ec c8 10 4b 89 6e 97 ....[Q.8/...K.n. 05e0 77 91 36 bc 4c fc e2 5a 0e 50 w.6.L..Z.P No. Time Source Destination Protocol Info 64 61.806965 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 64 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 8874, Ack: 2306, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d d6 40 00 80 06 6c 3a ac 1f 01 65 ac 1f ..-.@...l:...e.. 0020 01 68 01 85 07 eb f8 ee 15 31 c4 68 4d 9a 50 10 .h.......1.hM.P. 0030 f8 9f 79 f3 00 00 22 d4 3d 2e 9e f8 39 1d e7 2e ..y...".=...9... 0040 7a 9d 2d b3 0b 2b 94 70 17 71 29 7d f6 05 76 ea z.-..+.p.q)}..v. 0050 36 04 c9 23 3c 89 1e 1d 3a 8d 80 b5 c0 96 58 a5 6..#<...:.....X. 0060 de 3f cf fc 0f c3 b5 5a 22 4a 44 db c9 ca 09 87 .?.....Z"JD..... 0070 44 29 e4 e3 94 1b a1 e1 4f 45 da f5 fc e5 14 f2 D)......OE...... 0080 2e 5e 52 b8 cd 17 47 9c af 54 5c ab a8 e3 94 69 .^R...G..T\....i 0090 80 5a 95 97 0a 6c 48 19 2e 47 14 a4 2f 12 8c 1a .Z...lH..G../... 00a0 b3 f7 92 7d 80 0d 6f 03 16 f5 96 f4 80 0f ba 89 ...}..o......... 00b0 41 65 64 05 b3 ca 7f 9f 4e d3 f9 3b fd 51 ab 20 Aed.....N..;.Q. 00c0 98 c5 ac 70 23 62 9d 08 f6 a8 0f 9b 0b 88 b2 04 ...p#b.......... 00d0 5a 8f 1c 88 56 34 32 5a 0b bb a2 1c 0b 3e 77 51 Z...V42Z.....>wQ 00e0 fc 2c ae 54 7f 58 b2 7f 78 76 87 54 19 13 13 62 .,.T.X..xv.T...b 00f0 75 98 29 7e 7a e9 72 a5 4c e2 4c f1 52 43 7b a8 u.)~z.r.L.L.RC{. 0100 cf 47 61 3c 78 79 ab 0d 02 7b c2 79 a8 93 54 42 .Gaf_.C..o0.....{ 02f0 8e ec c4 8b 35 3c 34 d5 64 24 e3 81 c2 9b 2b 39 ....5<4.d$....+9 0300 cd bd 79 7b 02 62 da e2 a8 f2 00 7a 33 eb 04 37 ..y{.b.....z3..7 0310 d8 0a 58 e2 bc 56 ab 92 34 51 e0 63 28 87 55 8d ..X..V..4Q.c(.U. 0320 5a f5 93 b1 da 53 59 61 2d e9 d6 5a 7d 3c db 4b Z....SYa-..Z}<.K 0330 1c e8 a6 cd 3e 4e 1f f0 e2 1d 72 20 37 c8 cf d0 ....>N....r 7... 0340 59 a0 d5 aa 35 98 cb d2 99 63 a1 5a e8 ed b5 e6 Y...5....c.Z.... 0350 86 c4 d9 c9 32 1e e0 94 6a 38 a7 1e 8b 97 c6 20 ....2...j8..... 0360 25 4a 82 ec 5f 92 e7 26 0c 9e c2 5a 80 e5 27 80 %J.._..&...Z..'. 0370 c3 0a 1f 78 03 d8 a0 81 a2 7d d3 36 dd 7a ff e8 ...x.....}.6.z.. 0380 2f 4d d5 4c 36 46 f3 1e 55 de 45 08 95 94 99 76 /M.L6F..U.E....v 0390 7a 4f fc 8b df 45 4b e0 60 d9 ad d5 4f a4 af d8 zO...EK.`...O... 03a0 b7 6f 09 63 41 4e c4 23 50 21 9f 89 cb 95 7e 10 .o.cAN.#P!....~. 03b0 6f 13 15 17 7e 79 d2 e7 96 6e 1b e9 d2 f4 bc 75 o...~y...n.....u 03c0 3f 3e 6d 3d d4 fc 0e 29 2d a9 67 ae 1b a8 8c 9b ?>m=...)-.g..... 03d0 87 cd 89 85 cd 85 28 aa 91 10 9c 09 81 57 af 83 ......(......W.. 03e0 b3 7f 47 24 31 67 4b 26 4c 49 af 4e d5 a3 9d 47 ..G$1gK&LI.N...G 03f0 dd ca 2f 66 5a fe 16 0e db 10 8c 63 b9 23 08 2b ../fZ......c.#.+ 0400 df c9 8f d7 3d 6e d8 9d f2 df ae 42 b8 40 d8 f2 ....=n.....B.@.. 0410 bb 3e f4 75 92 54 2d 23 36 c8 00 9f 69 12 65 0c .>.u.T-#6...i.e. 0420 7f e1 7a 7f 08 87 81 b3 34 c0 23 2a ef 76 52 d6 ..z.....4.#*.vR. 0430 09 ab 2e 5e 8a c7 1e 6b 2a 4c a2 be f1 01 e1 36 ...^...k*L.....6 0440 4b 60 13 63 d0 71 a7 bd a3 bc 5d 14 8e ec 80 5c K`.c.q....]....\ 0450 75 d4 db f0 60 53 94 56 36 7e cc 2a d0 2d 96 82 u...`S.V6~.*.-.. 0460 16 73 51 38 2e 7b 29 63 cf bd d8 be d0 74 28 a7 .sQ8.{)c.....t(. 0470 54 f1 ac 7a 30 9b 4e 35 2e 27 a5 b4 37 59 6f d6 T..z0.N5.'..7Yo. 0480 83 5c dd f9 c2 fe 15 0a 41 ca d3 2d cd bc 38 3b .\......A..-..8; 0490 fb 25 2d 46 8d ed ac 17 d2 21 ce 3f 42 d1 f4 82 .%-F.....!.?B... 04a0 63 36 61 9d 1d 12 b8 83 1b fd 93 41 63 d9 87 5a c6a........Ac..Z 04b0 81 c1 f3 de ba 73 91 e6 f0 b4 92 34 f8 50 d6 67 .....s.....4.P.g 04c0 dc ac 89 d1 b2 b3 d2 f8 d1 07 7e b1 86 78 e3 8c ..........~..x.. 04d0 e0 55 f9 77 1a 4e 62 7e 1f 34 9d e4 cf 65 e3 6e .U.w.Nb~.4...e.n 04e0 ce f6 1e 57 47 32 6e a6 e3 ce 25 f5 38 25 89 4d ...WG2n...%.8%.M 04f0 00 8a 4f 07 57 3b 3a e6 27 a6 cd b1 56 e1 d4 36 ..O.W;:.'...V..6 0500 b3 d7 f8 e7 24 b7 8c 6c b4 9b da ac f9 1e d6 29 ....$..l.......) 0510 a6 a9 57 ef 7e 3e 43 89 22 2e 69 f8 a6 b9 33 81 ..W.~>C.".i...3. 0520 4f dd d4 7a 91 89 1c 9e 87 c0 6c a1 1a 6b 65 90 O..z......l..ke. 0530 80 b2 c9 b2 12 c3 7f 86 57 fb f7 58 82 f6 e9 a3 ........W..X.... 0540 81 ee 0b 74 c0 7a 75 2d cd d4 82 ea 7f ff 6c 08 ...t.zu-......l. 0550 a8 43 09 4a b7 52 3e 8a b3 13 8f 3e 43 94 0e 71 .C.J.R>....>C..q 0560 5a fc 49 1e cf 29 99 2a a0 5e 7a df cf 38 fc 2e Z.I..).*.^z..8.. 0570 4d 1f 58 a4 c8 c4 32 dd 70 b7 97 85 7e 4d 62 d9 M.X...2.p...~Mb. 0580 84 d4 45 0d 42 a5 18 73 74 6f 5e 8a 4a 2a 71 30 ..E.B..sto^.J*q0 0590 3c 1a b4 34 51 a2 59 7b e9 2d 72 ca 3f 64 a2 f9 <..4Q.Y{.-r.?d.. 05a0 46 91 c9 b5 0f 0f 32 1a 66 a7 97 bc 2c c9 7a d7 F.....2.f...,.z. 05b0 8d 8e b1 22 c6 6f 38 60 24 ae 4e be 92 c8 4e 45 ...".o8`$.N...NE 05c0 71 07 0b e8 90 fb 0e da 6c df f9 42 c7 d5 21 17 q.......l..B..!. 05d0 61 fa 11 49 81 b6 5e 4e ea 85 ec ce 07 e4 f1 af a..I..^N........ 05e0 41 3b 01 f1 a8 55 b9 c4 43 fc A;...U..C. No. Time Source Destination Protocol Info 65 61.807042 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (5398 bytes) Frame 65 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 10334, Ack: 2306, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 5445 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9CE3FDB22000524B77F92F2DA9D36C9E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9CE3FDB22000524B krb5_sgn_cksum: 77F92F2DA9D36C9E krb5_confounder: 283388CAB39E9C68 GSS-API Encrypted payload (5398 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2d d7 40 00 80 06 6d c0 ac 1f 01 65 ac 1f .U-.@...m....e.. 0020 01 68 01 85 07 eb f8 ee 1a e5 c4 68 4d 9a 50 18 .h.........hM.P. 0030 f8 9f df a8 00 00 bb a0 d9 ad a1 4e 97 8f d6 a1 ...........N.... 0040 de a3 91 60 58 f7 6a bb b6 1d f6 8c 7f 80 d0 58 ...`X.j........X 0050 a4 63 8d 22 4e a7 ad 8a e5 bd 86 86 94 37 3f a9 .c."N........7?. 0060 62 d2 fd 31 a6 19 34 c0 46 fd 97 c6 9b 68 4a 10 b..1..4.F....hJ. 0070 56 a9 b7 50 91 92 86 da 50 a4 ba e1 ec 61 ab 5a V..P....P....a.Z 0080 67 d3 74 dc 80 05 22 21 e3 d5 84 b5 d0 c4 ce e4 g.t..."!........ 0090 36 00 01 2f 8a 07 8c 8c 8c 7e c7 31 68 9f 87 bc 6../.....~.1h... 00a0 40 f5 7b 60 cf 84 92 fd 8a 81 ff a5 b3 22 cd b1 @.{`.........".. 00b0 43 e2 66 6e 5a 4e bb af fb b4 f1 b8 02 8d 0e 74 C.fnZN.........t 00c0 3e 28 51 f4 e4 1a 95 43 e7 67 d3 fe 0f d4 8c 65 >(Q....C.g.....e 00d0 52 39 59 dd 8e 64 0f 20 37 95 a7 57 e5 b3 0b fd R9Y..d. 7..W.... 00e0 69 f3 e1 fd c1 61 bc c5 d5 29 c9 6a 3c c6 55 e1 i....a...).j<.U. 00f0 ed 43 6e 2f 91 11 8b 23 43 14 c1 d2 26 77 33 3e .Cn/...#C...&w3> 0100 d6 e1 c4 c8 af 0f ad 36 06 68 91 07 cb c7 c7 a7 .......6.h...... 0110 2b ac a2 4d 63 10 92 6b e6 d2 8d ce e7 a3 20 c6 +..Mc..k...... . 0120 c8 48 c7 ee a8 f0 6e dc e2 23 ae 91 d1 d3 58 dc .H....n..#....X. 0130 c5 fe e4 2d ee 8a 39 4d 7b bc b6 28 33 92 4e c9 ...-..9M{..(3.N. 0140 a3 40 55 08 e1 c7 e2 6e 84 1b 4a 4f db 94 ec de .@U....n..JO.... 0150 3e 5c d1 b1 28 e4 f9 41 0b 49 d6 51 6d f5 91 17 >\..(..A.I.Qm... 0160 e3 1e 55 42 c3 ed e0 b7 f1 a7 5f 24 60 8c 2a a7 ..UB......_$`.*. 0170 a5 5a 59 77 84 6b b8 31 da 27 cc c6 f7 f5 22 42 .ZYw.k.1.'...."B 0180 07 a7 1e 47 38 20 84 55 63 e1 b2 aa eb b2 cc 1a ...G8 .Uc....... 0190 03 70 46 2c 12 f6 fa b8 bc 88 b3 73 17 a7 65 49 .pF,.......s..eI 01a0 72 ba 9c b4 4d 27 68 8d 31 53 5f 67 5c 17 aa 0f r...M'h.1S_g\... 01b0 e7 21 68 8f 2a 7a c0 a5 f0 ed b2 8a 0f cc c1 19 .!h.*z.......... 01c0 55 f9 0a 8a 4d c4 08 95 c0 36 6f 63 bc 53 ea e4 U...M....6oc.S.. 01d0 7a a2 b7 0c 07 ae 37 57 c4 58 88 7a 17 3d 4d 94 z.....7W.X.z.=M. 01e0 fe 14 e0 38 dc f3 78 f6 61 12 c3 10 e2 d8 ae ae ...8..x.a....... 01f0 3d 98 db db 38 20 da 41 6c a0 78 f6 5e ea d0 f9 =...8 .Al.x.^... 0200 62 2c d3 bf 3d 51 68 ea 56 fc 35 6c 5c cc 3d b2 b,..=Qh.V.5l\.=. 0210 7e d2 45 05 05 ac 17 8a 67 ec 62 8b 5c 64 bb fd ~.E.....g.b.\d.. 0220 3c fc 00 eb 32 24 2f fd 14 10 67 f9 97 19 6b 19 <...2$/...g...k. 0230 0d 14 40 96 a1 d5 70 17 2f 68 85 6d 82 22 82 c2 ..@...p./h.m.".. 0240 08 47 98 50 2c 69 a7 ba eb d3 05 a4 40 62 fc e4 .G.P,i......@b.. 0250 4e 50 39 de 98 bb 7f a7 9e 99 4f 8f c2 bd 3c 59 NP9.......O....Q..0...v.. 02b0 df c5 5e aa 69 ae b9 cf c2 41 65 c0 88 3c a5 08 ..^.i....Ae..<.. 02c0 cf 94 89 f7 71 ae da 28 78 41 c2 31 ed 1d 09 ea ....q..(xA.1.... 02d0 4b 22 a5 61 40 c6 a7 f5 a1 9d d7 0b 25 c0 64 14 K".a@.......%.d. 02e0 eb 82 e7 cb 11 24 04 6a 0b 0e d8 5b 93 73 2a 4b .....$.j...[.s*K 02f0 e5 39 23 15 20 67 48 2b f2 64 2a 40 6e bc 6c 6f .9#. gH+.d*@n.lo 0300 62 e2 3b 03 1b 60 a5 11 54 1b f9 4f 1c bc b4 17 b.;..`..T..O.... 0310 8b 5c 4e d4 4c 22 37 fc 16 4f bf ea 5c de 01 a8 .\N.L"7..O..\... 0320 27 89 8a fb 75 4c 08 0e dd c3 1b 2a 7d 42 8a 1a '...uL.....*}B.. 0330 9a 84 da 7f 5d 74 08 8e 12 5b be 71 9a 7b d4 1c ....]t...[.q.{.. 0340 5d 88 d2 56 24 69 0e ef e7 d6 cc 11 fe d8 f8 e6 ]..V$i.......... 0350 d5 b9 2c 04 80 b0 7e 43 8b fc 1c 14 f6 9a 52 33 ..,...~C......R3 0360 e2 a7 cd 36 ac f2 86 d2 0f 5c 86 59 11 f8 9e 73 ...6.....\.Y...s 0370 10 19 1f 7f 99 c8 18 00 e0 f1 b7 2c 6a 74 a4 1c ...........,jt.. 0380 5c 03 d0 7e 5f 6c 3d f0 3a a1 fb 4d 1d dd b2 2b \..~_l=.:..M...+ 0390 b7 79 47 51 a2 c4 4f 9f 6f 24 9f 59 e6 70 db 2a .yGQ..O.o$.Y.p.* 03a0 ca 9b b6 52 15 42 5b 00 3c a6 f7 26 37 79 35 6b ...R.B[.<..&7y5k 03b0 00 45 8f aa 57 c3 75 75 8a 31 34 f8 11 47 b7 85 .E..W.uu.14..G.. 03c0 67 2a 4b d0 49 4f 53 3a eb fe 3b 5c 3c 04 b4 83 g*K.IOS:..;\<... 03d0 10 ab 8c 8c a8 c7 c6 9f c2 44 0b 2a 52 da 9c 6e .........D.*R..n 03e0 67 7f dd d6 61 ac 9a a4 52 91 76 fc 23 86 58 b4 g...a...R.v.#.X. 03f0 a1 e1 7d 3d fc d2 b5 8b c0 40 c3 c8 1e f4 f1 e0 ..}=.....@...... 0400 a7 e1 f3 dd ed 24 28 3a 51 77 c9 d1 77 6d dd f3 .....$(:Qw..wm.. 0410 b0 53 0a 03 74 76 f3 c2 d8 bc 0d 9e e7 38 49 af .S..tv.......8I. 0420 e5 e1 7e a9 d6 dd 34 0c ac f8 64 b4 a6 aa 19 cf ..~...4...d..... 0430 24 72 3c 06 c3 c4 12 36 a3 35 12 12 64 55 4a 55 $r<....6.5..dUJU 0440 69 a6 58 82 0b 9d 78 95 3d 0a 5e 25 56 aa ca 92 i.X...x.=.^%V... 0450 6e da d5 18 1e 9a 03 20 c5 0e 7f 5f b5 7b 72 ee n...... ..._.{r. 0460 46 24 c9 F$. Reassembled TCP (5449 bytes): 0000 00 00 15 45 60 82 15 41 06 09 2a 86 48 86 f7 12 ...E`..A..*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 9c e3 fd b2 20 ............... 0020 00 52 4b 77 f9 2f 2d a9 d3 6c 9e 28 33 88 ca b3 .RKw./-..l.(3... 0030 9e 9c 68 1c 46 20 4c bf 9b 10 72 09 3c 6a 72 0f ..h.F L...r.. 0050 89 ed 1a 20 b0 2b a8 4e 8d d2 8c 1c 0e b1 ea 20 ... .+.N....... 0060 fd 36 42 f8 68 7a c5 87 c8 96 63 6e c6 d0 c6 9a .6B.hz....cn.... 0070 44 2a 89 38 48 0a 77 74 27 36 04 58 12 47 5c 45 D*.8H.wt'6.X.G\E 0080 c5 73 3e a5 27 1d 30 f5 cd b2 a1 2f b9 d2 7e cd .s>.'.0..../..~. 0090 12 5c 54 70 c9 6b f8 2e 09 e9 37 41 73 2c 75 8c .\Tp.k....7As,u. 00a0 a9 e9 6f 16 af 7a 2c e9 61 3b 21 81 d0 79 ed c1 ..o..z,.a;!..y.. 00b0 2b dd f6 3b f1 f3 1c 89 05 97 b8 65 7b b3 10 be +..;.......e{... 00c0 d0 65 65 43 02 9e 79 c9 cd a3 c7 c6 0d 3d 04 3a .eeC..y......=.: 00d0 b8 1e 86 b3 43 e2 47 16 91 c4 0f 98 e6 61 d9 6b ....C.G......a.k 00e0 d5 6b ee a0 db 04 84 98 71 2c 59 33 36 d1 c8 46 .k......q,Y36..F 00f0 19 89 d2 df 41 ff 72 39 a7 5f c1 30 c5 a6 81 43 ....A.r9._.0...C 0100 dc 14 27 1f dc be c1 87 a4 26 87 62 1f 4a e5 fd ..'......&.b.J.. 0110 09 12 76 de 68 fb 17 e1 14 3a cd cc a2 95 0b fd ..v.h....:...... 0120 b6 90 86 d5 b5 8c 3d e9 5d 96 4c 81 4a 63 3a cb ......=.].L.Jc:. 0130 f4 6a 94 65 34 d0 13 e8 87 9a 70 fb 38 2b 55 d4 .j.e4.....p.8+U. 0140 61 36 9a aa c8 43 a3 29 0d 48 3e 66 20 77 8a 70 a6...C.).H>f w.p 0150 c5 3b e2 7c a6 65 fa bd aa e2 10 a4 74 42 df a9 .;.|.e......tB.. 0160 f9 4b 75 bb d4 dc a8 fd 34 a5 78 02 5b 72 19 56 .Ku.....4.x.[r.V 0170 24 4d 3e c5 5a 8f 34 4d 51 05 9e 65 b9 48 21 e1 $M>.Z.4MQ..e.H!. 0180 ca a6 3f 4c 01 19 fa f1 47 2a ce f7 27 ad 61 7b ..?L....G*..'.a{ 0190 1e 5b a3 68 ce 55 01 29 b1 45 06 fc 59 ca 39 1c .[.h.U.).E..Y.9. 01a0 a5 bb f6 39 86 d6 c7 77 e2 df 4b 51 d6 76 d8 ff ...9...w..KQ.v.. 01b0 4e c4 75 68 5f 43 75 a9 9d 65 f7 d8 70 74 da d0 N.uh_Cu..e..pt.. 01c0 0f 28 c3 72 b5 f1 a5 03 4f 33 ee 75 80 68 80 44 .(.r....O3.u.h.D 01d0 47 60 1b 06 c6 3d 23 2e a8 41 38 eb 9a ab 81 cc G`...=#..A8..... 01e0 db 4f 97 61 d8 2d 99 db 29 7f dc 45 07 30 22 9f .O.a.-..)..E.0". 01f0 47 10 fc c6 91 64 33 65 fc 09 00 f4 d6 96 dc 6b G....d3e.......k 0200 3f 88 50 7e 77 5a 2e f3 60 ca 4e b2 9a 37 10 c1 ?.P~wZ..`.N..7.. 0210 90 a9 21 4b 2b ee 26 11 00 f2 00 93 61 08 3f a3 ..!K+.&.....a.?. 0220 44 4e c1 55 19 92 ce 24 f5 33 77 87 67 ae 85 f8 DN.U...$.3w.g... 0230 9a 3e 00 e2 7e a4 c7 08 9c af f2 9e ed 9c 22 2f .>..~........."/ 0240 27 86 1d bf 73 86 92 7c 63 55 f3 71 16 72 bd f5 '...s..|cU.q.r.. 0250 6e 80 4f cf 9d a3 01 7e 5b e4 c5 40 af 3a 85 41 n.O....~[..@.:.A 0260 7c 57 24 44 73 f6 b1 e3 41 95 fe bf 31 17 c2 5e |W$Ds...A...1..^ 0270 08 fe 9d 53 94 56 a2 dc f8 58 76 5f 76 fa 76 aa ...S.V...Xv_v.v. 0280 ae 2e 71 a5 7b 2d 43 42 38 17 91 6a a4 c5 4c 4b ..q.{-CB8..j..LK 0290 e2 98 f1 4f cb 42 51 97 fd da dc e0 8c 5d 37 2e ...O.BQ......]7. 02a0 d3 29 f1 ad 95 49 50 63 72 01 b7 cf 48 18 b5 64 .)...IPcr...H..d 02b0 88 64 39 a2 9f 24 bd ec 53 32 54 89 40 74 57 3f .d9..$..S2T.@tW? 02c0 32 1d 9e 04 23 be 00 06 be 20 b3 54 ba 9c 5d cc 2...#.... .T..]. 02d0 19 53 be b0 be 66 52 03 6d 17 97 d3 9e 4b a5 0f .S...fR.m....K.. 02e0 ce 54 d3 50 24 8a 5b 48 58 1c aa f4 8f 2c 9d 07 .T.P$.[HX....,.. 02f0 0f 63 67 84 02 1f 02 45 11 c8 ec 92 98 4d b8 98 .cg....E.....M.. 0300 a4 57 ca 7f f5 ec 9f 53 0b 9a e3 a3 88 8a 0c 48 .W.....S.......H 0310 f1 d9 9a e4 20 69 b7 b8 8f 43 4e 7a 08 3e e9 b0 .... i...CNz.>.. 0320 97 c9 d1 9d 35 bf 0c 45 59 92 f9 b6 74 0e 28 f1 ....5..EY...t.(. 0330 c3 69 fe c0 b8 a2 00 11 53 72 cf 95 48 f0 da 3b .i......Sr..H..; 0340 d6 22 c8 d9 c6 09 b5 63 e0 18 ac 82 a9 bf 93 c2 .".....c........ 0350 b8 ab cd 5a e7 46 31 4f 99 5b 5d 1c 97 da 84 5e ...Z.F1O.[]....^ 0360 40 b2 70 08 87 61 12 89 10 cd 80 7d 39 d5 2f b6 @.p..a.....}9./. 0370 42 de 00 10 09 81 1e 51 dc 13 6d d0 dd 06 a8 c9 B......Q..m..... 0380 4d 27 a0 4a a4 26 92 ae 88 36 64 31 e1 e3 b2 9f M'.J.&...6d1.... 0390 d5 1c 8e 8c 02 15 e7 4f 8b cf a3 e7 5f f7 cb 67 .......O...._..g 03a0 bf 40 6c 40 82 9a da 59 8e 88 05 67 d8 d1 0c 8f .@l@...Y...g.... 03b0 b5 50 5a 07 84 8a c0 c8 b0 2d b9 d3 ae 4d 30 0c .PZ......-...M0. 03c0 d8 09 9a 36 e0 a1 49 0e ad fc 85 66 64 63 e6 16 ...6..I....fdc.. 03d0 11 1d bd bf 9a f8 98 b7 0f 8d 24 2e 64 a7 d6 f6 ..........$.d... 03e0 98 59 c4 f8 8b 07 04 80 d9 9e ba 4b 7b f6 3f eb .Y.........K{.?. 03f0 12 66 6f 04 93 26 52 44 4f b6 5d c0 98 3c 03 31 .fo..&RDO.]..<.1 0400 ec 7c 93 a1 44 08 da d3 37 7e 91 c9 e4 d2 29 68 .|..D...7~....)h 0410 5a 27 15 e4 24 04 c6 ce 70 5b 83 d3 f0 09 43 84 Z'..$...p[....C. 0420 50 58 46 44 89 be 89 7c 1d 7d 42 e1 9c bf 52 d8 PXFD...|.}B...R. 0430 7a 65 1f 6a 23 91 81 4f 2f 7b cf 09 38 cd 2b 0d ze.j#..O/{..8.+. 0440 98 50 5b 51 18 43 ec 5d 32 4b 25 d2 31 0b c2 e7 .P[Q.C.]2K%.1... 0450 f7 b7 39 d7 32 ea db 3f bb 37 f7 ea 16 1c d9 d8 ..9.2..?.7...... 0460 4c 9e 09 ef fb 82 74 81 b9 8e 06 41 1d 97 2d 1c L.....t....A..-. 0470 5d 9c 90 8e 08 b5 74 12 ab 56 85 10 31 8a a2 cd ].....t..V..1... 0480 d5 b0 eb 9a c6 ff a0 eb f2 f3 bf 0c 2c 0a 9c cf ............,... 0490 d0 e4 18 fb 54 79 37 f2 0e 6d 4b c2 a9 7c 3c 76 ....Ty7..mK..| 04f0 cb f8 5b 1b 21 d7 12 18 0a f4 a5 05 f1 8c 25 3f ..[.!.........%? 0500 ad 87 ea d0 97 d9 ed 9e fc e6 94 c4 05 fd d2 fc ................ 0510 07 ed 2e bf 0b 6e c9 f6 59 ff e5 f9 69 95 ae ed .....n..Y...i... 0520 c5 41 44 72 d2 75 82 8b 3a ca dc f2 a7 24 61 9b .ADr.u..:....$a. 0530 f0 45 2b f6 f2 c5 bc 4b c6 43 01 ea 5d 6f ec fe .E+....K.C..]o.. 0540 2b 4c f2 99 2a fd d3 8b ac 6e e0 68 1b dd a0 c2 +L..*....n.h.... 0550 be e0 19 47 84 b1 31 69 1d 70 d1 2f 95 37 39 26 ...G..1i.p./.79& 0560 65 fa 2f d1 b2 15 7b d6 14 8f 6b 93 37 14 c9 3c e./...{...k.7..< 0570 15 28 61 29 a3 35 7a 29 8d 97 95 fa a9 a2 7e 7c .(a).5z)......~| 0580 ae 62 26 ea 92 df 43 2d 5a 96 44 50 ac 6d 6e 44 .b&...C-Z.DP.mnD 0590 fc 8f f8 7f 2c c1 c9 96 ec f8 02 00 21 6f 50 25 ....,.......!oP% 05a0 a3 12 b0 82 ec e7 d3 cd 33 b3 a2 9b 52 c5 13 98 ........3...R... 05b0 4c 85 df 91 68 62 b6 e2 db 19 42 47 75 65 0a 94 L...hb....BGue.. 05c0 29 ae fb 71 a4 d9 85 1b 6e 42 11 8c 31 a6 52 9a )..q....nB..1.R. 05d0 82 7b cf 86 1e 4a d1 c1 3d 3e 05 d5 01 31 80 28 .{...J..=>...1.( 05e0 63 59 c4 22 c0 2b e2 ed 04 17 9d ae 1e 5a 9f 05 cY.".+.......Z.. 05f0 8a 01 87 19 2d 63 07 2a 41 c0 b3 5e 3d 39 27 56 ....-c.*A..^=9'V 0600 d3 6f 43 32 8c dc 08 55 dd 60 82 69 8d ec fd 0e .oC2...U.`.i.... 0610 41 0a cb d3 02 2d 92 81 21 71 9c e0 77 0c a2 42 A....-..!q..w..B 0620 f4 fd 5f 6f 3c cf 7c 33 09 6e b9 f0 d7 45 7a 30 .._o<.|3.n...Ez0 0630 68 d2 05 bd f8 42 92 24 54 bb 47 70 7d 16 02 a6 h....B.$T.Gp}... 0640 22 f5 ce 0f d8 d2 ac 34 9d 7a d4 f5 ad 27 76 44 "......4.z...'vD 0650 9d 73 95 ae f9 4f 6a c0 2f b2 ed 17 e1 9b 9b 40 .s...Oj./......@ 0660 07 7b d2 c1 c4 3a 2f d1 6c b1 41 18 3b cb 5e c5 .{...:/.l.A.;.^. 0670 da 9b 09 98 be 6a 29 25 95 41 8b 7b 29 90 33 76 .....j)%.A.{).3v 0680 4b 8a 7f fe 71 0a 37 ae 88 32 92 f1 f7 a4 a1 68 K...q.7..2.....h 0690 8b 7a de a2 f3 11 c9 88 90 a8 2e c8 4f 87 41 04 .z..........O.A. 06a0 75 db 73 fb 8f 46 94 b3 58 fe f6 8f 18 4c 19 9f u.s..F..X....L.. 06b0 1a 1e 7a 03 44 a3 f5 3a dc d5 40 48 d3 40 9b c7 ..z.D..:..@H.@.. 06c0 c5 af f1 1f 16 da 54 64 38 6f 84 06 e0 06 98 a4 ......Td8o...... 06d0 46 1c 54 3f 8e 5e 1d cc c2 5e 71 a6 04 03 50 38 F.T?.^...^q...P8 06e0 f6 92 32 12 8f 42 06 83 16 88 31 5e 80 bc b4 7c ..2..B....1^...| 06f0 2e ab ad e5 0e 60 8f 34 ad 1a 67 4c a0 f4 83 10 .....`.4..gL.... 0700 0e 53 47 aa 7f 0b 8c 17 56 81 4b b3 05 b6 60 27 .SG.....V.K...`' 0710 aa 9c ce ea 8d 77 c2 70 84 cb 88 29 d7 3f 04 ef .....w.p...).?.. 0720 e4 bd ff 07 4f b9 3b 4d 7d 97 9d 8e 76 d9 f0 6e ....O.;M}...v..n 0730 02 96 6a e4 ba 83 ac e0 32 ad ff 0c 93 61 37 44 ..j.....2....a7D 0740 ae de 14 c9 79 c9 72 a8 54 10 40 9e c7 fd f5 28 ....y.r.T.@....( 0750 4b 4d 2c c7 ea 73 d9 83 4d 07 25 4b c2 0f e1 ed KM,..s..M.%K.... 0760 15 7f a6 5c 6b 98 bd 77 12 09 51 20 11 ab f2 ef ...\k..w..Q .... 0770 2a dd 56 bb cd 2b 1a 91 99 d3 70 bf 0c 2f f4 b4 *.V..+....p../.. 0780 dc e8 ac e4 d6 a0 c4 b7 10 68 54 61 68 77 69 b2 .........hTahwi. 0790 18 64 3c cb 16 d6 07 1d 11 76 7f a2 95 d8 93 01 .d<......v...... 07a0 17 fb 28 82 d5 67 29 12 14 6a 98 b9 39 50 4a 70 ..(..g)..j..9PJp 07b0 a1 52 d9 0b 56 09 3f a5 53 ae 78 6f 03 e0 f8 4a .R..V.?.S.xo...J 07c0 97 90 1c 65 85 3a a5 81 5d cb 77 a6 5d bd 32 01 ...e.:..].w.].2. 07d0 61 da 10 93 b6 0d e9 d8 6d a1 56 38 10 6e 24 7e a.......m.V8.n$~ 07e0 2e 3a 82 8b 1f 8e c7 39 04 cd 3b 8e f0 7a 3a a6 .:.....9..;..z:. 07f0 d8 4f ce 50 bb e8 0d 57 b5 b4 23 be 95 74 12 6f .O.P...W..#..t.o 0800 9d 94 f9 7e 12 54 1d cc 95 d9 4e 58 0b 8d 3d ed ...~.T....NX..=. 0810 fe 43 2c 97 8b 15 76 a3 e9 d4 49 f1 82 cb bc d9 .C,...v...I..... 0820 cd 97 bc 1b 20 4a 6f fd b9 f9 63 6b 72 bf 23 c0 .... Jo...ckr.#. 0830 ce 58 ae 0b a7 26 ef df c4 47 22 80 72 0f 78 4b .X...&...G".r.xK 0840 1c d2 3d 5f c8 85 0e 3a 7a 3c cd 39 63 c3 50 90 ..=_...:z<.9c.P. 0850 f1 82 b9 56 5c f6 36 9e 0f 9a dd 8f bb 61 cc 6f ...V\.6......a.o 0860 7e b6 57 05 86 77 d9 e1 bb ab 2b c6 d6 76 bd 48 ~.W..w....+..v.H 0870 08 a0 f2 02 02 af 5f 1c 3a e6 3e ad 5e 97 57 7c ......_.:.>.^.W| 0880 7b 6d d2 f8 f9 d6 a8 00 85 37 91 c6 d8 ed 60 0b {m.......7....`. 0890 bb d8 c7 c7 7a 0f c8 1c ba ba 65 e6 ff 2f ad ee ....z.....e../.. 08a0 ce 58 e1 89 f7 51 a3 45 13 72 11 2d 44 06 f1 e3 .X...Q.E.r.-D... 08b0 e0 c2 82 bb 03 26 96 a2 3d d6 b8 6c d7 7e 3f 4c .....&..=..l.~?L 08c0 d3 32 51 ef e7 f5 f3 ea 03 64 8f d9 1b 2e 48 7f .2Q......d....H. 08d0 06 90 79 8a b9 cb 90 c7 d5 a0 62 e8 08 02 d1 b9 ..y.......b..... 08e0 d3 ab e5 08 c0 c6 cc c9 2c 0a 19 54 40 22 a8 4d ........,..T@".M 08f0 a2 55 fe 5f d9 ee a7 29 3a 7d df 14 00 43 4f 03 .U._...):}...CO. 0900 95 ae 1b 61 6e c9 34 ad 57 50 ab dc 4e 6f cf 6c ...an.4.WP..No.l 0910 d8 9a 8d 26 1a 8e 5f fc 9a 67 9c e6 62 4e 8f 46 ...&.._..g..bN.F 0920 a0 17 8c f6 64 74 ef 45 ed 5b 83 86 12 66 3a c4 ....dt.E.[...f:. 0930 c8 58 d0 e1 92 00 7d 35 08 db 58 15 f6 b8 b8 33 .X....}5..X....3 0940 1b 07 1c 4f d7 78 39 8d 8d 5c ba 79 74 db 33 49 ...O.x9..\.yt.3I 0950 fb 91 cc 40 fd fc 3f e2 32 f5 1b 3b 10 63 4a 3d ...@..?.2..;.cJ= 0960 c3 0f 3b e0 30 3d b3 85 73 f7 25 d7 4c e4 48 49 ..;.0=..s.%.L.HI 0970 6b f2 70 76 b5 7c ce ee f3 6e 82 f2 75 c7 66 6d k.pv.|...n..u.fm 0980 b7 03 5f fc be 88 03 e3 ac c1 f3 63 e6 78 77 77 .._........c.xww 0990 c2 f2 35 f6 13 72 d1 2b 13 39 07 ab 44 3a 0c 38 ..5..r.+.9..D:.8 09a0 fc 96 7a f3 dd 8a 42 5f 7e 9a b8 e8 fa be dd b2 ..z...B_~....... 09b0 14 0a 36 01 31 60 ac aa e9 5d 7d 65 b7 f8 35 05 ..6.1`...]}e..5. 09c0 0b a7 5a 64 c7 fa ca 9c e2 c5 73 34 0d 21 70 ca ..Zd......s4.!p. 09d0 95 86 53 68 34 c5 78 2c fa 92 5a 0d ae a7 63 83 ..Sh4.x,..Z...c. 09e0 08 cf b6 a7 3b 5c 87 b9 93 23 8e 39 af 3d a2 39 ....;\...#.9.=.9 09f0 4a 0a 8d 8f 9c 77 7e 9d 79 69 45 10 28 6e a7 8f J....w~.yiE.(n.. 0a00 f5 61 c7 9d f1 46 ae d0 46 f1 85 b2 bd 1d 77 b0 .a...F..F.....w. 0a10 49 39 cb 02 56 62 5f 13 8c 5f 62 2e 24 5b 19 4a I9..Vb_.._b.$[.J 0a20 ab 32 76 e0 00 1f 0e 9a ea 21 01 6d c0 3d 4f 1c .2v......!.m.=O. 0a30 cc a8 7e 41 b0 d8 0e 2d 6c 69 bf cf c6 28 2f 60 ..~A...-li...(/` 0a40 7d 73 7e 75 b1 56 c4 16 6b 11 5c 27 16 44 6c 30 }s~u.V..k.\'.Dl0 0a50 8b ce 8a 2d f0 9b ee 13 98 21 52 f2 eb ba 09 53 ...-.....!R....S 0a60 87 34 fc a0 ee f5 ab 1d fa de e5 85 24 a8 2b dc .4..........$.+. 0a70 e9 f4 d0 c2 ee 4f 8c c4 cf 54 0f 88 61 b7 26 0e .....O...T..a.&. 0a80 fa 64 6f cd 02 83 6e fc a7 d2 31 24 3b 81 dd 7e .do...n...1$;..~ 0a90 10 40 ba 0d 76 12 f9 6f 12 84 5a 31 82 5f fb 4d .@..v..o..Z1._.M 0aa0 21 9d 8b 46 21 ff 3e e9 51 f8 b0 81 54 48 5e e1 !..F!.>.Q...TH^. 0ab0 5a 15 f8 28 07 8f a1 04 f4 f2 13 30 f5 a7 f4 eb Z..(.......0.... 0ac0 5d c8 03 23 cb 11 0d d5 c8 0c bd c0 55 a3 58 ca ]..#........U.X. 0ad0 1b e9 d5 0e 45 c4 0c 0e 8f 5a 35 9c b9 11 18 6a ....E....Z5....j 0ae0 b2 b3 f4 06 7b ff 6e e5 72 91 49 b3 87 06 c0 ca ....{.n.r.I..... 0af0 85 4b 00 9c 3a 4c fb 4d 07 6b 2c 6a 7d 54 54 22 .K..:L.M.k,j}TT" 0b00 56 97 0b bc 75 ac 63 8d 7e 1d ed ea 82 fa 0e 58 V...u.c.~......X 0b10 fb b9 0c 1a a2 fc fc 92 bf 31 84 58 e0 19 ca 32 .........1.X...2 0b20 71 e6 ec de cd 97 ef 42 f8 6e 61 92 46 0a 6a a3 q......B.na.F.j. 0b30 15 b0 6d c5 38 cb f0 bc 9d 7c 83 84 96 50 41 a2 ..m.8....|...PA. 0b40 3f f8 0f 7f f5 0f c0 c4 38 a5 90 e0 f0 62 13 fd ?.......8....b.. 0b50 0d a6 5b 51 9d 38 2f ec c8 10 4b 89 6e 97 77 91 ..[Q.8/...K.n.w. 0b60 36 bc 4c fc e2 5a 0e 50 22 d4 3d 2e 9e f8 39 1d 6.L..Z.P".=...9. 0b70 e7 2e 7a 9d 2d b3 0b 2b 94 70 17 71 29 7d f6 05 ..z.-..+.p.q)}.. 0b80 76 ea 36 04 c9 23 3c 89 1e 1d 3a 8d 80 b5 c0 96 v.6..#<...:..... 0b90 58 a5 de 3f cf fc 0f c3 b5 5a 22 4a 44 db c9 ca X..?.....Z"JD... 0ba0 09 87 44 29 e4 e3 94 1b a1 e1 4f 45 da f5 fc e5 ..D)......OE.... 0bb0 14 f2 2e 5e 52 b8 cd 17 47 9c af 54 5c ab a8 e3 ...^R...G..T\... 0bc0 94 69 80 5a 95 97 0a 6c 48 19 2e 47 14 a4 2f 12 .i.Z...lH..G../. 0bd0 8c 1a b3 f7 92 7d 80 0d 6f 03 16 f5 96 f4 80 0f .....}..o....... 0be0 ba 89 41 65 64 05 b3 ca 7f 9f 4e d3 f9 3b fd 51 ..Aed.....N..;.Q 0bf0 ab 20 98 c5 ac 70 23 62 9d 08 f6 a8 0f 9b 0b 88 . ...p#b........ 0c00 b2 04 5a 8f 1c 88 56 34 32 5a 0b bb a2 1c 0b 3e ..Z...V42Z.....> 0c10 77 51 fc 2c ae 54 7f 58 b2 7f 78 76 87 54 19 13 wQ.,.T.X..xv.T.. 0c20 13 62 75 98 29 7e 7a e9 72 a5 4c e2 4c f1 52 43 .bu.)~z.r.L.L.RC 0c30 7b a8 cf 47 61 3c 78 79 ab 0d 02 7b c2 79 a8 93 {..Gaf_.C..o0.... 0e20 db 7b 8e ec c4 8b 35 3c 34 d5 64 24 e3 81 c2 9b .{....5<4.d$.... 0e30 2b 39 cd bd 79 7b 02 62 da e2 a8 f2 00 7a 33 eb +9..y{.b.....z3. 0e40 04 37 d8 0a 58 e2 bc 56 ab 92 34 51 e0 63 28 87 .7..X..V..4Q.c(. 0e50 55 8d 5a f5 93 b1 da 53 59 61 2d e9 d6 5a 7d 3c U.Z....SYa-..Z}< 0e60 db 4b 1c e8 a6 cd 3e 4e 1f f0 e2 1d 72 20 37 c8 .K....>N....r 7. 0e70 cf d0 59 a0 d5 aa 35 98 cb d2 99 63 a1 5a e8 ed ..Y...5....c.Z.. 0e80 b5 e6 86 c4 d9 c9 32 1e e0 94 6a 38 a7 1e 8b 97 ......2...j8.... 0e90 c6 20 25 4a 82 ec 5f 92 e7 26 0c 9e c2 5a 80 e5 . %J.._..&...Z.. 0ea0 27 80 c3 0a 1f 78 03 d8 a0 81 a2 7d d3 36 dd 7a '....x.....}.6.z 0eb0 ff e8 2f 4d d5 4c 36 46 f3 1e 55 de 45 08 95 94 ../M.L6F..U.E... 0ec0 99 76 7a 4f fc 8b df 45 4b e0 60 d9 ad d5 4f a4 .vzO...EK.`...O. 0ed0 af d8 b7 6f 09 63 41 4e c4 23 50 21 9f 89 cb 95 ...o.cAN.#P!.... 0ee0 7e 10 6f 13 15 17 7e 79 d2 e7 96 6e 1b e9 d2 f4 ~.o...~y...n.... 0ef0 bc 75 3f 3e 6d 3d d4 fc 0e 29 2d a9 67 ae 1b a8 .u?>m=...)-.g... 0f00 8c 9b 87 cd 89 85 cd 85 28 aa 91 10 9c 09 81 57 ........(......W 0f10 af 83 b3 7f 47 24 31 67 4b 26 4c 49 af 4e d5 a3 ....G$1gK&LI.N.. 0f20 9d 47 dd ca 2f 66 5a fe 16 0e db 10 8c 63 b9 23 .G../fZ......c.# 0f30 08 2b df c9 8f d7 3d 6e d8 9d f2 df ae 42 b8 40 .+....=n.....B.@ 0f40 d8 f2 bb 3e f4 75 92 54 2d 23 36 c8 00 9f 69 12 ...>.u.T-#6...i. 0f50 65 0c 7f e1 7a 7f 08 87 81 b3 34 c0 23 2a ef 76 e...z.....4.#*.v 0f60 52 d6 09 ab 2e 5e 8a c7 1e 6b 2a 4c a2 be f1 01 R....^...k*L.... 0f70 e1 36 4b 60 13 63 d0 71 a7 bd a3 bc 5d 14 8e ec .6K`.c.q....]... 0f80 80 5c 75 d4 db f0 60 53 94 56 36 7e cc 2a d0 2d .\u...`S.V6~.*.- 0f90 96 82 16 73 51 38 2e 7b 29 63 cf bd d8 be d0 74 ...sQ8.{)c.....t 0fa0 28 a7 54 f1 ac 7a 30 9b 4e 35 2e 27 a5 b4 37 59 (.T..z0.N5.'..7Y 0fb0 6f d6 83 5c dd f9 c2 fe 15 0a 41 ca d3 2d cd bc o..\......A..-.. 0fc0 38 3b fb 25 2d 46 8d ed ac 17 d2 21 ce 3f 42 d1 8;.%-F.....!.?B. 0fd0 f4 82 63 36 61 9d 1d 12 b8 83 1b fd 93 41 63 d9 ..c6a........Ac. 0fe0 87 5a 81 c1 f3 de ba 73 91 e6 f0 b4 92 34 f8 50 .Z.....s.....4.P 0ff0 d6 67 dc ac 89 d1 b2 b3 d2 f8 d1 07 7e b1 86 78 .g..........~..x 1000 e3 8c e0 55 f9 77 1a 4e 62 7e 1f 34 9d e4 cf 65 ...U.w.Nb~.4...e 1010 e3 6e ce f6 1e 57 47 32 6e a6 e3 ce 25 f5 38 25 .n...WG2n...%.8% 1020 89 4d 00 8a 4f 07 57 3b 3a e6 27 a6 cd b1 56 e1 .M..O.W;:.'...V. 1030 d4 36 b3 d7 f8 e7 24 b7 8c 6c b4 9b da ac f9 1e .6....$..l...... 1040 d6 29 a6 a9 57 ef 7e 3e 43 89 22 2e 69 f8 a6 b9 .)..W.~>C.".i... 1050 33 81 4f dd d4 7a 91 89 1c 9e 87 c0 6c a1 1a 6b 3.O..z......l..k 1060 65 90 80 b2 c9 b2 12 c3 7f 86 57 fb f7 58 82 f6 e.........W..X.. 1070 e9 a3 81 ee 0b 74 c0 7a 75 2d cd d4 82 ea 7f ff .....t.zu-...... 1080 6c 08 a8 43 09 4a b7 52 3e 8a b3 13 8f 3e 43 94 l..C.J.R>....>C. 1090 0e 71 5a fc 49 1e cf 29 99 2a a0 5e 7a df cf 38 .qZ.I..).*.^z..8 10a0 fc 2e 4d 1f 58 a4 c8 c4 32 dd 70 b7 97 85 7e 4d ..M.X...2.p...~M 10b0 62 d9 84 d4 45 0d 42 a5 18 73 74 6f 5e 8a 4a 2a b...E.B..sto^.J* 10c0 71 30 3c 1a b4 34 51 a2 59 7b e9 2d 72 ca 3f 64 q0<..4Q.Y{.-r.?d 10d0 a2 f9 46 91 c9 b5 0f 0f 32 1a 66 a7 97 bc 2c c9 ..F.....2.f...,. 10e0 7a d7 8d 8e b1 22 c6 6f 38 60 24 ae 4e be 92 c8 z....".o8`$.N... 10f0 4e 45 71 07 0b e8 90 fb 0e da 6c df f9 42 c7 d5 NEq.......l..B.. 1100 21 17 61 fa 11 49 81 b6 5e 4e ea 85 ec ce 07 e4 !.a..I..^N...... 1110 f1 af 41 3b 01 f1 a8 55 b9 c4 43 fc bb a0 d9 ad ..A;...U..C..... 1120 a1 4e 97 8f d6 a1 de a3 91 60 58 f7 6a bb b6 1d .N.......`X.j... 1130 f6 8c 7f 80 d0 58 a4 63 8d 22 4e a7 ad 8a e5 bd .....X.c."N..... 1140 86 86 94 37 3f a9 62 d2 fd 31 a6 19 34 c0 46 fd ...7?.b..1..4.F. 1150 97 c6 9b 68 4a 10 56 a9 b7 50 91 92 86 da 50 a4 ...hJ.V..P....P. 1160 ba e1 ec 61 ab 5a 67 d3 74 dc 80 05 22 21 e3 d5 ...a.Zg.t..."!.. 1170 84 b5 d0 c4 ce e4 36 00 01 2f 8a 07 8c 8c 8c 7e ......6../.....~ 1180 c7 31 68 9f 87 bc 40 f5 7b 60 cf 84 92 fd 8a 81 .1h...@.{`...... 1190 ff a5 b3 22 cd b1 43 e2 66 6e 5a 4e bb af fb b4 ..."..C.fnZN.... 11a0 f1 b8 02 8d 0e 74 3e 28 51 f4 e4 1a 95 43 e7 67 .....t>(Q....C.g 11b0 d3 fe 0f d4 8c 65 52 39 59 dd 8e 64 0f 20 37 95 .....eR9Y..d. 7. 11c0 a7 57 e5 b3 0b fd 69 f3 e1 fd c1 61 bc c5 d5 29 .W....i....a...) 11d0 c9 6a 3c c6 55 e1 ed 43 6e 2f 91 11 8b 23 43 14 .j<.U..Cn/...#C. 11e0 c1 d2 26 77 33 3e d6 e1 c4 c8 af 0f ad 36 06 68 ..&w3>.......6.h 11f0 91 07 cb c7 c7 a7 2b ac a2 4d 63 10 92 6b e6 d2 ......+..Mc..k.. 1200 8d ce e7 a3 20 c6 c8 48 c7 ee a8 f0 6e dc e2 23 .... ..H....n..# 1210 ae 91 d1 d3 58 dc c5 fe e4 2d ee 8a 39 4d 7b bc ....X....-..9M{. 1220 b6 28 33 92 4e c9 a3 40 55 08 e1 c7 e2 6e 84 1b .(3.N..@U....n.. 1230 4a 4f db 94 ec de 3e 5c d1 b1 28 e4 f9 41 0b 49 JO....>\..(..A.I 1240 d6 51 6d f5 91 17 e3 1e 55 42 c3 ed e0 b7 f1 a7 .Qm.....UB...... 1250 5f 24 60 8c 2a a7 a5 5a 59 77 84 6b b8 31 da 27 _$`.*..ZYw.k.1.' 1260 cc c6 f7 f5 22 42 07 a7 1e 47 38 20 84 55 63 e1 ...."B...G8 .Uc. 1270 b2 aa eb b2 cc 1a 03 70 46 2c 12 f6 fa b8 bc 88 .......pF,...... 1280 b3 73 17 a7 65 49 72 ba 9c b4 4d 27 68 8d 31 53 .s..eIr...M'h.1S 1290 5f 67 5c 17 aa 0f e7 21 68 8f 2a 7a c0 a5 f0 ed _g\....!h.*z.... 12a0 b2 8a 0f cc c1 19 55 f9 0a 8a 4d c4 08 95 c0 36 ......U...M....6 12b0 6f 63 bc 53 ea e4 7a a2 b7 0c 07 ae 37 57 c4 58 oc.S..z.....7W.X 12c0 88 7a 17 3d 4d 94 fe 14 e0 38 dc f3 78 f6 61 12 .z.=M....8..x.a. 12d0 c3 10 e2 d8 ae ae 3d 98 db db 38 20 da 41 6c a0 ......=...8 .Al. 12e0 78 f6 5e ea d0 f9 62 2c d3 bf 3d 51 68 ea 56 fc x.^...b,..=Qh.V. 12f0 35 6c 5c cc 3d b2 7e d2 45 05 05 ac 17 8a 67 ec 5l\.=.~.E.....g. 1300 62 8b 5c 64 bb fd 3c fc 00 eb 32 24 2f fd 14 10 b.\d..<...2$/... 1310 67 f9 97 19 6b 19 0d 14 40 96 a1 d5 70 17 2f 68 g...k...@...p./h 1320 85 6d 82 22 82 c2 08 47 98 50 2c 69 a7 ba eb d3 .m."...G.P,i.... 1330 05 a4 40 62 fc e4 4e 50 39 de 98 bb 7f a7 9e 99 ..@b..NP9....... 1340 4f 8f c2 bd 3c 59 a5 5d 54 d8 4f 53 7b ac 8f 94 O....Q..0 1390 ac ef 09 76 d4 d6 df c5 5e aa 69 ae b9 cf c2 41 ...v....^.i....A 13a0 65 c0 88 3c a5 08 cf 94 89 f7 71 ae da 28 78 41 e..<......q..(xA 13b0 c2 31 ed 1d 09 ea 4b 22 a5 61 40 c6 a7 f5 a1 9d .1....K".a@..... 13c0 d7 0b 25 c0 64 14 eb 82 e7 cb 11 24 04 6a 0b 0e ..%.d......$.j.. 13d0 d8 5b 93 73 2a 4b e5 39 23 15 20 67 48 2b f2 64 .[.s*K.9#. gH+.d 13e0 2a 40 6e bc 6c 6f 62 e2 3b 03 1b 60 a5 11 54 1b *@n.lob.;..`..T. 13f0 f9 4f 1c bc b4 17 8b 5c 4e d4 4c 22 37 fc 16 4f .O.....\N.L"7..O 1400 bf ea 5c de 01 a8 27 89 8a fb 75 4c 08 0e dd c3 ..\...'...uL.... 1410 1b 2a 7d 42 8a 1a 9a 84 da 7f 5d 74 08 8e 12 5b .*}B......]t...[ 1420 be 71 9a 7b d4 1c 5d 88 d2 56 24 69 0e ef e7 d6 .q.{..]..V$i.... 1430 cc 11 fe d8 f8 e6 d5 b9 2c 04 80 b0 7e 43 8b fc ........,...~C.. 1440 1c 14 f6 9a 52 33 e2 a7 cd 36 ac f2 86 d2 0f 5c ....R3...6.....\ 1450 86 59 11 f8 9e 73 10 19 1f 7f 99 c8 18 00 e0 f1 .Y...s.......... 1460 b7 2c 6a 74 a4 1c 5c 03 d0 7e 5f 6c 3d f0 3a a1 .,jt..\..~_l=.:. 1470 fb 4d 1d dd b2 2b b7 79 47 51 a2 c4 4f 9f 6f 24 .M...+.yGQ..O.o$ 1480 9f 59 e6 70 db 2a ca 9b b6 52 15 42 5b 00 3c a6 .Y.p.*...R.B[.<. 1490 f7 26 37 79 35 6b 00 45 8f aa 57 c3 75 75 8a 31 .&7y5k.E..W.uu.1 14a0 34 f8 11 47 b7 85 67 2a 4b d0 49 4f 53 3a eb fe 4..G..g*K.IOS:.. 14b0 3b 5c 3c 04 b4 83 10 ab 8c 8c a8 c7 c6 9f c2 44 ;\<............D 14c0 0b 2a 52 da 9c 6e 67 7f dd d6 61 ac 9a a4 52 91 .*R..ng...a...R. 14d0 76 fc 23 86 58 b4 a1 e1 7d 3d fc d2 b5 8b c0 40 v.#.X...}=.....@ 14e0 c3 c8 1e f4 f1 e0 a7 e1 f3 dd ed 24 28 3a 51 77 ...........$(:Qw 14f0 c9 d1 77 6d dd f3 b0 53 0a 03 74 76 f3 c2 d8 bc ..wm...S..tv.... 1500 0d 9e e7 38 49 af e5 e1 7e a9 d6 dd 34 0c ac f8 ...8I...~...4... 1510 64 b4 a6 aa 19 cf 24 72 3c 06 c3 c4 12 36 a3 35 d.....$r<....6.5 1520 12 12 64 55 4a 55 69 a6 58 82 0b 9d 78 95 3d 0a ..dUJUi.X...x.=. 1530 5e 25 56 aa ca 92 6e da d5 18 1e 9a 03 20 c5 0e ^%V...n...... .. 1540 7f 5f b5 7b 72 ee 46 24 c9 ._.{r.F$. No. Time Source Destination Protocol Info 66 61.807143 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=2306 Ack=8874 Win=64240 Len=0 Frame 66 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2306, Ack: 8874, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df e0 40 00 80 06 bf e3 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 4d 9a f8 ee 15 31 50 10 .e.....hM....1P. 0030 fa f0 30 45 00 00 00 00 20 46 48 44 ..0E.... FHD No. Time Source Destination Protocol Info 67 61.807648 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=2306 Ack=11403 Win=64240 Len=0 Frame 67 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2306, Ack: 11403, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df e1 40 00 80 06 bf e2 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 4d 9a f8 ee 1f 12 50 10 .e.....hM.....P. 0030 fa f0 26 64 00 00 ac 1f 01 65 c5 d5 ..&d.....e.. No. Time Source Destination Protocol Info 68 61.813042 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 68 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2306, Ack: 11403, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF3B00B076F5077F5B5708C29E42B4C4F9... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 3B00B076F5077F5B krb5_sgn_cksum: 5708C29E42B4C4F9 krb5_confounder: 7E45C816C73E0E13 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 da df e2 40 00 80 06 bf 2f ac 1f 01 68 ac 1f ....@..../...h.. 0020 01 65 07 eb 01 85 c4 68 4d 9a f8 ee 1f 12 50 18 .e.....hM.....P. 0030 fa f0 66 70 00 00 00 00 00 ae 60 81 ab 06 09 2a ..fp......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 3b 00 b0 76 f5 07 7f 5b 57 08 c2 9e 42 b4 c4 f9 ;..v...[W...B... 0060 7e 45 c8 16 c7 3e 0e 13 3a 3d cf 76 cd 7f 1b b5 ~E...>..:=.v.... 0070 81 95 7e e4 ae 2d a9 dc 4d 6b 8f 16 74 60 5e ee ..~..-..Mk..t`^. 0080 ca 79 35 21 85 68 01 65 5a c1 9d b0 cd 10 ce b4 .y5!.h.eZ....... 0090 f5 27 4a 5d 46 fb ee 83 47 43 0d b4 0c 47 b3 d2 .'J]F...GC...G.. 00a0 2a c2 3b 88 e6 5e 6f d8 59 fd 16 e2 8a b5 69 00 *.;..^o.Y.....i. 00b0 69 f5 d2 70 52 41 5b ff 92 88 3c 69 37 7b f1 8a i..pRA[.....f. 0090 9a 80 da 74 5b 31 57 83 98 75 a9 7c c9 2f 40 05 ...t[1W..u.|./@. 00a0 32 1b bf 07 14 be 62 b6 68 54 ca 97 0f b4 c3 5c 2.....b.hT.....\ 00b0 95 f0 37 89 48 20 ab d9 ee 63 73 fb 50 cf 02 5d ..7.H ...cs.P..] 00c0 07 88 38 c6 9a d9 59 e9 ab 19 5e c4 c2 73 0d bc ..8...Y...^..s.. 00d0 5c f2 45 a9 07 31 bb 24 ba f0 1a 3c 31 b5 32 0e \.E..1.$...<1.2. 00e0 a0 44 ef 67 20 d7 cd 1e dd 8c d7 3a 63 0a 0e 1b .D.g ......:c... 00f0 93 71 28 78 f0 02 25 ed 57 85 a7 45 55 00 44 f3 .q(x..%.W..EU.D. 0100 c7 f6 18 fa 10 be bd 99 19 a2 .......... No. Time Source Destination Protocol Info 71 61.826237 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1200 bytes) Frame 71 (1305 bytes on wire, 1305 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 11612, Ack: 2696, Len: 1251 Lightweight Directory Access Protocol SASL Buffer Length: 1247 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF42164E1611D80033310532F6EC4121E1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 42164E1611D80033 krb5_sgn_cksum: 310532F6EC4121E1 krb5_confounder: AAD3172337420BE2 GSS-API Encrypted payload (1200 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 0b 2d d9 40 00 80 06 6d 08 ac 1f 01 65 ac 1f ..-.@...m....e.. 0020 01 68 01 85 07 eb f8 ee 1f e3 c4 68 4f 20 50 18 .h.........hO P. 0030 f7 19 fa 17 00 00 00 00 04 df 60 82 04 db 06 09 ..........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 42 16 4e 16 11 d8 00 33 31 05 32 f6 ec 41 21 .B.N....31.2..A! 0060 e1 aa d3 17 23 37 42 0b e2 39 88 1c 97 e8 c6 ae ....#7B..9...... 0070 4c d2 69 e7 42 44 1a a0 da 28 af 62 4e f2 fd d4 L.i.BD...(.bN... 0080 97 68 81 1b 3c 40 26 96 08 ab db c6 4d b6 24 62 .h..<@&.....M.$b 0090 34 e5 90 88 5d 9d 39 53 1b 44 59 98 2b a1 cc 94 4...].9S.DY.+... 00a0 62 f8 24 39 52 5f 1d 75 e7 e2 fb 32 d6 a4 c3 4a b.$9R_.u...2...J 00b0 5c 43 e6 ed 60 53 d2 01 34 c4 61 c4 2d d4 4f 66 \C..`S..4.a.-.Of 00c0 d5 49 a7 2d a2 fc 4c d8 b2 f7 d6 55 9f 18 2c 07 .I.-..L....U..,. 00d0 02 66 4d 06 9d a3 6e 28 fc 2e f2 06 69 0b 38 10 .fM...n(....i.8. 00e0 8a b1 4d 73 1d e8 0f 30 53 04 20 5b 88 91 d4 22 ..Ms...0S. [..." 00f0 e5 2f 28 73 c0 0c a2 65 b3 24 80 d3 c4 67 37 2e ./(s...e.$...g7. 0100 4b b3 b9 58 60 4c 05 90 d4 40 bc 99 ab ae e2 b0 K..X`L...@...... 0110 27 59 da 01 31 c8 79 7c ce 90 bd ef dc 6e d1 9d 'Y..1.y|.....n.. 0120 04 d7 6a 1d 3f d6 05 13 ba a6 41 e7 b5 9b 3f 0f ..j.?.....A...?. 0130 8e 02 f3 46 b2 24 da 80 23 d4 41 58 f5 a7 ed 73 ...F.$..#.AX...s 0140 3e 10 d5 b3 56 1f 36 39 1f 85 29 56 cf c8 cf 5d >...V.69..)V...] 0150 71 73 5e 33 21 7a 23 ae ea c7 a6 08 60 94 86 6c qs^3!z#.....`..l 0160 0c 35 68 65 7e 1f 9f e1 a1 96 3b 24 c5 7f ca 2d .5he~.....;$...- 0170 db 0d 2c b7 dd 22 36 c7 80 b8 63 96 ef 5e 71 ce ..,.."6...c..^q. 0180 45 6d 2e 97 9d c3 1a ce 44 cb 33 e3 76 44 b0 85 Em......D.3.vD.. 0190 d9 37 23 df a9 9d 01 ac 48 9b ff 5b bc c7 80 e6 .7#.....H..[.... 01a0 e0 53 ff 09 a5 01 03 7a f5 08 97 28 2e c0 f3 71 .S.....z...(...q 01b0 d5 e7 4d 8e fb 71 f5 82 80 13 bc b0 80 6b 4f 9b ..M..q.......kO. 01c0 aa b1 a0 c5 7d 81 1f 89 dd 01 25 c0 80 b0 b1 c1 ....}.....%..... 01d0 df bd 0e 14 98 31 5d 89 fb 26 93 87 f4 d1 73 e3 .....1]..&....s. 01e0 a9 a1 88 b7 9c 1d 25 2e 79 a9 02 f5 f3 04 87 9e ......%.y....... 01f0 10 72 8d cb c1 e3 57 1e d1 34 4b 9b bc 68 06 0f .r....W..4K..h.. 0200 42 4c 00 35 2d d8 a8 07 be 07 be ec b4 6d b0 be BL.5-........m.. 0210 ba 0f da fb ed 6a 11 af 0e 42 e0 9f b3 d4 af ce .....j...B...... 0220 47 e4 95 a5 78 82 fd 5f 76 c1 dd 31 47 05 d1 73 G...x.._v..1G..s 0230 7a 6c eb c1 8e bc 59 82 9f 81 9d 9c 00 20 5f 5a zl....Y...... _Z 0240 7e e1 d5 93 64 50 0d a8 e0 6a fa 9c 9d 10 3a 12 ~...dP...j....:. 0250 fd aa 6b cc ae 02 f8 89 e2 3b 66 96 62 05 3e 85 ..k......;f.b.>. 0260 ae c0 a7 80 c3 c0 78 23 31 f1 41 a7 39 d2 ae 2b ......x#1.A.9..+ 0270 b6 ff 77 5f 15 72 81 e0 3e af b0 41 20 05 4c 71 ..w_.r..>..A .Lq 0280 b2 51 a8 55 25 e3 97 6b 9a 5f 54 1f 96 1a bf 8d .Q.U%..k._T..... 0290 48 52 06 ff 01 e9 6a e7 9c 65 91 5f 56 15 02 c3 HR....j..e._V... 02a0 18 a9 8d 11 40 58 7c 3f 27 e9 cc 03 1a 4f c5 d5 ....@X|?'....O.. 02b0 fe 94 e4 19 a2 b5 48 3b 71 28 e6 da 89 e6 40 ca ......H;q(....@. 02c0 02 3b 38 9f e6 92 5e 50 bb 35 81 1e 3d 04 25 c6 .;8...^P.5..=.%. 02d0 55 a6 6f a2 46 37 1a 8e 2e 2b a5 11 4a 7a a2 0d U.o.F7...+..Jz.. 02e0 3d 6e ba 8b cc da e8 84 e3 50 66 6d 9c 69 6b 6d =n.......Pfm.ikm 02f0 ab 59 00 72 5e 1c 1b 24 1c 36 91 4a 21 fe 22 63 .Y.r^..$.6.J!."c 0300 96 1e 36 1d 42 5b 01 e5 66 0b a2 7f 2c d8 03 1e ..6.B[..f...,... 0310 4b 60 95 3d f9 6e 7f a8 8b 7c 9f b0 b6 25 ad ba K`.=.n...|...%.. 0320 21 2f 6a b3 29 21 ff ab 1a 89 ba 7e d2 43 b7 29 !/j.)!.....~.C.) 0330 9a 43 09 2f b2 f6 9b 0f 22 56 f8 c9 ae 2c de 9a .C./...."V...,.. 0340 6a 56 74 fa 85 99 65 01 e2 64 3f 30 64 95 71 c1 jVt...e..d?0d.q. 0350 47 41 c1 b6 72 50 4f ac 6f fa f6 af 1c e7 35 65 GA..rPO.o.....5e 0360 89 3d 5c 28 90 78 43 65 61 78 e1 a0 bc 58 35 fb .=\(.xCeax...X5. 0370 5a 3b 3e f2 98 41 fa 85 76 6c 70 02 6e 1b 8d b0 Z;>..A..vlp.n... 0380 33 3b 6a 72 59 83 69 aa 0a 58 17 f7 67 20 a1 8d 3;jrY.i..X..g .. 0390 60 9a b9 b8 48 cf a1 a1 46 36 2b e1 e0 da cd 80 `...H...F6+..... 03a0 90 64 eb 6b ce 47 77 07 f3 9d 64 ca 5e af cf e6 .d.k.Gw...d.^... 03b0 31 d3 84 32 2b 9a 9b 07 eb df cd 56 0c 49 52 83 1..2+......V.IR. 03c0 ea 24 c1 b4 4f 27 c4 ab 14 9d 71 9b 62 73 19 8c .$..O'....q.bs.. 03d0 cc 4a b6 cc 54 0c 94 6a 96 81 f6 ea fa 5e 82 f6 .J..T..j.....^.. 03e0 2d a3 62 f3 70 f1 a5 54 e2 c7 97 eb 7b b9 39 b8 -.b.p..T....{.9. 03f0 2c 14 47 ae f1 21 66 b6 53 71 10 97 37 06 28 65 ,.G..!f.Sq..7.(e 0400 84 9c a0 a7 dc 23 84 ac d1 36 a8 51 86 07 9f ba .....#...6.Q.... 0410 1a ce 24 b6 4f 4f e6 89 3e 33 4c 5d 69 32 63 51 ..$.OO..>3L]i2cQ 0420 1f 3e 65 69 cd 58 b1 9d b7 6e b6 03 e9 fe cb 95 .>ei.X...n...... 0430 ee b6 e2 54 50 d1 75 d6 00 78 19 15 f2 ac 9b 17 ...TP.u..x...... 0440 5e 46 6d 32 d6 8f 5d 03 be 7b 9a 70 1a f9 5b ab ^Fm2..]..{.p..[. 0450 3a ca 85 37 60 3f 5b a1 ea 32 7a 1f ed 03 dc 66 :..7`?[..2z....f 0460 50 d9 19 2b 82 0f 6d c6 cf 12 9b a1 c1 60 51 07 P..+..m......`Q. 0470 5f 0a b3 84 e2 4c c7 5a 36 b5 af 0d 0c 7c 09 59 _....L.Z6....|.Y 0480 69 a6 8a 6e d9 67 5d aa 16 97 8d df 09 4c 2f 20 i..n.g]......L/ 0490 f4 14 02 26 1f cd f6 27 e1 18 4e 5c b7 2f 23 c3 ...&...'..N\./#. 04a0 61 6e 9e 68 d3 6f 2d aa fb eb 1d 37 ef ac 1b e2 an.h.o-....7.... 04b0 72 f9 f2 de 44 c7 86 6b 57 03 d2 73 74 06 f4 fe r...D..kW..st... 04c0 57 32 a7 08 2c c5 61 b1 15 c3 62 fb ef 94 70 9e W2..,.a...b...p. 04d0 0e 32 4b ae 0b 04 bf 73 94 e2 82 c1 aa 03 93 42 .2K....s.......B 04e0 f1 1b e2 97 fe f1 02 9d b9 19 66 83 9c 97 5c a5 ..........f...\. 04f0 14 d2 53 ea 5d 68 66 6f b7 54 c9 2b 45 82 c0 ff ..S.]hfo.T.+E... 0500 35 72 e0 a4 4f d2 b4 dc d1 e4 df cd 64 25 f9 4a 5r..O.......d%.J 0510 93 5d fb 3f b6 9b 71 49 a1 .].?..qI. No. Time Source Destination Protocol Info 72 61.827544 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (124 bytes) Frame 72 (228 bytes on wire, 228 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2696, Ack: 12863, Len: 174 Lightweight Directory Access Protocol SASL Buffer Length: 170 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF0EA7787CA5C0C2A65E73BCC2E7566813... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 0EA7787CA5C0C2A6 krb5_sgn_cksum: 5E73BCC2E7566813 krb5_confounder: 2DC1C1C5329187E2 GSS-API Encrypted payload (124 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 d6 df e4 40 00 80 06 bf 31 ac 1f 01 68 ac 1f ....@....1...h.. 0020 01 65 07 eb 01 85 c4 68 4f 20 f8 ee 24 c6 50 18 .e.....hO ..$.P. 0030 fa f0 66 c2 00 00 00 00 00 aa 60 81 a7 06 09 2a ..f.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 0e a7 78 7c a5 c0 c2 a6 5e 73 bc c2 e7 56 68 13 ..x|....^s...Vh. 0060 2d c1 c1 c5 32 91 87 e2 d7 06 b7 4a 8a 86 f0 a2 -...2......J.... 0070 85 8a 62 bc 5d 7d e4 72 ed fc 5b bf b4 57 fd d5 ..b.]}.r..[..W.. 0080 d0 08 af ca f8 6b ac f6 95 96 eb 1b b5 b0 2e f3 .....k.......... 0090 60 52 74 04 1a 92 2f 6d 61 2e 73 b1 b8 e7 8e 3c `Rt.../ma.s....< 00a0 3e 4b aa 8f fc 5c 51 63 79 ed be 97 74 2a 83 8a >K...\Qcy...t*.. 00b0 1f 8c 5c a1 0f f3 dd 04 20 38 d5 fe 9b 32 c9 12 ..\..... 8...2.. 00c0 3e 23 ad 48 0d 61 a7 11 ca 49 1a f1 a7 d6 68 5a >#.H.a...I....hZ 00d0 0f c3 99 37 60 1f 59 e9 a6 30 de 32 be 06 7e cc ...7`.Y..0.2..~. 00e0 64 72 20 fa dr . No. Time Source Destination Protocol Info 73 61.828420 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (141 bytes) Frame 73 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 12863, Ack: 2870, Len: 191 Lightweight Directory Access Protocol SASL Buffer Length: 187 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF61616355F398D63D1E78DF25C2E67F1E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 61616355F398D63D krb5_sgn_cksum: 1E78DF25C2E67F1E krb5_confounder: 4C02D039FCC1E483 GSS-API Encrypted payload (141 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d da 40 00 80 06 71 2b ac 1f 01 65 ac 1f ..-.@...q+...e.. 0020 01 68 01 85 07 eb f8 ee 24 c6 c4 68 4f ce 50 18 .h......$..hO.P. 0030 f6 6b a6 ae 00 00 00 00 00 bb 60 81 b8 06 09 2a .k........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 61 61 63 55 f3 98 d6 3d 1e 78 df 25 c2 e6 7f 1e aacU...=.x.%.... 0060 4c 02 d0 39 fc c1 e4 83 33 97 c5 80 33 ab 0e 03 L..9....3...3... 0070 74 6e 21 12 e5 0b 35 09 8e b1 d1 ee de f1 da b0 tn!...5......... 0080 18 79 72 4d e5 4b 1b 7b 95 78 68 3b ad 04 e1 ca .yrM.K.{.xh;.... 0090 95 ca 93 c4 90 91 bf 6d 93 3d 90 75 fc d8 4d 63 .......m.=.u..Mc 00a0 db 9c b9 51 37 69 f9 c3 01 64 8d da 93 15 fd b1 ...Q7i...d...... 00b0 dc 88 6b d1 ed 36 b5 99 0b f5 4e 2f 37 2d 68 8d ..k..6....N/7-h. 00c0 f3 e7 e7 c7 89 fc 60 2c d3 95 3c 60 6b d2 78 fa ......`,..<`k.x. 00d0 2a 6a a6 34 4d 19 68 78 f7 7b 2f 5f 96 8d 5f 66 *j.4M.hx.{/_.._f 00e0 8c fa 49 76 34 1b 33 b2 38 1d e1 c6 98 27 73 11 ..Iv4.3.8....'s. 00f0 a5 5d f0 78 23 .].x# No. Time Source Destination Protocol Info 74 61.830349 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (158 bytes) Frame 74 (262 bytes on wire, 262 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 2870, Ack: 13054, Len: 208 Lightweight Directory Access Protocol SASL Buffer Length: 204 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF083C1D0676636190B4802B17F68F9DDB... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 083C1D0676636190 krb5_sgn_cksum: B4802B17F68F9DDB krb5_confounder: EE240980A5934B35 GSS-API Encrypted payload (158 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 f8 df e5 40 00 80 06 bf 0e ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 eb 01 85 c4 68 4f ce f8 ee 25 85 50 18 .e.....hO...%.P. 0030 fa 31 b7 79 00 00 00 00 00 cc 60 81 c9 06 09 2a .1.y......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 08 3c 1d 06 76 63 61 90 b4 80 2b 17 f6 8f 9d db .<..vca...+..... 0060 ee 24 09 80 a5 93 4b 35 c9 38 6f 4a 26 c0 41 ec .$....K5.8oJ&.A. 0070 82 13 d9 32 82 7b b1 a7 c5 71 52 c4 35 c1 f4 e6 ...2.{...qR.5... 0080 7b a9 2e 70 ae fb 4e ea 4b 12 6f 44 76 1e 12 7d {..p..N.K.oDv..} 0090 e2 35 09 f7 6c 1a 52 fb 86 50 ab 46 35 86 ac b0 .5..l.R..P.F5... 00a0 25 39 dc 9c 2b cf 14 44 5f ec 52 9f 7b b2 2b 3a %9..+..D_.R.{.+: 00b0 7d 07 42 d3 6f e3 d6 d2 7c 5d e7 46 6c 95 68 d1 }.B.o...|].Fl.h. 00c0 03 25 88 46 a8 6e 2f 6b 32 5a 94 2b 6b 28 55 28 .%.F.n/k2Z.+k(U( 00d0 71 2f 11 5b fb 0c 85 5b 0b 8d cc bb 6a 25 d5 32 q/.[...[....j%.2 00e0 f3 1c 56 0b fb 16 04 ee 94 22 e1 ad aa 32 7e c8 ..V......"...2~. 00f0 36 51 66 17 2e cd ab 16 be aa f2 c2 13 af ec ee 6Qf............. 0100 93 5b 02 d1 f1 1a .[.... No. Time Source Destination Protocol Info 75 61.831741 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 75 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 13054, Ack: 3078, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d db 40 00 80 06 6c 35 ac 1f 01 65 ac 1f ..-.@...l5...e.. 0020 01 68 01 85 07 eb f8 ee 25 85 c4 68 50 9e 50 10 .h......%..hP.P. 0030 f5 9b c5 b4 00 00 00 00 0b 19 60 82 0b 15 06 09 ..........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 13 2a 3e b9 16 e7 29 46 1e 7e b0 d3 58 b0 c7 ..*>...)F.~..X.. 0060 48 7b 2c 41 06 3a e8 6c 85 48 b9 5e ad 5e 75 94 H{,A.:.l.H.^.^u. 0070 02 2a d3 cb 09 ab fa 68 40 4b 2f 55 ca a8 82 f5 .*.....h@K/U.... 0080 b6 da dc d1 21 f4 ef ad c4 d6 a0 70 bb 4b c7 6c ....!......p.K.l 0090 4d 68 38 f2 d6 2a a4 7f 28 63 62 98 eb 7e b1 6c Mh8..*..(cb..~.l 00a0 02 fb fa c2 d3 c7 b1 b4 30 a1 76 83 6b 43 ce 92 ........0.v.kC.. 00b0 9b a0 c4 1f 7d d6 88 16 3f d5 fb b8 62 84 71 f4 ....}...?...b.q. 00c0 98 75 d3 19 52 17 a9 c6 54 ab 0c 6f 70 3c 0b dd .u..R...T..op<.. 00d0 7e a9 c2 01 6e fe 27 eb 9b d6 9b 7f 33 46 19 02 ~...n.'.....3F.. 00e0 ed 7d b3 f5 d7 08 6c aa 69 c0 14 c4 14 c0 1f 21 .}....l.i......! 00f0 0e 7c 2f 37 af 98 23 12 ed 06 f1 e3 f0 7d 1e 49 .|/7..#......}.I 0100 16 ae a0 4b 4e bb 02 cb 2c 8b 40 03 38 17 ad 2d ...KN...,.@.8..- 0110 d3 9f 20 28 ee 67 02 54 25 05 b3 41 50 70 f3 74 .. (.g.T%..APp.t 0120 e2 76 88 e5 54 c2 4a 28 5b 64 39 5d 1c be c3 71 .v..T.J([d9]...q 0130 08 04 5b 81 ed 58 f2 f1 5f 18 fc 1f b8 72 38 dd ..[..X.._....r8. 0140 b0 7e 61 9c 32 d5 cc e7 e6 e1 c6 52 9f 90 99 93 .~a.2......R.... 0150 90 60 51 60 38 90 a1 b1 0c 84 ab 48 63 1b ef 53 .`Q`8......Hc..S 0160 8d 43 ab c5 50 1e a0 a9 f5 10 3b 93 5a 83 34 70 .C..P.....;.Z.4p 0170 bf 19 ec 7e 5b db 69 81 ab 38 d5 46 40 11 2b eb ...~[.i..8.F@.+. 0180 14 10 6a de 48 05 4b 3c d3 70 32 b8 52 2f e5 10 ..j.H.K<.p2.R/.. 0190 b7 a8 c0 95 ec ec 95 1b 17 41 57 a0 82 bb 02 08 .........AW..... 01a0 f2 fb 44 fa 66 e6 71 3b d2 9a 09 54 d9 6c 56 1c ..D.f.q;...T.lV. 01b0 59 ca cb de 98 26 05 b9 ff 83 1d 1f f4 cc 27 6e Y....&........'n 01c0 b3 ca 2b 5e 50 0c b6 46 ae d4 99 70 6f 4c 9a 8a ..+^P..F...poL.. 01d0 00 03 e8 34 a6 5f 29 fb b1 62 3d f1 22 2c 72 6c ...4._)..b=.",rl 01e0 97 93 bc 00 13 71 5c d1 35 01 4f cf c2 be f1 09 .....q\.5.O..... 01f0 ef 7f a9 77 bf 10 f1 3a 72 7c 6b 4a 7a 52 24 bb ...w...:r|kJzR$. 0200 64 d1 f2 c3 32 40 91 03 4b 66 7e 8b bb 91 10 6f d...2@..Kf~....o 0210 7e 95 30 73 28 17 5d a0 02 30 0a 83 2f 8f 3d b9 ~.0s(.]..0../.=. 0220 22 c8 4a 00 4b 71 42 30 47 18 98 41 4a 35 fe 91 ".J.KqB0G..AJ5.. 0230 32 ca 63 22 06 75 e9 83 14 eb 55 85 84 97 13 74 2.c".u....U....t 0240 f2 df fc 97 de 13 43 26 a7 54 86 3f 2f 40 04 aa ......C&.T.?/@.. 0250 74 2b d1 d5 da 07 28 fb f8 9e 38 80 e0 bd 74 86 t+....(...8...t. 0260 58 4e 70 e9 ad 16 ce 35 1e 09 0f 7d 5f e5 51 9d XNp....5...}_.Q. 0270 c2 98 26 77 5a 97 6d 4f 4d b5 79 1a 4b 50 96 ab ..&wZ.mOM.y.KP.. 0280 51 b7 3a 45 63 9b ba 62 d7 9d 22 f7 58 18 09 1e Q.:Ec..b..".X... 0290 66 48 47 ac ae 9a d0 08 78 a5 62 ce 6b a5 b7 c4 fHG.....x.b.k... 02a0 42 ee d6 bd e2 a9 fe 10 7f 81 33 51 5c 44 93 c7 B.........3Q\D.. 02b0 0b 69 64 40 28 e2 44 03 36 dd 57 01 aa 3a 22 a5 .id@(.D.6.W..:". 02c0 86 35 1f e1 81 cc 28 03 a6 93 b1 4a 68 41 62 c7 .5....(....JhAb. 02d0 84 95 01 bb a9 c0 26 be f2 f2 15 7f 60 53 4f 30 ......&.....`SO0 02e0 72 40 e7 0d 69 f3 20 5f 11 66 f5 54 1b fe 5c 2a r@..i. _.f.T..\* 02f0 71 83 60 d0 28 8c 4d dd 7b 9e b7 e5 b4 95 1d 30 q.`.(.M.{......0 0300 f0 65 89 19 72 86 b3 31 b2 4b 50 a3 66 fb 5c f0 .e..r..1.KP.f.\. 0310 31 33 e1 b9 34 05 ea 77 be 4c 19 fb 56 1a 28 0c 13..4..w.L..V.(. 0320 9f 72 4d 6c 09 3a 4f 4d 58 a1 7b 36 64 49 f1 c0 .rMl.:OMX.{6dI.. 0330 ee 5e 1d 54 c7 91 75 b5 d1 39 7b 00 f7 57 fe 7c .^.T..u..9{..W.| 0340 6f 1e 0f bf 38 52 dc 48 37 3b 2e a7 89 d2 5e 48 o...8R.H7;....^H 0350 82 9f ee 22 4d 12 3f 42 27 a5 f0 ce 66 9e 82 ca ..."M.?B'...f... 0360 d8 05 c3 cd 86 92 95 eb 6d ac 79 a0 d9 2f 52 60 ........m.y../R` 0370 4e f3 e0 b6 6f fa 83 db 9b b8 68 01 86 a0 22 51 N...o.....h..."Q 0380 42 4d 36 2c f9 b1 43 99 20 b6 61 ba 86 11 51 83 BM6,..C. .a...Q. 0390 15 a9 4d 6b 26 65 d7 99 7d 14 1f d7 d9 c0 de d4 ..Mk&e..}....... 03a0 a3 22 b7 d8 3e 6a 23 06 f4 59 dc 0b aa 30 28 24 ."..>j#..Y...0($ 03b0 48 43 bb 4f e7 6f 04 72 4d 10 ca 72 6f 4a 25 5d HC.O.o.rM..roJ%] 03c0 55 37 bc 11 c7 ab d5 7f c8 9d 0a 81 d7 7f e4 83 U7.............. 03d0 b1 55 55 fa 42 3e e5 8a 42 1b 64 f8 14 10 ad 95 .UU.B>..B.d..... 03e0 15 59 cf 31 35 87 76 1f a7 0a 45 68 3f f3 ce c5 .Y.15.v...Eh?... 03f0 c5 54 f6 5a 3b bd 3d 39 a7 c9 46 ef 0e f6 3d 06 .T.Z;.=9..F...=. 0400 ec b1 57 be e2 cc 24 fc 59 5c 50 23 0f be 7b 3c ..W...$.Y\P#..{< 0410 a5 e1 a1 9a 18 8e 96 e9 79 9b d7 5a 42 60 fe 50 ........y..ZB`.P 0420 b0 1c 90 f1 0e b8 17 48 bb 4b ea fe 5a 50 37 b7 .......H.K..ZP7. 0430 94 64 97 05 a2 2b 6d 5e b3 e5 41 32 8e 33 ab fe .d...+m^..A2.3.. 0440 ed c0 16 8f 81 6b 0b 79 06 90 61 76 92 f3 d5 84 .....k.y..av.... 0450 8a c6 2b 33 6d e3 3a b4 96 b8 6f f2 03 68 03 1d ..+3m.:...o..h.. 0460 f0 4f d1 1a a6 f7 0a 4c f9 19 33 80 d2 c8 33 37 .O.....L..3...37 0470 9a d3 87 5c 27 4f 89 54 f3 cc d7 71 f8 20 50 79 ...\'O.T...q. Py 0480 2e 3b e1 52 91 42 b8 ea d4 f5 a5 eb 09 31 ea 57 .;.R.B.......1.W 0490 5d 2d 0b ef 93 ab 5a 93 b1 7a d5 df 50 fe bc 40 ]-....Z..z..P..@ 04a0 1b 55 cd 85 c8 59 a6 d0 c5 0e cf 8f 27 d4 1f aa .U...Y......'... 04b0 cc 33 9c 05 85 2b 09 74 f9 7c b8 45 ca 6a 1a 0c .3...+.t.|.E.j.. 04c0 77 2a 6e 1a 53 27 dd 2b b3 1b 63 09 55 dd 5e 48 w*n.S'.+..c.U.^H 04d0 e1 aa f4 43 62 20 72 60 b1 63 19 e5 4e 09 ae a1 ...Cb r`.c..N... 04e0 8b 72 9b c0 d1 d1 7b 29 8d 88 88 26 c5 53 83 62 .r....{)...&.S.b 04f0 65 97 73 6a ff 09 b5 41 fd 3b f4 26 c6 5c f6 2c e.sj...A.;.&.\., 0500 e7 ea ba 1d ea 6e 82 15 d3 3b d7 9a 2f c9 55 8f .....n...;../.U. 0510 e7 ca 5c 7c 5e 74 8b 62 d7 d7 8c a5 7e b7 bb ac ..\|^t.b....~... 0520 be 18 67 d9 51 a7 71 56 bc 8f df 5f 30 ee 3c 1b ..g.Q.qV..._0.<. 0530 eb d3 34 ab d1 a7 95 fb d3 88 ae 71 55 95 8a c6 ..4........qU... 0540 d1 ab cf fc 55 98 08 85 e3 7a af 39 42 3a 16 98 ....U....z.9B:.. 0550 ff b0 7e 0b 61 57 43 a4 45 39 3e 6f f5 9b 9c 7b ..~.aWC.E9>o...{ 0560 44 1e 55 f1 f0 07 c7 00 8d 82 ee f3 55 05 e8 f5 D.U.........U... 0570 9d ef 84 18 33 54 32 04 dd 7b 00 df 84 b5 4f b3 ....3T2..{....O. 0580 bb c2 eb f1 b5 31 98 b2 91 91 7a 2b e6 50 30 c6 .....1....z+.P0. 0590 79 7c 80 7b 36 54 b5 bf ff e3 8c 44 ea d8 96 89 y|.{6T.....D.... 05a0 02 7a 43 23 0d b4 66 18 e6 6b 94 09 10 8b 12 e2 .zC#..f..k...... 05b0 8a d2 e7 ef 48 72 7c c0 4a 6b 97 ac 65 9d a1 3f ....Hr|.Jk..e..? 05c0 a4 6c 2c 2c e0 e8 c2 a2 ad 8e 74 76 df 88 5d d7 .l,,......tv..]. 05d0 6a 83 d5 ac 99 40 65 4e f1 06 ba a4 3b 36 0b ac j....@eN....;6.. 05e0 c9 b4 8e e5 6f 63 76 7a e9 1a ....ocvz.. No. Time Source Destination Protocol Info 76 61.831854 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2794 bytes) Frame 76 (1439 bytes on wire, 1439 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 14514, Ack: 3078, Len: 1385 Lightweight Directory Access Protocol SASL Buffer Length: 2841 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF132A3EB916E729461E7EB0D358B0C748... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 132A3EB916E72946 krb5_sgn_cksum: 1E7EB0D358B0C748 krb5_confounder: 7B2C41063AE86C85 GSS-API Encrypted payload (2794 bytes) Frame (1439 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 91 2d dc 40 00 80 06 6c 7f ac 1f 01 65 ac 1f ..-.@...l....e.. 0020 01 68 01 85 07 eb f8 ee 2b 39 c4 68 50 9e 50 18 .h......+9.hP.P. 0030 f5 9b 47 12 00 00 b1 7f 7a f5 5d 62 6b 91 63 97 ..G.....z.]bk.c. 0040 5a c3 2d 49 a6 26 a9 b8 69 59 90 ec bf 80 70 35 Z.-I.&..iY....p5 0050 3b 08 12 7f 2c 63 16 a3 26 e6 fb fc 9c 47 92 be ;...,c..&....G.. 0060 5e 4c 31 92 96 23 de 91 62 4c 79 12 7a cb bf b6 ^L1..#..bLy.z... 0070 d5 65 9f e8 e4 be e7 3b dc 2e 8c e8 b2 a9 1f 2d .e.....;.......- 0080 19 78 18 7a 32 03 fb 4e b6 43 f2 da fc ad 50 2c .x.z2..N.C....P, 0090 1b b2 cf 2b a0 ac cc 60 89 6a 33 ff 56 7b 25 d1 ...+...`.j3.V{%. 00a0 cb 8e 81 da cc 3f fb 9f 03 01 27 8c 06 ce a0 d2 .....?....'..... 00b0 8f 23 af 00 7d 66 66 37 d5 34 8f 34 c7 39 cc dd .#..}ff7.4.4.9.. 00c0 0f b7 36 2b 2f e3 a2 c2 da 93 db d7 5d c8 17 bb ..6+/.......]... 00d0 fa f4 55 76 ab cd 8d a9 9d f8 75 f6 ae 8b 4e ad ..Uv......u...N. 00e0 da 3a fe 99 50 50 d7 f7 fa 94 23 47 9e 03 1c dd .:..PP....#G.... 00f0 6e 20 fc 00 37 b5 52 ac b3 28 37 08 5f 33 e2 01 n ..7.R..(7._3.. 0100 91 65 d3 6d 47 4a a5 c8 3a d7 60 4e d8 8b 5a 17 .e.mGJ..:.`N..Z. 0110 fe e1 98 6f fc ec cc 99 f0 f6 56 ef e5 1e 4f 9e ...o......V...O. 0120 bd 98 b6 99 50 85 a4 14 24 4f ae c6 d9 9f 03 aa ....P...$O...... 0130 ad 66 3e 44 ec 28 a4 4a 55 49 cb c4 47 06 6e a1 .f>D.(.JUI..G.n. 0140 7e 99 ae 0b 4a 89 90 7b 8f a2 1c b7 06 92 c2 35 ~...J..{.......5 0150 b9 17 70 43 f2 65 89 59 1d 3e 61 55 48 40 c5 ea ..pC.e.Y.>aUH@.. 0160 bc b6 81 de 3e 8d f2 76 a3 74 dd 60 08 e1 58 f1 ....>..v.t.`..X. 0170 04 a3 75 89 cf b5 a9 a4 1f 15 6d 18 c6 2b 68 35 ..u.......m..+h5 0180 1c 81 45 7d 83 5a de 2d 35 af da 34 7e 9f b3 c3 ..E}.Z.-5..4~... 0190 32 af f5 a2 f3 39 7b b1 b8 43 46 ce af ca d2 55 2....9{..CF....U 01a0 6d b2 0f 46 56 02 98 cd 87 23 59 55 99 f3 64 74 m..FV....#YU..dt 01b0 50 4d 3f 91 6f 51 10 b7 19 ad d0 12 27 94 fa f1 PM?.oQ......'... 01c0 31 b4 d9 3d a0 9b 36 45 ef 79 a0 87 e3 93 41 7c 1..=..6E.y....A| 01d0 eb 66 f1 af 59 50 a0 fe 9e 1d ad f4 b7 d3 00 26 .f..YP.........& 01e0 10 ff 68 85 6f 94 f5 8d 12 44 33 ff cf 13 77 46 ..h.o....D3...wF 01f0 9b e3 e7 6f 6c ff 68 93 26 23 08 36 2f 23 dd 54 ...ol.h.&#.6/#.T 0200 e2 d9 c1 5e b1 e9 02 67 81 6b 23 39 35 06 0c ff ...^...g.k#95... 0210 0d b9 1a f5 a5 a3 36 95 4d 9e 83 ef f8 d1 a1 08 ......6.M....... 0220 7c 8f 3c 56 e1 7d 86 25 ea 5e 2c f6 cd fd 45 6e |....oq.n..^5.. 0370 71 44 7c 98 4b b8 36 0a 24 6c 79 7e e3 46 e1 35 qD|.K.6.$ly~.F.5 0380 e8 b5 5a c1 9d e6 65 01 78 bd aa 82 e3 96 21 9e ..Z...e.x.....!. 0390 6c d6 01 80 d4 e8 d2 27 d9 83 f2 d7 35 39 a6 10 l......'....59.. 03a0 99 22 cc bd 11 05 39 da d7 bd 56 ee c3 68 0f fd ."....9...V..h.. 03b0 fe cb 08 b4 ef cd 75 8f 05 97 29 c4 5a 5c 5f 40 ......u...).Z\_@ 03c0 61 65 31 aa 77 62 c2 97 a0 94 17 1b be 2c 2e 55 ae1.wb.......,.U 03d0 5a a6 7b f8 ea de e9 98 5e c9 2d ad 19 03 a0 79 Z.{.....^.-....y 03e0 03 dd fb f2 aa 22 51 52 b0 a2 25 8b cc 18 00 d2 ....."QR..%..... 03f0 cf 13 c6 e0 4b 7e 6b ec 9b b5 a5 37 5c 33 a9 bd ....K~k....7\3.. 0400 c1 d1 73 a1 45 e5 26 d0 6e e3 2f db 8d 40 22 8d ..s.E.&.n./..@". 0410 bb d7 4b 4b e5 bb 9c 13 4d 5a 39 8d 21 1e 6b 6f ..KK....MZ9.!.ko 0420 7e 92 7d 68 3e bc b3 41 91 0f 49 7f 40 5f cf ba ~.}h>..A..I.@_.. 0430 59 60 8f 20 18 a1 44 d3 d9 55 f8 44 d6 c2 89 28 Y`. ..D..U.D...( 0440 f0 bf bb 63 7e 0e e1 a2 12 f4 90 2b a7 3f a0 5d ...c~......+.?.] 0450 e7 da e3 e6 2f 95 3d e1 94 b8 f7 3d 2a 46 47 54 ..../.=....=*FGT 0460 a2 ec 43 13 9d 6a bc 5d 31 0c 0d cf 18 17 8b 12 ..C..j.]1....... 0470 08 ea e5 d5 36 25 eb 46 bc be b0 2f 8d 2e ab 3b ....6%.F.../...; 0480 c1 ee 25 a1 a4 b2 72 12 6b 18 3b 54 88 83 9b 25 ..%...r.k.;T...% 0490 33 29 f2 b1 9e 97 e4 9d 82 4d 21 20 50 59 a4 fb 3).......M! PY.. 04a0 a8 83 ad 47 6e d6 16 05 d1 af e7 5d df 24 25 43 ...Gn......].$%C 04b0 14 e2 d9 99 cd e8 7d 8d a1 5f be 1e f4 d5 cf 6c ......}.._.....l 04c0 6a 87 b8 81 a4 b8 73 72 54 54 c0 58 11 9b d8 43 j.....srTT.X...C 04d0 10 77 e0 fa 8e 82 b7 db db c8 6c ef ab b9 56 74 .w........l...Vt 04e0 70 02 e4 1f e2 f5 77 e8 b9 8b 6f 6c 92 39 c9 40 p.....w...ol.9.@ 04f0 b6 73 e1 27 e7 ea c7 a5 42 72 fe 49 59 8b 96 46 .s.'....Br.IY..F 0500 8a 7b bd ad 0a ce f9 b0 92 7b 5a fd da 5f 21 1b .{.......{Z.._!. 0510 55 e0 cb cc d9 16 00 47 3a 57 7e 75 1e df 48 17 U......G:W~u..H. 0520 7e b8 59 ac 2e f5 fa e7 4c 63 04 85 0b 6f 2a ff ~.Y.....Lc...o*. 0530 eb fb d2 64 22 66 2d b5 bc 0f 9b 6f 2a 7d 3a 0d ...d"f-....o*}:. 0540 01 2b 32 23 6f b1 07 d6 22 26 69 5f ea b3 a5 12 .+2#o..."&i_.... 0550 30 4f 68 91 53 02 b1 c6 9a 42 8b 2d 10 da ed 13 0Oh.S....B.-.... 0560 f1 af 4f 7a 50 7c f3 de f1 b7 01 ce d5 a4 83 a7 ..OzP|.......... 0570 27 14 15 7f 5d e6 1b c5 94 c5 cf f7 35 26 5c f7 '...].......5&\. 0580 7f d5 f1 a2 06 32 ff ad 8c 40 08 f5 15 83 23 c0 .....2...@....#. 0590 7a e6 19 51 a0 26 d1 0d 81 b3 6a 57 d6 fc 43 z..Q.&....jW..C Reassembled TCP (2845 bytes): 0000 00 00 0b 19 60 82 0b 15 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 13 2a 3e b9 16 ............*>.. 0020 e7 29 46 1e 7e b0 d3 58 b0 c7 48 7b 2c 41 06 3a .)F.~..X..H{,A.: 0030 e8 6c 85 48 b9 5e ad 5e 75 94 02 2a d3 cb 09 ab .l.H.^.^u..*.... 0040 fa 68 40 4b 2f 55 ca a8 82 f5 b6 da dc d1 21 f4 .h@K/U........!. 0050 ef ad c4 d6 a0 70 bb 4b c7 6c 4d 68 38 f2 d6 2a .....p.K.lMh8..* 0060 a4 7f 28 63 62 98 eb 7e b1 6c 02 fb fa c2 d3 c7 ..(cb..~.l...... 0070 b1 b4 30 a1 76 83 6b 43 ce 92 9b a0 c4 1f 7d d6 ..0.v.kC......}. 0080 88 16 3f d5 fb b8 62 84 71 f4 98 75 d3 19 52 17 ..?...b.q..u..R. 0090 a9 c6 54 ab 0c 6f 70 3c 0b dd 7e a9 c2 01 6e fe ..T..op<..~...n. 00a0 27 eb 9b d6 9b 7f 33 46 19 02 ed 7d b3 f5 d7 08 '.....3F...}.... 00b0 6c aa 69 c0 14 c4 14 c0 1f 21 0e 7c 2f 37 af 98 l.i......!.|/7.. 00c0 23 12 ed 06 f1 e3 f0 7d 1e 49 16 ae a0 4b 4e bb #......}.I...KN. 00d0 02 cb 2c 8b 40 03 38 17 ad 2d d3 9f 20 28 ee 67 ..,.@.8..-.. (.g 00e0 02 54 25 05 b3 41 50 70 f3 74 e2 76 88 e5 54 c2 .T%..APp.t.v..T. 00f0 4a 28 5b 64 39 5d 1c be c3 71 08 04 5b 81 ed 58 J([d9]...q..[..X 0100 f2 f1 5f 18 fc 1f b8 72 38 dd b0 7e 61 9c 32 d5 .._....r8..~a.2. 0110 cc e7 e6 e1 c6 52 9f 90 99 93 90 60 51 60 38 90 .....R.....`Q`8. 0120 a1 b1 0c 84 ab 48 63 1b ef 53 8d 43 ab c5 50 1e .....Hc..S.C..P. 0130 a0 a9 f5 10 3b 93 5a 83 34 70 bf 19 ec 7e 5b db ....;.Z.4p...~[. 0140 69 81 ab 38 d5 46 40 11 2b eb 14 10 6a de 48 05 i..8.F@.+...j.H. 0150 4b 3c d3 70 32 b8 52 2f e5 10 b7 a8 c0 95 ec ec K<.p2.R/........ 0160 95 1b 17 41 57 a0 82 bb 02 08 f2 fb 44 fa 66 e6 ...AW.......D.f. 0170 71 3b d2 9a 09 54 d9 6c 56 1c 59 ca cb de 98 26 q;...T.lV.Y....& 0180 05 b9 ff 83 1d 1f f4 cc 27 6e b3 ca 2b 5e 50 0c ........'n..+^P. 0190 b6 46 ae d4 99 70 6f 4c 9a 8a 00 03 e8 34 a6 5f .F...poL.....4._ 01a0 29 fb b1 62 3d f1 22 2c 72 6c 97 93 bc 00 13 71 )..b=.",rl.....q 01b0 5c d1 35 01 4f cf c2 be f1 09 ef 7f a9 77 bf 10 \.5.O........w.. 01c0 f1 3a 72 7c 6b 4a 7a 52 24 bb 64 d1 f2 c3 32 40 .:r|kJzR$.d...2@ 01d0 91 03 4b 66 7e 8b bb 91 10 6f 7e 95 30 73 28 17 ..Kf~....o~.0s(. 01e0 5d a0 02 30 0a 83 2f 8f 3d b9 22 c8 4a 00 4b 71 ]..0../.=.".J.Kq 01f0 42 30 47 18 98 41 4a 35 fe 91 32 ca 63 22 06 75 B0G..AJ5..2.c".u 0200 e9 83 14 eb 55 85 84 97 13 74 f2 df fc 97 de 13 ....U....t...... 0210 43 26 a7 54 86 3f 2f 40 04 aa 74 2b d1 d5 da 07 C&.T.?/@..t+.... 0220 28 fb f8 9e 38 80 e0 bd 74 86 58 4e 70 e9 ad 16 (...8...t.XNp... 0230 ce 35 1e 09 0f 7d 5f e5 51 9d c2 98 26 77 5a 97 .5...}_.Q...&wZ. 0240 6d 4f 4d b5 79 1a 4b 50 96 ab 51 b7 3a 45 63 9b mOM.y.KP..Q.:Ec. 0250 ba 62 d7 9d 22 f7 58 18 09 1e 66 48 47 ac ae 9a .b..".X...fHG... 0260 d0 08 78 a5 62 ce 6b a5 b7 c4 42 ee d6 bd e2 a9 ..x.b.k...B..... 0270 fe 10 7f 81 33 51 5c 44 93 c7 0b 69 64 40 28 e2 ....3Q\D...id@(. 0280 44 03 36 dd 57 01 aa 3a 22 a5 86 35 1f e1 81 cc D.6.W..:"..5.... 0290 28 03 a6 93 b1 4a 68 41 62 c7 84 95 01 bb a9 c0 (....JhAb....... 02a0 26 be f2 f2 15 7f 60 53 4f 30 72 40 e7 0d 69 f3 &.....`SO0r@..i. 02b0 20 5f 11 66 f5 54 1b fe 5c 2a 71 83 60 d0 28 8c _.f.T..\*q.`.(. 02c0 4d dd 7b 9e b7 e5 b4 95 1d 30 f0 65 89 19 72 86 M.{......0.e..r. 02d0 b3 31 b2 4b 50 a3 66 fb 5c f0 31 33 e1 b9 34 05 .1.KP.f.\.13..4. 02e0 ea 77 be 4c 19 fb 56 1a 28 0c 9f 72 4d 6c 09 3a .w.L..V.(..rMl.: 02f0 4f 4d 58 a1 7b 36 64 49 f1 c0 ee 5e 1d 54 c7 91 OMX.{6dI...^.T.. 0300 75 b5 d1 39 7b 00 f7 57 fe 7c 6f 1e 0f bf 38 52 u..9{..W.|o...8R 0310 dc 48 37 3b 2e a7 89 d2 5e 48 82 9f ee 22 4d 12 .H7;....^H..."M. 0320 3f 42 27 a5 f0 ce 66 9e 82 ca d8 05 c3 cd 86 92 ?B'...f......... 0330 95 eb 6d ac 79 a0 d9 2f 52 60 4e f3 e0 b6 6f fa ..m.y../R`N...o. 0340 83 db 9b b8 68 01 86 a0 22 51 42 4d 36 2c f9 b1 ....h..."QBM6,.. 0350 43 99 20 b6 61 ba 86 11 51 83 15 a9 4d 6b 26 65 C. .a...Q...Mk&e 0360 d7 99 7d 14 1f d7 d9 c0 de d4 a3 22 b7 d8 3e 6a ..}........"..>j 0370 23 06 f4 59 dc 0b aa 30 28 24 48 43 bb 4f e7 6f #..Y...0($HC.O.o 0380 04 72 4d 10 ca 72 6f 4a 25 5d 55 37 bc 11 c7 ab .rM..roJ%]U7.... 0390 d5 7f c8 9d 0a 81 d7 7f e4 83 b1 55 55 fa 42 3e ...........UU.B> 03a0 e5 8a 42 1b 64 f8 14 10 ad 95 15 59 cf 31 35 87 ..B.d......Y.15. 03b0 76 1f a7 0a 45 68 3f f3 ce c5 c5 54 f6 5a 3b bd v...Eh?....T.Z;. 03c0 3d 39 a7 c9 46 ef 0e f6 3d 06 ec b1 57 be e2 cc =9..F...=...W... 03d0 24 fc 59 5c 50 23 0f be 7b 3c a5 e1 a1 9a 18 8e $.Y\P#..{<...... 03e0 96 e9 79 9b d7 5a 42 60 fe 50 b0 1c 90 f1 0e b8 ..y..ZB`.P...... 03f0 17 48 bb 4b ea fe 5a 50 37 b7 94 64 97 05 a2 2b .H.K..ZP7..d...+ 0400 6d 5e b3 e5 41 32 8e 33 ab fe ed c0 16 8f 81 6b m^..A2.3.......k 0410 0b 79 06 90 61 76 92 f3 d5 84 8a c6 2b 33 6d e3 .y..av......+3m. 0420 3a b4 96 b8 6f f2 03 68 03 1d f0 4f d1 1a a6 f7 :...o..h...O.... 0430 0a 4c f9 19 33 80 d2 c8 33 37 9a d3 87 5c 27 4f .L..3...37...\'O 0440 89 54 f3 cc d7 71 f8 20 50 79 2e 3b e1 52 91 42 .T...q. Py.;.R.B 0450 b8 ea d4 f5 a5 eb 09 31 ea 57 5d 2d 0b ef 93 ab .......1.W]-.... 0460 5a 93 b1 7a d5 df 50 fe bc 40 1b 55 cd 85 c8 59 Z..z..P..@.U...Y 0470 a6 d0 c5 0e cf 8f 27 d4 1f aa cc 33 9c 05 85 2b ......'....3...+ 0480 09 74 f9 7c b8 45 ca 6a 1a 0c 77 2a 6e 1a 53 27 .t.|.E.j..w*n.S' 0490 dd 2b b3 1b 63 09 55 dd 5e 48 e1 aa f4 43 62 20 .+..c.U.^H...Cb 04a0 72 60 b1 63 19 e5 4e 09 ae a1 8b 72 9b c0 d1 d1 r`.c..N....r.... 04b0 7b 29 8d 88 88 26 c5 53 83 62 65 97 73 6a ff 09 {)...&.S.be.sj.. 04c0 b5 41 fd 3b f4 26 c6 5c f6 2c e7 ea ba 1d ea 6e .A.;.&.\.,.....n 04d0 82 15 d3 3b d7 9a 2f c9 55 8f e7 ca 5c 7c 5e 74 ...;../.U...\|^t 04e0 8b 62 d7 d7 8c a5 7e b7 bb ac be 18 67 d9 51 a7 .b....~.....g.Q. 04f0 71 56 bc 8f df 5f 30 ee 3c 1b eb d3 34 ab d1 a7 qV..._0.<...4... 0500 95 fb d3 88 ae 71 55 95 8a c6 d1 ab cf fc 55 98 .....qU.......U. 0510 08 85 e3 7a af 39 42 3a 16 98 ff b0 7e 0b 61 57 ...z.9B:....~.aW 0520 43 a4 45 39 3e 6f f5 9b 9c 7b 44 1e 55 f1 f0 07 C.E9>o...{D.U... 0530 c7 00 8d 82 ee f3 55 05 e8 f5 9d ef 84 18 33 54 ......U.......3T 0540 32 04 dd 7b 00 df 84 b5 4f b3 bb c2 eb f1 b5 31 2..{....O......1 0550 98 b2 91 91 7a 2b e6 50 30 c6 79 7c 80 7b 36 54 ....z+.P0.y|.{6T 0560 b5 bf ff e3 8c 44 ea d8 96 89 02 7a 43 23 0d b4 .....D.....zC#.. 0570 66 18 e6 6b 94 09 10 8b 12 e2 8a d2 e7 ef 48 72 f..k..........Hr 0580 7c c0 4a 6b 97 ac 65 9d a1 3f a4 6c 2c 2c e0 e8 |.Jk..e..?.l,,.. 0590 c2 a2 ad 8e 74 76 df 88 5d d7 6a 83 d5 ac 99 40 ....tv..].j....@ 05a0 65 4e f1 06 ba a4 3b 36 0b ac c9 b4 8e e5 6f 63 eN....;6......oc 05b0 76 7a e9 1a b1 7f 7a f5 5d 62 6b 91 63 97 5a c3 vz....z.]bk.c.Z. 05c0 2d 49 a6 26 a9 b8 69 59 90 ec bf 80 70 35 3b 08 -I.&..iY....p5;. 05d0 12 7f 2c 63 16 a3 26 e6 fb fc 9c 47 92 be 5e 4c ..,c..&....G..^L 05e0 31 92 96 23 de 91 62 4c 79 12 7a cb bf b6 d5 65 1..#..bLy.z....e 05f0 9f e8 e4 be e7 3b dc 2e 8c e8 b2 a9 1f 2d 19 78 .....;.......-.x 0600 18 7a 32 03 fb 4e b6 43 f2 da fc ad 50 2c 1b b2 .z2..N.C....P,.. 0610 cf 2b a0 ac cc 60 89 6a 33 ff 56 7b 25 d1 cb 8e .+...`.j3.V{%... 0620 81 da cc 3f fb 9f 03 01 27 8c 06 ce a0 d2 8f 23 ...?....'......# 0630 af 00 7d 66 66 37 d5 34 8f 34 c7 39 cc dd 0f b7 ..}ff7.4.4.9.... 0640 36 2b 2f e3 a2 c2 da 93 db d7 5d c8 17 bb fa f4 6+/.......]..... 0650 55 76 ab cd 8d a9 9d f8 75 f6 ae 8b 4e ad da 3a Uv......u...N..: 0660 fe 99 50 50 d7 f7 fa 94 23 47 9e 03 1c dd 6e 20 ..PP....#G....n 0670 fc 00 37 b5 52 ac b3 28 37 08 5f 33 e2 01 91 65 ..7.R..(7._3...e 0680 d3 6d 47 4a a5 c8 3a d7 60 4e d8 8b 5a 17 fe e1 .mGJ..:.`N..Z... 0690 98 6f fc ec cc 99 f0 f6 56 ef e5 1e 4f 9e bd 98 .o......V...O... 06a0 b6 99 50 85 a4 14 24 4f ae c6 d9 9f 03 aa ad 66 ..P...$O.......f 06b0 3e 44 ec 28 a4 4a 55 49 cb c4 47 06 6e a1 7e 99 >D.(.JUI..G.n.~. 06c0 ae 0b 4a 89 90 7b 8f a2 1c b7 06 92 c2 35 b9 17 ..J..{.......5.. 06d0 70 43 f2 65 89 59 1d 3e 61 55 48 40 c5 ea bc b6 pC.e.Y.>aUH@.... 06e0 81 de 3e 8d f2 76 a3 74 dd 60 08 e1 58 f1 04 a3 ..>..v.t.`..X... 06f0 75 89 cf b5 a9 a4 1f 15 6d 18 c6 2b 68 35 1c 81 u.......m..+h5.. 0700 45 7d 83 5a de 2d 35 af da 34 7e 9f b3 c3 32 af E}.Z.-5..4~...2. 0710 f5 a2 f3 39 7b b1 b8 43 46 ce af ca d2 55 6d b2 ...9{..CF....Um. 0720 0f 46 56 02 98 cd 87 23 59 55 99 f3 64 74 50 4d .FV....#YU..dtPM 0730 3f 91 6f 51 10 b7 19 ad d0 12 27 94 fa f1 31 b4 ?.oQ......'...1. 0740 d9 3d a0 9b 36 45 ef 79 a0 87 e3 93 41 7c eb 66 .=..6E.y....A|.f 0750 f1 af 59 50 a0 fe 9e 1d ad f4 b7 d3 00 26 10 ff ..YP.........&.. 0760 68 85 6f 94 f5 8d 12 44 33 ff cf 13 77 46 9b e3 h.o....D3...wF.. 0770 e7 6f 6c ff 68 93 26 23 08 36 2f 23 dd 54 e2 d9 .ol.h.&#.6/#.T.. 0780 c1 5e b1 e9 02 67 81 6b 23 39 35 06 0c ff 0d b9 .^...g.k#95..... 0790 1a f5 a5 a3 36 95 4d 9e 83 ef f8 d1 a1 08 7c 8f ....6.M.......|. 07a0 3c 56 e1 7d 86 25 ea 5e 2c f6 cd fd 45 6e a5 3f ...oq.n..^5..qD 08f0 7c 98 4b b8 36 0a 24 6c 79 7e e3 46 e1 35 e8 b5 |.K.6.$ly~.F.5.. 0900 5a c1 9d e6 65 01 78 bd aa 82 e3 96 21 9e 6c d6 Z...e.x.....!.l. 0910 01 80 d4 e8 d2 27 d9 83 f2 d7 35 39 a6 10 99 22 .....'....59..." 0920 cc bd 11 05 39 da d7 bd 56 ee c3 68 0f fd fe cb ....9...V..h.... 0930 08 b4 ef cd 75 8f 05 97 29 c4 5a 5c 5f 40 61 65 ....u...).Z\_@ae 0940 31 aa 77 62 c2 97 a0 94 17 1b be 2c 2e 55 5a a6 1.wb.......,.UZ. 0950 7b f8 ea de e9 98 5e c9 2d ad 19 03 a0 79 03 dd {.....^.-....y.. 0960 fb f2 aa 22 51 52 b0 a2 25 8b cc 18 00 d2 cf 13 ..."QR..%....... 0970 c6 e0 4b 7e 6b ec 9b b5 a5 37 5c 33 a9 bd c1 d1 ..K~k....7\3.... 0980 73 a1 45 e5 26 d0 6e e3 2f db 8d 40 22 8d bb d7 s.E.&.n./..@"... 0990 4b 4b e5 bb 9c 13 4d 5a 39 8d 21 1e 6b 6f 7e 92 KK....MZ9.!.ko~. 09a0 7d 68 3e bc b3 41 91 0f 49 7f 40 5f cf ba 59 60 }h>..A..I.@_..Y` 09b0 8f 20 18 a1 44 d3 d9 55 f8 44 d6 c2 89 28 f0 bf . ..D..U.D...(.. 09c0 bb 63 7e 0e e1 a2 12 f4 90 2b a7 3f a0 5d e7 da .c~......+.?.].. 09d0 e3 e6 2f 95 3d e1 94 b8 f7 3d 2a 46 47 54 a2 ec ../.=....=*FGT.. 09e0 43 13 9d 6a bc 5d 31 0c 0d cf 18 17 8b 12 08 ea C..j.]1......... 09f0 e5 d5 36 25 eb 46 bc be b0 2f 8d 2e ab 3b c1 ee ..6%.F.../...;.. 0a00 25 a1 a4 b2 72 12 6b 18 3b 54 88 83 9b 25 33 29 %...r.k.;T...%3) 0a10 f2 b1 9e 97 e4 9d 82 4d 21 20 50 59 a4 fb a8 83 .......M! PY.... 0a20 ad 47 6e d6 16 05 d1 af e7 5d df 24 25 43 14 e2 .Gn......].$%C.. 0a30 d9 99 cd e8 7d 8d a1 5f be 1e f4 d5 cf 6c 6a 87 ....}.._.....lj. 0a40 b8 81 a4 b8 73 72 54 54 c0 58 11 9b d8 43 10 77 ....srTT.X...C.w 0a50 e0 fa 8e 82 b7 db db c8 6c ef ab b9 56 74 70 02 ........l...Vtp. 0a60 e4 1f e2 f5 77 e8 b9 8b 6f 6c 92 39 c9 40 b6 73 ....w...ol.9.@.s 0a70 e1 27 e7 ea c7 a5 42 72 fe 49 59 8b 96 46 8a 7b .'....Br.IY..F.{ 0a80 bd ad 0a ce f9 b0 92 7b 5a fd da 5f 21 1b 55 e0 .......{Z.._!.U. 0a90 cb cc d9 16 00 47 3a 57 7e 75 1e df 48 17 7e b8 .....G:W~u..H.~. 0aa0 59 ac 2e f5 fa e7 4c 63 04 85 0b 6f 2a ff eb fb Y.....Lc...o*... 0ab0 d2 64 22 66 2d b5 bc 0f 9b 6f 2a 7d 3a 0d 01 2b .d"f-....o*}:..+ 0ac0 32 23 6f b1 07 d6 22 26 69 5f ea b3 a5 12 30 4f 2#o..."&i_....0O 0ad0 68 91 53 02 b1 c6 9a 42 8b 2d 10 da ed 13 f1 af h.S....B.-...... 0ae0 4f 7a 50 7c f3 de f1 b7 01 ce d5 a4 83 a7 27 14 OzP|..........'. 0af0 15 7f 5d e6 1b c5 94 c5 cf f7 35 26 5c f7 7f d5 ..].......5&\... 0b00 f1 a2 06 32 ff ad 8c 40 08 f5 15 83 23 c0 7a e6 ...2...@....#.z. 0b10 19 51 a0 26 d1 0d 81 b3 6a 57 d6 fc 43 .Q.&....jW..C No. Time Source Destination Protocol Info 77 61.832140 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=3078 Ack=15899 Win=64240 Len=0 Frame 77 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 3078, Ack: 15899, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df e6 40 00 80 06 bf dd ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 50 9e f8 ee 30 a2 50 10 .e.....hP...0.P. 0030 fa f0 11 d0 00 00 ac 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 78 61.833678 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (114 bytes) Frame 78 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 3078, Ack: 15899, Len: 164 Lightweight Directory Access Protocol SASL Buffer Length: 160 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFB0DF039A6F49744E1AC78EF9178A464E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: B0DF039A6F49744E krb5_sgn_cksum: 1AC78EF9178A464E krb5_confounder: 8AC92FFB56C0B895 GSS-API Encrypted payload (114 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cc df e7 40 00 80 06 bf 38 ac 1f 01 68 ac 1f ....@....8...h.. 0020 01 65 07 eb 01 85 c4 68 50 9e f8 ee 30 a2 50 18 .e.....hP...0.P. 0030 fa f0 d9 a8 00 00 00 00 00 a0 60 81 9d 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 b0 df 03 9a 6f 49 74 4e 1a c7 8e f9 17 8a 46 4e ....oItN......FN 0060 8a c9 2f fb 56 c0 b8 95 00 65 70 73 4d 5b 71 33 ../.V....epsM[q3 0070 b1 05 ba d6 2e 2b 88 a2 16 a1 d5 04 9b ea 15 cb .....+.......... 0080 5c f3 ff c4 de 20 c3 65 33 3b 19 7d 31 08 b2 3e \.... .e3;.}1..> 0090 61 c6 4e 63 09 f3 d5 1a 86 e7 55 40 dd ec 21 7e a.Nc......U@..!~ 00a0 f2 40 cd 50 ab 91 1d 8d 06 b7 d7 df 1c d9 f5 0f .@.P............ 00b0 46 1b 91 c5 2c 37 c1 b3 14 bf 5b 0f 58 e7 f6 1e F...,7....[.X... 00c0 bf e9 6e 3a f1 df 55 7c bf 5e ac ff 3a ca 24 78 ..n:..U|.^..:.$x 00d0 11 8c 5e 95 a6 d7 3e 84 65 3a ..^...>.e: No. Time Source Destination Protocol Info 79 61.834614 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (141 bytes) Frame 79 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 15899, Ack: 3242, Len: 191 Lightweight Directory Access Protocol SASL Buffer Length: 187 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF739CAA8C08DF726AA5450A35DD56D533... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 739CAA8C08DF726A krb5_sgn_cksum: A5450A35DD56D533 krb5_confounder: 8096D82AC2F112A7 GSS-API Encrypted payload (141 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d dd 40 00 80 06 71 28 ac 1f 01 65 ac 1f ..-.@...q(...e.. 0020 01 68 01 85 07 eb f8 ee 30 a2 c4 68 51 42 50 18 .h......0..hQBP. 0030 fa f0 10 f1 00 00 00 00 00 bb 60 81 b8 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 73 9c aa 8c 08 df 72 6a a5 45 0a 35 dd 56 d5 33 s.....rj.E.5.V.3 0060 80 96 d8 2a c2 f1 12 a7 7d a5 ef ea 9d 48 ab bf ...*....}....H.. 0070 91 0f ef 8c 49 d5 51 4c 58 68 2b 01 76 b7 62 d9 ....I.QLXh+.v.b. 0080 28 1c d7 3e c0 d9 b1 25 b2 52 5a 26 4b 18 97 0e (..>...%.RZ&K... 0090 1a 86 e0 79 05 42 14 f2 5b 8c 4d 13 da e2 89 a4 ...y.B..[.M..... 00a0 06 83 ab 41 67 ac 90 4f bf 0d bf 44 49 fc 4a fc ...Ag..O...DI.J. 00b0 52 e9 cb 48 e8 ca 6e d4 19 cf 5c e5 5e 63 f8 20 R..H..n...\.^c. 00c0 92 7f f7 b6 8f db 6e 5c eb 9f 1e 5b fc 27 b0 6d ......n\...[.'.m 00d0 8b fe 2a ca fa ad c2 c9 02 a1 66 7c c6 31 d3 48 ..*.......f|.1.H 00e0 b5 9c f5 d5 ac c6 c0 33 b0 6f 46 7b ed 4f 82 a3 .......3.oF{.O.. 00f0 1a 30 6e df ff .0n.. No. Time Source Destination Protocol Info 80 61.835302 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (114 bytes) Frame 80 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 3242, Ack: 16090, Len: 164 Lightweight Directory Access Protocol SASL Buffer Length: 160 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFD6BF0AC4EC4D12432A728FDDB7BB1FEE... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: D6BF0AC4EC4D1243 krb5_sgn_cksum: 2A728FDDB7BB1FEE krb5_confounder: D34915D0E250DD19 GSS-API Encrypted payload (114 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cc df e8 40 00 80 06 bf 37 ac 1f 01 68 ac 1f ....@....7...h.. 0020 01 65 07 eb 01 85 c4 68 51 42 f8 ee 31 61 50 18 .e.....hQB..1aP. 0030 fa 31 b9 7f 00 00 00 00 00 a0 60 81 9d 06 09 2a .1........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 d6 bf 0a c4 ec 4d 12 43 2a 72 8f dd b7 bb 1f ee .....M.C*r...... 0060 d3 49 15 d0 e2 50 dd 19 36 54 95 ca 3f ab be 29 .I...P..6T..?..) 0070 b2 52 52 87 85 74 5e b0 c8 92 d1 32 49 4b be 78 .RR..t^....2IK.x 0080 dc a6 2b b9 fc de a9 b2 29 b9 ca cc 74 22 58 67 ..+.....)...t"Xg 0090 ec 5b 08 70 a2 82 c3 0f 9b 00 55 43 5e 8e cb f3 .[.p......UC^... 00a0 af 47 3a 3f bd 41 66 e8 8c 6b 52 be fd 39 29 c7 .G:?.Af..kR..9). 00b0 19 bf bb a5 25 49 f0 8c 0e 8e 86 eb 9b ca ce e5 ....%I.......... 00c0 f3 21 5e 5e 3c 8c 8e 3c b8 c0 28 4e 4e 68 35 5f .!^^<..<..(NNh5_ 00d0 3d 9a a4 ca c8 d5 a7 86 e4 12 =......... No. Time Source Destination Protocol Info 81 61.836028 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (141 bytes) Frame 81 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: shadowserver (2027), Seq: 16090, Ack: 3406, Len: 191 Lightweight Directory Access Protocol SASL Buffer Length: 187 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF57EF131EBF9F634C09F1997BC86BD034... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 57EF131EBF9F634C krb5_sgn_cksum: 09F1997BC86BD034 krb5_confounder: 77F4DB4A0C408349 GSS-API Encrypted payload (141 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d de 40 00 80 06 71 27 ac 1f 01 65 ac 1f ..-.@...q'...e.. 0020 01 68 01 85 07 eb f8 ee 31 61 c4 68 51 e6 50 18 .h......1a.hQ.P. 0030 fa 4c b1 79 00 00 00 00 00 bb 60 81 b8 06 09 2a .L.y......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 57 ef 13 1e bf 9f 63 4c 09 f1 99 7b c8 6b d0 34 W.....cL...{.k.4 0060 77 f4 db 4a 0c 40 83 49 d1 b4 90 bb 97 dc 3b 71 w..J.@.I......;q 0070 d7 f8 87 b7 c0 44 b1 82 ea 7f 05 a6 d6 b6 af 28 .....D.........( 0080 7d 48 e8 4c c4 e3 ce 6a 37 53 17 2d 0c 01 ac d9 }H.L...j7S.-.... 0090 7b 57 d4 4d bb 1e 2c f5 d2 5f 1f 2b 04 c6 fe 15 {W.M..,.._.+.... 00a0 13 af 94 94 52 f2 11 8d c7 b1 a4 42 06 6d 77 b1 ....R......B.mw. 00b0 d8 9e 66 8a 07 2a d6 1f 98 04 7a 59 83 71 7b 53 ..f..*....zY.q{S 00c0 5a ba 82 a6 05 f6 dc 9c 87 5f b8 d2 5d c0 da 3e Z........_..]..> 00d0 a0 84 d9 80 ea 33 8a 9f be ae 90 20 14 c4 b6 11 .....3..... .... 00e0 6d 30 06 2f 01 54 4d 24 aa 01 cd 9c 1c 1c 49 0c m0./.TM$......I. 00f0 d7 0d 52 54 74 ..RTt No. Time Source Destination Protocol Info 82 61.837617 172.31.1.104 172.31.1.101 TCP device2 > ldap [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 Frame 82 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 0, Ack: 0, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 30 df e9 40 00 80 06 bf d2 ac 1f 01 68 ac 1f .0..@........h.. 0020 01 65 07 ee 01 85 54 a9 fc 5a 00 00 00 00 70 02 .e....T..Z....p. 0030 fa f0 d2 ab 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 83 61.837968 172.31.1.101 172.31.1.104 TCP ldap > device2 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 Frame 83 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 30 2d df 40 00 80 06 71 dd ac 1f 01 65 ac 1f .0-.@...q....e.. 0020 01 68 01 85 07 ee 19 95 2d 2c 54 a9 fc 5b 70 12 .h......-,T..[p. 0030 fa f0 8b d9 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 84 61.838141 172.31.1.104 172.31.1.101 TCP device2 > ldap [ACK] Seq=1 Ack=1 Win=64240 Len=0 Frame 84 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df ea 40 00 80 06 bf d9 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 ee 01 85 54 a9 fc 5b 19 95 2d 2d 50 10 .e....T..[..--P. 0030 fa f0 b8 9d 00 00 ac 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 85 61.841082 172.31.1.104 172.31.1.101 DRSUAPI DRSCrackNames request Frame 85 (275 bytes on wire, 275 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1712, Ack: 536, Len: 221 DCE RPC Microsoft Directory Replication Service, DRSCrackNames 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 05 df eb 40 00 80 06 be fb ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 ca 04 01 e7 79 56 d2 52 21 b7 97 50 18 .e.....yV.R!..P. 0030 f8 d9 e4 d7 00 00 05 00 00 03 10 00 00 00 dd 00 ................ 0040 2d 00 7d 06 00 00 90 00 00 00 00 00 0c 00 4e 25 -.}...........N% 0050 2f c2 d5 8e 77 3a 50 63 31 fe 59 3a 28 4c 78 ac /...w:Pc1.Y:(Lx. 0060 18 c6 76 5b 0b e7 14 14 39 9a a1 68 dc 6e 6f f3 ..v[....9..h.no. 0070 81 a4 9a f4 c0 27 96 e2 fa f9 97 e4 99 0f 7d fc .....'........}. 0080 a6 2f 85 7a e8 17 c9 ef 26 a5 82 c8 e5 f6 fc 30 ./.z....&......0 0090 4b 25 e7 48 ab 5c a9 25 e7 56 a4 df 3a b1 25 36 K%.H.\.%.V..:.%6 00a0 1d 44 97 85 91 55 45 ca 98 ed 54 42 3c b5 be 13 .D...UE...TB<... 00b0 fb 7c e3 8f 71 2d 4a 15 e9 ac d9 14 20 f5 73 68 .|..q-J..... .sh 00c0 db f8 7d 6f c9 4d da 21 c2 40 e9 31 0d e0 fd 45 ..}o.M.!.@.1...E 00d0 43 28 e2 ee 27 04 82 fa f4 83 87 e7 7d e7 10 06 C(..'.......}... 00e0 00 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 00f0 01 02 02 02 01 11 00 10 00 ff ff b1 7f 13 41 8c ..............A. 0100 82 01 0a ce c3 2d b9 d1 8d 06 5d 14 a8 15 6f d5 .....-....]...o. 0110 42 db fa B.. No. Time Source Destination Protocol Info 86 61.842244 172.31.1.101 172.31.1.104 DRSUAPI DRSCrackNames response Frame 86 (323 bytes on wire, 323 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 536, Ack: 1933, Len: 269 DCE RPC Microsoft Directory Replication Service, DRSCrackNames 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 35 2d e0 40 00 80 06 70 d7 ac 1f 01 65 ac 1f .5-.@...p....e.. 0020 01 68 04 01 07 ca 52 21 b7 97 e7 79 57 af 50 18 .h....R!...yW.P. 0030 f9 26 dd 7c 00 00 05 00 02 03 10 00 00 00 0d 01 .&.|............ 0040 2d 00 7d 06 00 00 b8 00 00 00 00 00 00 00 54 b2 -.}...........T. 0050 23 10 cf ef 79 e0 3f 93 4d 81 d2 92 c8 ad 31 8b #...y.?.M.....1. 0060 0f 3d ef ce 98 f0 95 0d a0 ef a1 ef 77 ff ca 86 .=..........w... 0070 ee b4 6a b1 aa a1 58 88 4f 74 3c ec 4b d2 33 d1 ..j...X.Ot<.K.3. 0080 e3 41 f6 18 24 9f af 55 b8 50 44 7e c4 c0 e4 6d .A..$..U.PD~...m 0090 31 61 de da dd dc 73 b1 d7 d2 f7 02 42 d4 47 37 1a....s.....B.G7 00a0 c8 73 dc d7 16 48 64 14 23 77 04 47 0d 0e ee 71 .s...Hd.#w.G...q 00b0 21 25 ec ad 6e f7 14 26 fb 47 74 7a 04 51 d7 7c !%..n..&.Gtz.Q.| 00c0 d5 a4 70 d4 2a 3a b7 c5 13 58 2d 14 20 32 49 09 ..p.*:...X-. 2I. 00d0 a1 7c 35 ee 46 eb 80 06 cd f7 60 1c 77 52 b3 f2 .|5.F.....`.wR.. 00e0 1c e9 74 d1 3e 4e 1c 0f ad 0d db 26 7c e8 d9 db ..t.>N.....&|... 00f0 5e fd 0e 6e 99 40 a5 2c 34 7d 86 2c 69 5b 32 11 ^..n.@.,4}.,i[2. 0100 6b e4 68 03 f8 bf d2 a8 95 81 d9 c1 0c 1e 10 06 k.h............. 0110 08 00 01 00 00 00 60 2b 06 09 2a 86 48 86 f7 12 ......`+..*.H... 0120 01 02 02 02 01 11 00 10 00 ff ff 81 7c e9 3d fe ............|.=. 0130 59 6c 8c 7e 35 88 34 77 5d cc d5 35 78 df c9 12 Yl.~5.4w]..5x... 0140 8d 30 92 .0. No. Time Source Destination Protocol Info 87 61.845105 172.31.1.104 172.31.1.101 KRB5 TGS-REQ Frame 87 (1385 bytes on wire, 1385 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 2031 (2031), Dst Port: kerberos (88) Kerberos TGS-REQ Pvno: 5 MSG Type: TGS-REQ (12) padata: PA-TGS-REQ KDC_REQ_BODY 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 5b df ec 00 00 80 11 fa 99 ac 1f 01 68 ac 1f .[...........h.. 0020 01 65 07 ef 00 58 05 47 73 ba 6c 82 05 3b 30 82 .e...X.Gs.l..;0. 0030 05 37 a1 03 02 01 05 a2 03 02 01 0c a3 82 04 a3 .7.............. 0040 30 82 04 9f 30 82 04 9b a1 03 02 01 01 a2 82 04 0...0........... 0050 92 04 82 04 8e 6e 82 04 8a 30 82 04 86 a0 03 02 .....n...0...... 0060 01 05 a1 03 02 01 0e a2 07 03 05 00 00 00 00 00 ................ 0070 a3 82 03 c6 61 82 03 c2 30 82 03 be a0 03 02 01 ....a...0....... 0080 05 a1 1a 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 .....SUB1.W2K3.V 0090 4d 4e 45 54 31 2e 56 4d 2e 42 41 53 45 a2 28 30 MNET1.VM.BASE.(0 00a0 26 a0 03 02 01 02 a1 1f 30 1d 1b 06 6b 72 62 74 &.......0...krbt 00b0 67 74 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e gt..W2K3.VMNET1. 00c0 56 4d 2e 42 41 53 45 a3 82 03 6f 30 82 03 6b a0 VM.BASE...o0..k. 00d0 03 02 01 17 a2 82 03 62 04 82 03 5e ce 8b 5a 29 .......b...^..Z) 00e0 1e 6e d5 99 36 0d a8 74 52 7b d9 06 e9 ee 41 41 .n..6..tR{....AA 00f0 68 03 29 86 69 0f e6 40 af 67 58 9d 44 c2 5c 6d h.).i..@.gX.D.\m 0100 b0 a6 9a 85 79 25 12 e9 51 19 0a 8b 6d 70 ec f5 ....y%..Q...mp.. 0110 ed 96 72 d9 86 a1 0c 9f 79 67 06 a3 58 48 b7 38 ..r.....yg..XH.8 0120 f3 f7 48 ce 5f b2 29 11 91 59 0c c1 3d e1 19 04 ..H._.)..Y..=... 0130 4f 8d 34 ee ca d3 5e bd d8 e8 72 dc ed d4 fa 5a O.4...^...r....Z 0140 77 04 f8 bc ec 38 8a 6a 01 0a 8f 50 c9 39 2c 59 w....8.j...P.9,Y 0150 93 1b 3d 51 c0 dc ec ac 16 19 a6 1f 10 8e d8 66 ..=Q...........f 0160 30 fe 16 44 4b f9 88 01 e1 23 62 14 45 d8 00 c2 0..DK....#b.E... 0170 df ba 54 ad 9e 4f 3c 74 a0 4f b5 3d 87 03 9d 4a ..T..OM... 0240 34 74 df 78 71 3c 9d 5f c1 c3 fb 20 85 f1 e5 af 4t.xq<._... .... 0250 21 5c 5b 4b 33 c2 15 0d 40 8a bc f1 f2 5b ea bd !\[K3...@....[.. 0260 2c 20 b0 23 46 7d f0 10 05 b5 2b 1e ab 07 56 04 , .#F}....+...V. 0270 ec d1 22 38 0c 51 49 11 b0 2c 78 62 ed 69 ff dd .."8.QI..,xb.i.. 0280 f6 95 81 c2 cd 6e b1 79 9c e2 7a 86 1a dd 63 71 .....n.y..z...cq 0290 62 24 dc 01 eb 77 ea 8c c6 70 8e b8 9e b5 81 2d b$...w...p.....- 02a0 6c b3 25 33 23 09 40 26 38 40 82 73 10 ee e1 b6 l.%3#.@&8@.s.... 02b0 a3 9f ac 45 da fa 94 fa 68 31 71 1d 3c 87 93 17 ...E....h1q.<... 02c0 47 5e c1 b6 d8 97 d0 74 64 b1 95 d7 23 5d 29 98 G^.....td...#]). 02d0 4a 4c 70 63 d5 85 d1 ba 68 f3 d7 e8 c5 80 16 7f JLpc....h....... 02e0 41 24 54 8a ef c2 e7 70 39 0c cc 87 c6 84 87 ec A$T....p9....... 02f0 96 79 30 f8 9e 6a 02 26 78 db 58 26 74 d1 dd 68 .y0..j.&x.X&t..h 0300 8e ac 3d c8 c1 35 62 a7 0d 39 a6 27 76 d2 42 0d ..=..5b..9.'v.B. 0310 38 2f c1 8c 5a ef 65 fd 3d b0 e9 b6 e1 bc 29 c0 8/..Z.e.=.....). 0320 62 20 3f 17 e0 82 dc b9 72 cc 4d ca d0 16 0a 0d b ?.....r.M..... 0330 99 f2 98 91 1a 6c 0d 4f c6 6b 66 b9 93 29 77 a9 .....l.O.kf..)w. 0340 48 3f 9e 33 be 58 2d a0 8c ee 3b 95 81 9d 61 0c H?.3.X-...;...a. 0350 9f c0 a1 b7 7c a2 1b 85 94 e7 75 6e 74 43 2f df ....|.....untC/. 0360 c9 6f 1b 2d 9d dd 99 83 39 cc 3b ea 4b cd 89 e5 .o.-....9.;.K... 0370 63 b0 a0 47 9e 5b 0f 2a f3 ed 11 15 a4 58 47 95 c..G.[.*.....XG. 0380 a5 2d 4b da d2 6f fc 34 52 07 ad cd 65 b4 02 d9 .-K..o.4R...e... 0390 53 44 ba 14 b9 f8 49 da 0d 4f e5 1a c7 e1 64 a0 SD....I..O....d. 03a0 57 3e 42 99 27 2b b2 67 d2 9b d9 2a f1 ff b9 58 W>B.'+.g...*...X 03b0 dd 39 42 83 3b f9 04 c8 49 0b f8 5c 49 8a fb 49 .9B.;...I..\I..I 03c0 dc 9d d8 ca bb c2 ac 31 3d 88 68 f5 c3 b6 24 dc .......1=.h...$. 03d0 32 fc d4 8e 35 01 11 ff a6 58 e5 2e 62 95 45 91 2...5....X..b.E. 03e0 49 2e d8 6f 70 fc b8 48 8b c2 18 e0 1d ee db 4b I..op..H.......K 03f0 71 60 83 8b 1f aa a9 53 b2 50 da a8 7e 37 0e fb q`.....S.P..~7.. 0400 25 b9 18 5a 23 f0 85 ef 40 06 c1 d8 40 bc 4a 19 %..Z#...@...@.J. 0410 ab 46 9d 17 74 90 5e 72 70 f8 35 54 8b 8e be 6a .F..t.^rp.5T...j 0420 b5 1d 94 43 3e ad 90 50 bc 21 fb b6 e5 c0 a8 1d ...C>..P.!...... 0430 26 f0 57 c8 ee 23 83 a4 6c ae a4 81 a6 30 81 a3 &.W..#..l....0.. 0440 a0 03 02 01 17 a2 81 9b 04 81 98 df c3 1f 61 51 ..............aQ 0450 de e0 ce 6f 1c 8f 84 4a 9c 88 b6 0b fb 24 93 19 ...o...J.....$.. 0460 71 c2 24 65 9d b3 6c bb 6e aa d9 cf 9a 45 9d 41 q.$e..l.n....E.A 0470 49 52 01 f9 23 e3 b6 51 d5 1f f9 8b 7f 5c 13 72 IR..#..Q.....\.r 0480 b1 c7 ea c3 e6 d0 b2 1f 64 16 92 62 a8 85 bc d5 ........d..b.... 0490 b8 b6 9b ec 4b e6 9f 58 ab ec 4e 85 3b 13 f2 bd ....K..X..N.;... 04a0 dc 0d d5 66 7e 73 86 d1 c5 ac 80 50 55 42 54 36 ...f~s.....PUBT6 04b0 86 bc 90 32 0c 30 e7 0e a2 11 a4 da 26 f8 5c d7 ...2.0......&.\. 04c0 b1 7a 08 f6 be 87 83 4e d4 8f 17 ff c3 b0 5b 9a .z.....N......[. 04d0 e3 06 5d ee 45 af 55 44 76 ee 19 93 0b ac 43 a0 ..].E.UDv.....C. 04e0 70 9a 9a a4 81 83 30 81 80 a0 07 03 05 00 40 81 p.....0.......@. 04f0 00 00 a2 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 ......W2K3.VMNET 0500 31 2e 56 4d 2e 42 41 53 45 a3 2f 30 2d a0 03 02 1.VM.BASE./0-... 0510 01 02 a1 26 30 24 1b 04 6c 64 61 70 1b 1c 77 32 ...&0$..ldap..w2 0520 6b 33 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 k3-101.w2k3.vmne 0530 74 31 2e 76 6d 2e 62 61 73 65 a5 11 18 0f 32 30 t1.vm.base....20 0540 33 37 30 39 31 33 30 32 34 38 30 35 5a a7 06 02 370913024805Z... 0550 04 3d b3 18 8a a8 12 30 10 02 01 17 02 01 03 02 .=.....0........ 0560 01 01 02 01 18 02 02 ff 79 ........y No. Time Source Destination Protocol Info 88 61.847993 172.31.1.101 172.31.1.104 KRB5 TGS-REP Frame 88 (1367 bytes on wire, 1367 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: kerberos (88), Dst Port: 2031 (2031) Kerberos TGS-REP Pvno: 5 MSG Type: TGS-REP (13) Client Realm: SUB1.W2K3.VMNET1.VM.BASE Client Name (Principal): Administrator Ticket enc-part rc4-hmac Frame (1367 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 49 2d e1 00 00 80 11 ac b7 ac 1f 01 65 ac 1f .I-..........e.. 0020 01 68 00 58 07 ef 05 35 d5 70 6d 82 05 29 30 82 .h.X...5.pm..)0. 0030 05 25 a0 03 02 01 05 a1 03 02 01 0d a3 1a 1b 18 .%.............. 0040 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 SUB1.W2K3.VMNET1 0050 2e 56 4d 2e 42 41 53 45 a4 1a 30 18 a0 03 02 01 .VM.BASE..0..... 0060 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 74 72 ...0...Administr 0070 61 74 6f 72 a5 82 03 cd 61 82 03 c9 30 82 03 c5 ator....a...0... 0080 a0 03 02 01 05 a1 15 1b 13 57 32 4b 33 2e 56 4d .........W2K3.VM 0090 4e 45 54 31 2e 56 4d 2e 42 41 53 45 a2 2f 30 2d NET1.VM.BASE./0- 00a0 a0 03 02 01 02 a1 26 30 24 1b 04 6c 64 61 70 1b ......&0$..ldap. 00b0 1c 77 32 6b 33 2d 31 30 31 2e 77 32 6b 33 2e 76 .w2k3-101.w2k3.v 00c0 6d 6e 65 74 31 2e 76 6d 2e 62 61 73 65 a3 82 03 mnet1.vm.base... 00d0 74 30 82 03 70 a0 03 02 01 17 a1 03 02 01 0a a2 t0..p........... 00e0 82 03 62 04 82 03 5e ec d4 c6 6c f8 b2 98 f1 07 ..b...^...l..... 00f0 3f f9 49 75 b6 7a f0 ea fe f3 09 0e 96 89 07 b9 ?.Iu.z.......... 0100 a4 1b 1a 0d 3f 6e d6 e0 48 fe c8 84 09 9f 04 c8 ....?n..H....... 0110 ce 03 b8 75 1d 1a 31 6b ad 8d 14 cd de 50 ac 3a ...u..1k.....P.: 0120 20 b1 9c 77 cf d8 a3 16 e2 29 40 54 95 78 7c 72 ..w.....)@T.x|r 0130 ab e8 c3 cc 1d 09 b3 c1 8e ec f0 2c 35 36 51 c6 ...........,56Q. 0140 93 14 3f 3a 5f 0d f3 61 a2 9a a5 82 f8 fd 4d 63 ..?:_..a......Mc 0150 9b 9f 3d bc ac 13 f8 3e a1 40 d1 f1 ba 24 a7 5f ..=....>.@...$._ 0160 f2 b6 4b 0e af c7 0b 4a 99 3c ab c6 91 9a 78 c0 ..K....J.<....x. 0170 86 4e d3 3b 96 44 7c a8 23 a6 01 bb 76 90 d9 af .N.;.D|.#...v... 0180 f1 ef c5 64 b6 94 1b 9d 1e dd b6 ce ee f5 1b e6 ...d............ 0190 d1 aa 16 d7 d6 a9 2c 4a ee 8f dd 0e 11 c8 7b d9 ......,J......{. 01a0 cb 4f e6 e7 0b 54 b6 84 40 ca 2e 29 45 c7 b9 cd .O...T..@..)E... 01b0 66 42 a7 2d d5 8e 07 5b 2f ef 11 21 10 a6 23 60 fB.-...[/..!..#` 01c0 3b 94 24 03 28 3a 3d 6d ac f9 32 32 7a 7b 89 8c ;.$.(:=m..22z{.. 01d0 71 d4 09 d1 6f ab 36 5e fb 28 62 d1 9d fb f2 8f q...o.6^.(b..... 01e0 de be e1 6c 74 98 1c 92 5e 3d 97 28 a7 97 30 6b ...lt...^=.(..0k 01f0 e3 f1 5e 40 0c 77 33 bb ef 68 8f be 39 8c 8f b3 ..^@.w3..h..9... 0200 e1 17 09 c1 69 95 29 8f 4b f4 0f 3c f5 e0 91 8c ....i.).K..<.... 0210 1c 96 4b 51 02 39 30 92 2c ea c2 d7 40 0a 58 04 ..KQ.90.,...@.X. 0220 0a 60 98 dd 85 b9 c5 82 ef 84 d4 15 55 0e a9 22 .`..........U.." 0230 64 a8 32 c3 31 d8 a2 33 bf f8 fd e3 52 18 67 c0 d.2.1..3....R.g. 0240 76 35 1d 87 c5 35 29 d4 70 2e cf 1d 69 2d 77 c8 v5...5).p...i-w. 0250 d6 f4 d5 34 c3 a9 09 1f 1a fb ad c5 e0 53 36 6b ...4.........S6k 0260 4a 45 22 36 5d 35 60 70 86 a1 0f a6 b2 53 86 e0 JE"6]5`p.....S.. 0270 f1 08 5f 33 8b 9a ee 15 cd 6e b9 ad a5 2f 94 4f .._3.....n.../.O 0280 f5 fa 3b 17 27 8c 92 44 ee ae f0 0d 0a e2 db df ..;.'..D........ 0290 ca 8f 06 fc 1b 88 5b d9 b1 61 dc 53 58 7e 9b 2a ......[..a.SX~.* 02a0 f7 29 67 06 2d 34 d4 47 3b c0 16 79 79 b8 ca a8 .)g.-4.G;..yy... 02b0 5c 51 73 be 45 9e 10 89 e5 7b d8 5a 54 c5 32 81 \Qs.E....{.ZT.2. 02c0 05 c4 c7 25 2f 91 d6 ed 3a 8d b0 74 ca bf 60 4e ...%/...:..t..`N 02d0 ee f3 70 47 d3 86 82 31 90 4a 49 f7 fc e5 ee c6 ..pG...1.JI..... 02e0 10 a5 04 19 d8 39 af ca fb 5f c1 6d 5e 1f 80 8e .....9..._.m^... 02f0 93 86 18 a5 9a 79 f2 0b 42 86 e5 8e 46 e0 a8 e1 .....y..B...F... 0300 0d b1 0b c8 3e 62 f7 4e 51 01 41 a3 9e 95 96 39 ....>b.NQ.A....9 0310 7c de 6c 4f 2d 9a 63 7e b7 a4 92 c4 2b 89 0b 85 |.lO-.c~....+... 0320 d7 c2 5e e6 3d a1 a4 8c 61 77 4b 83 8f 28 17 f1 ..^.=...awK..(.. 0330 35 fc 56 0e 09 c9 ce c5 59 09 7f 83 5b be 0e 42 5.V.....Y...[..B 0340 75 77 58 c5 35 49 d2 c8 dc 10 e7 82 57 90 96 82 uwX.5I......W... 0350 d0 0b 14 a1 b0 75 95 9f 4c da f3 99 a7 14 00 f4 .....u..L....... 0360 85 10 13 2c d7 8a 01 91 2b ce 61 ed 5e 56 38 df ...,....+.a.^V8. 0370 69 cf be 32 e6 86 ba 3e 35 56 38 ac 5c b1 20 75 i..2...>5V8.\. u 0380 86 aa b8 5b 53 4b 02 0b c4 7b dd df 02 28 ba d9 ...[SK...{...(.. 0390 29 f7 f7 c8 bb 64 22 ba 48 a0 e1 08 33 f1 fd 4a )....d".H...3..J 03a0 5f d5 e6 59 e9 84 e1 43 39 64 ad ce 97 f1 0d 1e _..Y...C9d...... 03b0 01 13 67 e1 a3 60 bd bd 32 94 be e5 b2 14 08 b4 ..g..`..2....... 03c0 ca 0f 0a c2 72 4e e8 7d e8 b9 81 e8 42 a3 90 fe ....rN.}....B... 03d0 99 52 71 70 e8 8e f1 7d 12 c3 a2 66 f7 b6 ea 18 .Rqp...}...f.... 03e0 f9 45 7d 1c 7b 62 5f 79 ff cd 0d 59 34 68 f8 15 .E}.{b_y...Y4h.. 03f0 af cd e8 69 ec f5 64 56 70 8b 70 05 0a b1 c9 ee ...i..dVp.p..... 0400 b7 16 63 0d 6c 50 3c 98 cb 89 30 1e 3e 35 7c f3 ..c.lP<...0.>5|. 0410 7d f5 4d 26 bd 6e ee af 28 1c 98 be 15 3d 45 58 }.M&.n..(....=EX 0420 fb f7 cb 57 9a 8a 1c d4 e8 16 4e 54 1c 84 dc 8b ...W......NT.... 0430 45 6b 61 fb 8f 23 75 8a 27 0c a1 85 bc 8f c2 04 Eka..#u.'....... 0440 21 72 1d b8 80 a6 82 01 0e 30 82 01 0a a0 03 02 !r.......0...... 0450 01 17 a2 82 01 01 04 81 fe 97 f6 9e fb f0 40 98 ..............@. 0460 0b 38 47 2d d0 7d 98 0d 43 0e 45 d6 c2 bd 4d 1e .8G-.}..C.E...M. 0470 a4 19 68 f2 91 f1 16 5b 9c 7b 8d 74 a6 2a 8f 3e ..h....[.{.t.*.> 0480 18 d6 6e 8b 29 67 21 88 f3 4d 62 ce 36 8d 51 a1 ..n.)g!..Mb.6.Q. 0490 44 38 76 59 1c ce cd de d5 d3 f1 89 54 66 c1 e9 D8vY........Tf.. 04a0 1a b5 0d 26 d7 87 dc fa 00 e5 e3 44 67 2b db d8 ...&.......Dg+.. 04b0 4c e0 73 69 1e a4 33 0b e0 d6 c5 82 8d 7d b2 32 L.si..3......}.2 04c0 c4 7d 47 ac d3 e2 66 e7 58 ec 09 7e 90 06 84 f2 .}G...f.X..~.... 04d0 46 ed e0 5d 64 ed 6a 3a df 46 c2 6b 15 70 46 5e F..]d.j:.F.k.pF^ 04e0 23 4e 9e 84 f1 ab b8 94 90 40 17 2b 22 c1 e9 e4 #N.......@.+"... 04f0 08 46 54 8d 40 d7 fc 9c 97 64 37 52 88 bd 8a 12 .FT.@....d7R.... 0500 20 51 bf 47 c5 8a d7 84 23 72 ab d5 4a be 22 dd Q.G....#r..J.". 0510 9e f8 ce 20 5b bc 8b ab 65 b2 e5 6c fc 10 e7 84 ... [...e..l.... 0520 0c e0 25 22 d2 7e 34 4f 6c 90 c1 fc c6 95 5c d7 ..%".~4Ol.....\. 0530 ad ab 94 10 c4 a4 be f6 17 e5 36 0a 70 8a 42 95 ..........6.p.B. 0540 7e 37 69 ef 33 f2 c4 b7 a0 c9 35 9f 4b 7f 62 ac ~7i.3.....5.K.b. 0550 32 7c 11 8a da ec f2 2|..... Decrypted Krb5 (862 bytes): 0000 63 82 03 42 30 82 03 3e a0 07 03 05 00 40 a4 00 c..B0..>.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 30 71 ...0..........0q 0020 38 02 d7 fa d7 21 dc 0e 16 9d 26 52 b5 ef a2 1a 8....!....&R.... 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 1a 30 18 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 .....0...Adminis 0060 74 72 61 74 6f 72 a4 0b 30 09 a0 03 02 01 01 a1 trator..0....... 0070 02 04 00 a5 11 18 0f 32 30 30 35 30 33 30 36 30 .......200503060 0080 39 30 38 33 35 5a a6 11 18 0f 32 30 30 35 30 33 90835Z....200503 0090 30 36 30 39 30 39 34 33 5a a7 11 18 0f 32 30 30 06090943Z....200 00a0 35 30 33 30 36 31 39 30 38 33 35 5a a8 11 18 0f 50306190835Z.... 00b0 32 30 30 35 30 33 31 33 30 39 30 38 33 35 5a aa 20050313090835Z. 00c0 82 02 83 30 82 02 7f 30 82 02 7b a0 03 02 01 01 ...0...0..{..... 00d0 a1 82 02 72 04 82 02 6e 30 82 02 6a 30 82 02 66 ...r...n0..j0..f 00e0 a0 04 02 02 00 80 a1 82 02 5c 04 82 02 58 04 00 .........\...X.. 00f0 00 00 00 00 00 00 01 00 00 00 b8 01 00 00 48 00 ..............H. 0100 00 00 00 00 00 00 0a 00 00 00 24 00 00 00 00 02 ..........$..... 0110 00 00 00 00 00 00 06 00 00 00 14 00 00 00 28 02 ..............(. 0120 00 00 00 00 00 00 07 00 00 00 14 00 00 00 40 02 ..............@. 0130 00 00 00 00 00 00 01 10 08 00 cc cc cc cc a8 01 ................ 0140 00 00 00 00 00 00 00 00 02 00 12 96 28 c4 6c 12 ............(.l. 0150 c5 01 ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ................ 0160 ff 7f ae 05 77 89 40 72 c4 01 ae c5 e0 b3 09 73 ....w.@r.......s 0170 c4 01 ff ff ff ff ff ff ff 7f 1a 00 1a 00 04 00 ................ 0180 02 00 00 00 00 00 08 00 02 00 00 00 00 00 0c 00 ................ 0190 02 00 00 00 00 00 10 00 02 00 00 00 00 00 14 00 ................ 01a0 02 00 00 00 00 00 18 00 02 00 0f 00 00 00 f4 01 ................ 01b0 00 00 01 02 00 00 03 00 00 00 1c 00 02 00 20 00 .............. . 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 10 00 12 00 20 00 02 00 08 00 0a 00 24 00 ...... .......$. 01e0 02 00 28 00 02 00 00 00 00 00 00 00 00 00 10 02 ..(............. 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 41 00 ..............A. 0230 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 d.m.i.n.i.s.t.r. 0240 61 00 74 00 6f 00 72 00 00 00 00 00 00 00 00 00 a.t.o.r......... 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280 00 00 00 00 00 00 03 00 00 00 00 02 00 00 07 00 ................ 0290 00 00 08 02 00 00 07 00 00 00 01 02 00 00 07 00 ................ 02a0 00 00 09 00 00 00 00 00 00 00 08 00 00 00 57 00 ..............W. 02b0 32 00 4b 00 33 00 2d 00 31 00 30 00 34 00 05 00 2.K.3.-.1.0.4... 02c0 00 00 00 00 00 00 04 00 00 00 53 00 55 00 42 00 ..........S.U.B. 02d0 31 00 04 00 00 00 01 04 00 00 00 00 00 05 15 00 1............... 02e0 00 00 39 15 ce fd e9 c3 37 9b 6f 15 38 1a 80 eb ..9.....7.o.8... 02f0 70 13 2c 22 c5 01 1a 00 41 00 64 00 6d 00 69 00 p.,"....A.d.m.i. 0300 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 n.i.s.t.r.a.t.o. 0310 72 00 00 00 00 00 76 ff ff ff d5 af 37 d7 1b 7e r.....v.....7..~ 0320 3b 3d db 15 2c 67 5b 6e 8f fe 00 00 00 00 76 ff ;=..,g[n......v. 0330 ff ff 19 01 28 c4 3c 29 04 39 1f 56 1a 2f 0e a0 ....(.<).9.V./.. 0340 e5 78 00 00 00 00 76 ff ff ff 19 01 99 00 00 00 .x....v......... 0350 58 58 1b 41 58 58 1b 41 e5 78 00 00 00 00 XX.AXX.A.x.... No. Time Source Destination Protocol Info 89 61.849709 172.31.1.104 172.31.1.101 LDAP MsgId=228 Bind Request, DN=(null) Frame 89 (1394 bytes on wire, 1394 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 1340 Lightweight Directory Access Protocol, Bind Request Message Id: 228 Message Type: Bind Request (0x00) Message Length: 1324 Response In: 90 Version: 3 DN: (null) Auth Type: SASL (0x03) Mechanism: GSS-SPNEGO GSS-API Token GSS-API OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) SPNEGO negTokenInit mechType mechToken krb5_blob: 608204CB06092A864886F71201020201006E8204BA308204... OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_tok_id: KRB5_AP_REQ (0x0001) Kerberos AP-REQ Pvno: 5 MSG Type: AP-REQ (14) Padding: 0 APOptions: 20000000 (Mutual required) Ticket Authenticator rc4-hmac Encryption type: rc4-hmac (23) Authenticator data: 429A3202D5841E6A56813590164BDA8FD1D721CE675FDF57... [Decrypted using: key learnt from frame 111] Authenticator Authenticator vno: 5 Client Realm: SUB1.W2K3.VMNET1.VM.BASE Client Name (Principal): Administrator Checksum cusec: 554176 ctime: 2005-03-06 09:09:43 (Z) Subkey rc4-hmac Key type: rc4-hmac (23) Key value: 353005EA746176810C760542BB7344B9 Seq Number: 1035147414 Frame (1394 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 64 df ed 40 00 80 06 ba 9a ac 1f 01 68 ac 1f .d..@........h.. 0020 01 65 07 ee 01 85 54 a9 fc 5b 19 95 2d 2d 50 18 .e....T..[..--P. 0030 fa f0 37 cb 00 00 30 84 00 00 05 36 02 02 00 e4 ..7...0....6.... 0040 60 84 00 00 05 2c 02 01 03 04 00 a3 84 00 00 05 `....,.......... 0050 21 04 0a 47 53 53 2d 53 50 4e 45 47 4f 04 82 05 !..GSS-SPNEGO... 0060 11 60 82 05 0d 06 06 2b 06 01 05 05 02 a0 82 05 .`.....+........ 0070 01 30 82 04 fd a0 24 30 22 06 09 2a 86 48 82 f7 .0....$0"..*.H.. 0080 12 01 02 02 06 09 2a 86 48 86 f7 12 01 02 02 06 ......*.H....... 0090 0a 2b 06 01 04 01 82 37 02 02 0a a2 82 04 d3 04 .+.....7........ 00a0 82 04 cf 60 82 04 cb 06 09 2a 86 48 86 f7 12 01 ...`.....*.H.... 00b0 02 02 01 00 6e 82 04 ba 30 82 04 b6 a0 03 02 01 ....n...0....... 00c0 05 a1 03 02 01 0e a2 07 03 05 00 20 00 00 00 a3 ........... .... 00d0 82 03 cd 61 82 03 c9 30 82 03 c5 a0 03 02 01 05 ...a...0........ 00e0 a1 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e ....W2K3.VMNET1. 00f0 56 4d 2e 42 41 53 45 a2 2f 30 2d a0 03 02 01 02 VM.BASE./0-..... 0100 a1 26 30 24 1b 04 6c 64 61 70 1b 1c 77 32 6b 33 .&0$..ldap..w2k3 0110 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 -101.w2k3.vmnet1 0120 2e 76 6d 2e 62 61 73 65 a3 82 03 74 30 82 03 70 .vm.base...t0..p 0130 a0 03 02 01 17 a1 03 02 01 0a a2 82 03 62 04 82 .............b.. 0140 03 5e ec d4 c6 6c f8 b2 98 f1 07 3f f9 49 75 b6 .^...l.....?.Iu. 0150 7a f0 ea fe f3 09 0e 96 89 07 b9 a4 1b 1a 0d 3f z..............? 0160 6e d6 e0 48 fe c8 84 09 9f 04 c8 ce 03 b8 75 1d n..H..........u. 0170 1a 31 6b ad 8d 14 cd de 50 ac 3a 20 b1 9c 77 cf .1k.....P.: ..w. 0180 d8 a3 16 e2 29 40 54 95 78 7c 72 ab e8 c3 cc 1d ....)@T.x|r..... 0190 09 b3 c1 8e ec f0 2c 35 36 51 c6 93 14 3f 3a 5f ......,56Q...?:_ 01a0 0d f3 61 a2 9a a5 82 f8 fd 4d 63 9b 9f 3d bc ac ..a......Mc..=.. 01b0 13 f8 3e a1 40 d1 f1 ba 24 a7 5f f2 b6 4b 0e af ..>.@...$._..K.. 01c0 c7 0b 4a 99 3c ab c6 91 9a 78 c0 86 4e d3 3b 96 ..J.<....x..N.;. 01d0 44 7c a8 23 a6 01 bb 76 90 d9 af f1 ef c5 64 b6 D|.#...v......d. 01e0 94 1b 9d 1e dd b6 ce ee f5 1b e6 d1 aa 16 d7 d6 ................ 01f0 a9 2c 4a ee 8f dd 0e 11 c8 7b d9 cb 4f e6 e7 0b .,J......{..O... 0200 54 b6 84 40 ca 2e 29 45 c7 b9 cd 66 42 a7 2d d5 T..@..)E...fB.-. 0210 8e 07 5b 2f ef 11 21 10 a6 23 60 3b 94 24 03 28 ..[/..!..#`;.$.( 0220 3a 3d 6d ac f9 32 32 7a 7b 89 8c 71 d4 09 d1 6f :=m..22z{..q...o 0230 ab 36 5e fb 28 62 d1 9d fb f2 8f de be e1 6c 74 .6^.(b........lt 0240 98 1c 92 5e 3d 97 28 a7 97 30 6b e3 f1 5e 40 0c ...^=.(..0k..^@. 0250 77 33 bb ef 68 8f be 39 8c 8f b3 e1 17 09 c1 69 w3..h..9.......i 0260 95 29 8f 4b f4 0f 3c f5 e0 91 8c 1c 96 4b 51 02 .).K..<......KQ. 0270 39 30 92 2c ea c2 d7 40 0a 58 04 0a 60 98 dd 85 90.,...@.X..`... 0280 b9 c5 82 ef 84 d4 15 55 0e a9 22 64 a8 32 c3 31 .......U.."d.2.1 0290 d8 a2 33 bf f8 fd e3 52 18 67 c0 76 35 1d 87 c5 ..3....R.g.v5... 02a0 35 29 d4 70 2e cf 1d 69 2d 77 c8 d6 f4 d5 34 c3 5).p...i-w....4. 02b0 a9 09 1f 1a fb ad c5 e0 53 36 6b 4a 45 22 36 5d ........S6kJE"6] 02c0 35 60 70 86 a1 0f a6 b2 53 86 e0 f1 08 5f 33 8b 5`p.....S...._3. 02d0 9a ee 15 cd 6e b9 ad a5 2f 94 4f f5 fa 3b 17 27 ....n.../.O..;.' 02e0 8c 92 44 ee ae f0 0d 0a e2 db df ca 8f 06 fc 1b ..D............. 02f0 88 5b d9 b1 61 dc 53 58 7e 9b 2a f7 29 67 06 2d .[..a.SX~.*.)g.- 0300 34 d4 47 3b c0 16 79 79 b8 ca a8 5c 51 73 be 45 4.G;..yy...\Qs.E 0310 9e 10 89 e5 7b d8 5a 54 c5 32 81 05 c4 c7 25 2f ....{.ZT.2....%/ 0320 91 d6 ed 3a 8d b0 74 ca bf 60 4e ee f3 70 47 d3 ...:..t..`N..pG. 0330 86 82 31 90 4a 49 f7 fc e5 ee c6 10 a5 04 19 d8 ..1.JI.......... 0340 39 af ca fb 5f c1 6d 5e 1f 80 8e 93 86 18 a5 9a 9..._.m^........ 0350 79 f2 0b 42 86 e5 8e 46 e0 a8 e1 0d b1 0b c8 3e y..B...F.......> 0360 62 f7 4e 51 01 41 a3 9e 95 96 39 7c de 6c 4f 2d b.NQ.A....9|.lO- 0370 9a 63 7e b7 a4 92 c4 2b 89 0b 85 d7 c2 5e e6 3d .c~....+.....^.= 0380 a1 a4 8c 61 77 4b 83 8f 28 17 f1 35 fc 56 0e 09 ...awK..(..5.V.. 0390 c9 ce c5 59 09 7f 83 5b be 0e 42 75 77 58 c5 35 ...Y...[..BuwX.5 03a0 49 d2 c8 dc 10 e7 82 57 90 96 82 d0 0b 14 a1 b0 I......W........ 03b0 75 95 9f 4c da f3 99 a7 14 00 f4 85 10 13 2c d7 u..L..........,. 03c0 8a 01 91 2b ce 61 ed 5e 56 38 df 69 cf be 32 e6 ...+.a.^V8.i..2. 03d0 86 ba 3e 35 56 38 ac 5c b1 20 75 86 aa b8 5b 53 ..>5V8.\. u...[S 03e0 4b 02 0b c4 7b dd df 02 28 ba d9 29 f7 f7 c8 bb K...{...(..).... 03f0 64 22 ba 48 a0 e1 08 33 f1 fd 4a 5f d5 e6 59 e9 d".H...3..J_..Y. 0400 84 e1 43 39 64 ad ce 97 f1 0d 1e 01 13 67 e1 a3 ..C9d........g.. 0410 60 bd bd 32 94 be e5 b2 14 08 b4 ca 0f 0a c2 72 `..2...........r 0420 4e e8 7d e8 b9 81 e8 42 a3 90 fe 99 52 71 70 e8 N.}....B....Rqp. 0430 8e f1 7d 12 c3 a2 66 f7 b6 ea 18 f9 45 7d 1c 7b ..}...f.....E}.{ 0440 62 5f 79 ff cd 0d 59 34 68 f8 15 af cd e8 69 ec b_y...Y4h.....i. 0450 f5 64 56 70 8b 70 05 0a b1 c9 ee b7 16 63 0d 6c .dVp.p.......c.l 0460 50 3c 98 cb 89 30 1e 3e 35 7c f3 7d f5 4d 26 bd P<...0.>5|.}.M&. 0470 6e ee af 28 1c 98 be 15 3d 45 58 fb f7 cb 57 9a n..(....=EX...W. 0480 8a 1c d4 e8 16 4e 54 1c 84 dc 8b 45 6b 61 fb 8f .....NT....Eka.. 0490 23 75 8a 27 0c a1 85 bc 8f c2 04 21 72 1d b8 80 #u.'.......!r... 04a0 a4 81 cf 30 81 cc a0 03 02 01 17 a2 81 c4 04 81 ...0............ 04b0 c1 42 9a 32 02 d5 84 1e 6a 56 81 35 90 16 4b da .B.2....jV.5..K. 04c0 8f d1 d7 21 ce 67 5f df 57 2c aa fc 9e 6c bf b5 ...!.g_.W,...l.. 04d0 6c 87 05 d4 0b 62 5a a6 50 10 e4 87 4c f8 4f 41 l....bZ.P...L.OA 04e0 23 38 7d 33 8d 6e 46 f4 60 c1 19 06 eb 22 ac 05 #8}3.nF.`....".. 04f0 38 f4 bf 83 73 1e 0a 92 85 b3 46 86 83 43 20 09 8...s.....F..C . 0500 b8 66 09 48 c8 19 19 c1 98 5d bd 50 3b a6 58 53 .f.H.....].P;.XS 0510 58 7e ef d1 e0 0b b2 77 e8 ec 2f 6c dd fd f3 68 X~.....w../l...h 0520 e9 ae ee 55 d8 f8 4c 70 81 18 b8 7f 61 98 96 91 ...U..Lp....a... 0530 ae 7d 71 d3 00 a3 15 67 9e e2 b3 d9 d8 6d 1c be .}q....g.....m.. 0540 9b 40 fd bb 3d 3a ec 14 2e 0e 30 70 da 85 e1 58 .@..=:....0p...X 0550 2f 5f e0 25 41 10 38 b4 ae 10 bb 6a 51 00 d0 56 /_.%A.8....jQ..V 0560 3b 70 d3 bf 1c 11 3f 95 21 0a cf 79 a5 7e c6 57 ;p....?.!..y.~.W 0570 58 b6 X. Decrypted Krb5 (862 bytes): 0000 63 82 03 42 30 82 03 3e a0 07 03 05 00 40 a4 00 c..B0..>.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 30 71 ...0..........0q 0020 38 02 d7 fa d7 21 dc 0e 16 9d 26 52 b5 ef a2 1a 8....!....&R.... 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 1a 30 18 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 .....0...Adminis 0060 74 72 61 74 6f 72 a4 0b 30 09 a0 03 02 01 01 a1 trator..0....... 0070 02 04 00 a5 11 18 0f 32 30 30 35 30 33 30 36 30 .......200503060 0080 39 30 38 33 35 5a a6 11 18 0f 32 30 30 35 30 33 90835Z....200503 0090 30 36 30 39 30 39 34 33 5a a7 11 18 0f 32 30 30 06090943Z....200 00a0 35 30 33 30 36 31 39 30 38 33 35 5a a8 11 18 0f 50306190835Z.... 00b0 32 30 30 35 30 33 31 33 30 39 30 38 33 35 5a aa 20050313090835Z. 00c0 82 02 83 30 82 02 7f 30 82 02 7b a0 03 02 01 01 ...0...0..{..... 00d0 a1 82 02 72 04 82 02 6e 30 82 02 6a 30 82 02 66 ...r...n0..j0..f 00e0 a0 04 02 02 00 80 a1 82 02 5c 04 82 02 58 04 00 .........\...X.. 00f0 00 00 00 00 00 00 01 00 00 00 b8 01 00 00 48 00 ..............H. 0100 00 00 00 00 00 00 0a 00 00 00 24 00 00 00 00 02 ..........$..... 0110 00 00 00 00 00 00 06 00 00 00 14 00 00 00 28 02 ..............(. 0120 00 00 00 00 00 00 07 00 00 00 14 00 00 00 40 02 ..............@. 0130 00 00 00 00 00 00 01 10 08 00 cc cc cc cc a8 01 ................ 0140 00 00 00 00 00 00 00 00 02 00 12 96 28 c4 6c 12 ............(.l. 0150 c5 01 ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ................ 0160 ff 7f ae 05 77 89 40 72 c4 01 ae c5 e0 b3 09 73 ....w.@r.......s 0170 c4 01 ff ff ff ff ff ff ff 7f 1a 00 1a 00 04 00 ................ 0180 02 00 00 00 00 00 08 00 02 00 00 00 00 00 0c 00 ................ 0190 02 00 00 00 00 00 10 00 02 00 00 00 00 00 14 00 ................ 01a0 02 00 00 00 00 00 18 00 02 00 0f 00 00 00 f4 01 ................ 01b0 00 00 01 02 00 00 03 00 00 00 1c 00 02 00 20 00 .............. . 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 10 00 12 00 20 00 02 00 08 00 0a 00 24 00 ...... .......$. 01e0 02 00 28 00 02 00 00 00 00 00 00 00 00 00 10 02 ..(............. 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 41 00 ..............A. 0230 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 d.m.i.n.i.s.t.r. 0240 61 00 74 00 6f 00 72 00 00 00 00 00 00 00 00 00 a.t.o.r......... 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280 00 00 00 00 00 00 03 00 00 00 00 02 00 00 07 00 ................ 0290 00 00 08 02 00 00 07 00 00 00 01 02 00 00 07 00 ................ 02a0 00 00 09 00 00 00 00 00 00 00 08 00 00 00 57 00 ..............W. 02b0 32 00 4b 00 33 00 2d 00 31 00 30 00 34 00 05 00 2.K.3.-.1.0.4... 02c0 00 00 00 00 00 00 04 00 00 00 53 00 55 00 42 00 ..........S.U.B. 02d0 31 00 04 00 00 00 01 04 00 00 00 00 00 05 15 00 1............... 02e0 00 00 39 15 ce fd e9 c3 37 9b 6f 15 38 1a 80 eb ..9.....7.o.8... 02f0 70 13 2c 22 c5 01 1a 00 41 00 64 00 6d 00 69 00 p.,"....A.d.m.i. 0300 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 n.i.s.t.r.a.t.o. 0310 72 00 00 00 00 00 76 ff ff ff d5 af 37 d7 1b 7e r.....v.....7..~ 0320 3b 3d db 15 2c 67 5b 6e 8f fe 00 00 00 00 76 ff ;=..,g[n......v. 0330 ff ff 19 01 28 c4 3c 29 04 39 1f 56 1a 2f 0e a0 ....(.<).9.V./.. 0340 e5 78 00 00 00 00 76 ff ff ff 19 01 f9 02 00 00 .x....v......... 0350 88 ec 5e 08 d8 59 1b 41 e5 78 00 00 00 00 ..^..Y.A.x.... Decrypted Krb5 (193 bytes): 0000 62 81 a6 30 81 a3 a0 03 02 01 05 a1 1a 1b 18 53 b..0...........S 0010 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 2e UB1.W2K3.VMNET1. 0020 56 4d 2e 42 41 53 45 a2 1a 30 18 a0 03 02 01 01 VM.BASE..0...... 0030 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 74 72 61 ..0...Administra 0040 74 6f 72 a3 25 30 23 a0 05 02 03 00 80 03 a1 1a tor.%0#......... 0050 04 18 10 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 00 00 00 00 3e 40 00 00 a4 05 02 03 08 74 ......>@.......t 0070 c0 a5 11 18 0f 32 30 30 35 30 33 30 36 30 39 30 .....20050306090 0080 39 34 33 5a a6 1b 30 19 a0 03 02 01 17 a1 12 04 943Z..0......... 0090 10 35 30 05 ea 74 61 76 81 0c 76 05 42 bb 73 44 .50..tav..v.B.sD 00a0 b9 a7 06 02 04 3d b3 18 96 35 30 05 39 00 00 00 .....=...50.9... 00b0 65 74 68 3a 69 70 3a 74 63 70 3a 6c 64 61 70 3a eth:ip:tcp:ldap: 00c0 67 g No. Time Source Destination Protocol Info 90 61.852153 172.31.1.101 172.31.1.104 LDAP MsgId=228 Bind Result Frame 90 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 1, Ack: 1341, Len: 191 Lightweight Directory Access Protocol, Bind Result Message Id: 228 Message Type: Bind Result (0x01) Message Length: 175 Response To: 89 Time: 0.002444000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) GSS-API Token GSS-API SPNEGO negTokenTarg Frame (245 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d e2 40 00 80 06 71 23 ac 1f 01 65 ac 1f ..-.@...q#...e.. 0020 01 68 01 85 07 ee 19 95 2d 2d 54 aa 01 97 50 18 .h......--T...P. 0030 f5 b4 12 57 00 00 30 84 00 00 00 b9 02 02 00 e4 ...W..0......... 0040 61 84 00 00 00 af 0a 01 00 04 00 04 00 87 82 00 a............... 0050 a4 a1 81 a1 30 81 9e a0 03 0a 01 00 a1 0b 06 09 ....0........... 0060 2a 86 48 82 f7 12 01 02 02 a2 81 89 04 81 86 60 *.H............` 0070 81 83 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f ....*.H........o 0080 74 30 72 a0 03 02 01 05 a1 03 02 01 0f a2 66 30 t0r...........f0 0090 64 a0 03 02 01 17 a2 5d 04 5b ba 1f 42 42 ff 98 d......].[..BB.. 00a0 69 7d 78 15 be 9b 2b be 6e 35 3f 8d 63 bf 1d cc i}x...+.n5?.c... 00b0 6a ec 72 65 1f 59 cf 38 bd 8a 37 15 c3 1c 50 e1 j.re.Y.8..7...P. 00c0 55 3b d2 43 3e 95 89 32 c4 b1 c9 23 9d b4 2c 8d U;.C>..2...#..,. 00d0 fb 84 2f 6a f4 a6 70 cf 05 9a b4 23 87 42 06 86 ../j..p....#.B.. 00e0 69 07 a9 95 68 49 3f c2 e6 4f 30 68 be df 3a 35 i...hI?..O0h..:5 00f0 18 9f e8 92 a9 ..... Decrypted Krb5 (91 bytes): 0000 7b 41 30 3f a0 11 18 0f 32 30 30 35 30 33 30 36 {A0?....20050306 0010 30 39 30 39 34 33 5a a1 05 02 03 08 74 c0 a2 1b 090943Z.....t... 0020 30 19 a0 03 02 01 17 a1 12 04 10 35 30 05 ea 74 0..........50..t 0030 61 76 81 0c 76 05 42 bb 73 44 b9 a3 06 02 04 3d av..v.B.sD.....= 0040 b9 68 6a 35 21 00 00 00 44 65 63 72 79 70 74 65 .hj5!...Decrypte 0050 64 20 4b 72 62 35 20 28 39 31 20 d Krb5 (91 No. Time Source Destination Protocol Info 91 61.854651 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (75 bytes) Frame 91 (178 bytes on wire, 178 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1341, Ack: 192, Len: 124 Lightweight Directory Access Protocol SASL Buffer Length: 120 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF3F1FC17D247098A14585983096A95C4B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 3F1FC17D247098A1 krb5_sgn_cksum: 4585983096A95C4B krb5_confounder: 122E5BB8AD6FF35F GSS-API Encrypted payload (75 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 a4 df ee 40 00 80 06 bf 59 ac 1f 01 68 ac 1f ....@....Y...h.. 0020 01 65 07 ee 01 85 54 aa 01 97 19 95 2d ec 50 18 .e....T.....-.P. 0030 fa 31 8c 7a 00 00 00 00 00 78 60 76 06 09 2a 86 .1.z.....x`v..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 3f H..............? 0050 1f c1 7d 24 70 98 a1 45 85 98 30 96 a9 5c 4b 12 ..}$p..E..0..\K. 0060 2e 5b b8 ad 6f f3 5f 0f 77 13 7d 4c 1b 62 46 70 .[..o._.w.}L.bFp 0070 66 c7 11 a9 06 8d 1e c2 09 b2 0e bb 7b c4 b3 40 f...........{..@ 0080 54 c7 7c ea 65 32 ba 9b 61 5b 55 b9 f5 78 fb 93 T.|.e2..a[U..x.. 0090 07 da 5a 0f 59 fa 75 dd 99 5d d0 73 31 ff d6 3b ..Z.Y.u..].s1..; 00a0 76 b7 d6 26 87 76 e9 2a 52 8a 40 5f ba 34 66 f8 v..&.v.*R.@_.4f. 00b0 57 11 W. No. Time Source Destination Protocol Info 92 61.855475 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (115 bytes) Frame 92 (219 bytes on wire, 219 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 192, Ack: 1465, Len: 165 Lightweight Directory Access Protocol SASL Buffer Length: 161 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFBD4D4D86774B8D84E3E2521F042937CF... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: BD4D4D86774B8D84 krb5_sgn_cksum: E3E2521F042937CF krb5_confounder: 1FAA587AE5BFCB9B GSS-API Encrypted payload (115 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 cd 2d e3 40 00 80 06 71 3c ac 1f 01 65 ac 1f ..-.@...q<...e.. 0020 01 68 01 85 07 ee 19 95 2d ec 54 aa 02 13 50 18 .h......-.T...P. 0030 fa f0 3e b3 00 00 00 00 00 a1 60 81 9e 06 09 2a ..>.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 bd 4d 4d 86 77 4b 8d 84 e3 e2 52 1f 04 29 37 cf .MM.wK....R..)7. 0060 1f aa 58 7a e5 bf cb 9b 8b 78 b0 31 6c 65 08 b9 ..Xz.....x.1le.. 0070 32 fb 3f c0 4a 0e b7 6f 3c 35 e2 ca 45 b0 8f 7e 2.?.J..o<5..E..~ 0080 05 2f b3 7a ee ce f9 83 18 a4 d1 f8 e3 e3 ba 5e ./.z...........^ 0090 6b f4 e8 01 eb b7 c5 fd ba 70 c5 6a fb 1d 68 3f k........p.j..h? 00a0 80 15 d7 e6 87 d6 7d f5 1d 89 a2 86 33 1e 0f d4 ......}.....3... 00b0 d9 10 f4 d0 f2 9f 5c e3 62 e4 1e 7f 8e bd fc ed ......\.b....... 00c0 2f 42 a8 68 d2 41 54 8c d3 93 b2 01 f4 c2 a1 1b /B.h.AT......... 00d0 32 3a 3f 8d 39 bb a9 79 f2 f5 62 2:?.9..y..b No. Time Source Destination Protocol Info 93 61.856328 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 93 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1465, Ack: 357, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF0F3DE2ABE6C32D1A1C460C7380CF7EB3... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 0F3DE2ABE6C32D1A krb5_sgn_cksum: 1C460C7380CF7EB3 krb5_confounder: F59EABB8502E8DC4 GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb df ef 40 00 80 06 bf 41 ac 1f 01 68 ac 1f ....@....A...h.. 0020 01 65 07 ee 01 85 54 aa 02 13 19 95 2e 91 50 18 .e....T.......P. 0030 f9 8c 15 79 00 00 00 00 00 8f 60 81 8c 06 09 2a ...y......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 0f 3d e2 ab e6 c3 2d 1a 1c 46 0c 73 80 cf 7e b3 .=....-..F.s..~. 0060 f5 9e ab b8 50 2e 8d c4 8b d1 b0 e9 2a 03 f3 12 ....P.......*... 0070 ab b0 4f 5f 25 c1 df 16 65 4d 56 e8 4a dc 42 4d ..O_%...eMV.J.BM 0080 c5 15 64 70 3c 13 8a 7b 33 56 24 20 12 b2 1e d5 ..dp<..{3V$ .... 0090 6b 9d f7 fc ea d5 66 b1 c9 7b 08 97 82 34 ff 5f k.....f..{...4._ 00a0 de ff 1b 33 f8 e2 ed a7 81 07 1b 8b c5 a7 8c 92 ...3............ 00b0 a4 d0 71 8c b5 ee 5b 1e d1 0b e4 83 b1 d2 ed c6 ..q...[......... 00c0 ef 6e ac ef 6c de 0b af 2f .n..l.../ No. Time Source Destination Protocol Info 94 61.857184 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 94 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 357, Ack: 1612, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF45E8922A715C2DF3A4C90C8C1A39B73F... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 45E8922A715C2DF3 krb5_sgn_cksum: A4C90C8C1A39B73F krb5_confounder: 4FA7C1F7A3DD7B86 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d e4 40 00 80 06 71 2e ac 1f 01 65 ac 1f ..-.@...q....e.. 0020 01 68 01 85 07 ee 19 95 2e 91 54 aa 02 a6 50 18 .h........T...P. 0030 fa 5d 58 d0 00 00 00 00 00 ae 60 81 ab 06 09 2a .]X.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 45 e8 92 2a 71 5c 2d f3 a4 c9 0c 8c 1a 39 b7 3f E..*q\-......9.? 0060 4f a7 c1 f7 a3 dd 7b 86 14 0e b5 b2 6c c8 88 07 O.....{.....l... 0070 eb fe 8c 61 a0 f5 cf e1 b8 06 6c 63 d6 63 7e 37 ...a......lc.c~7 0080 fe 73 ba e6 02 2f 61 b9 72 b6 b1 0e 63 a5 83 2e .s.../a.r...c... 0090 c3 a8 8f 24 a9 d3 56 e9 fb 97 ed e0 9a f1 f7 af ...$..V......... 00a0 bb 7e 0f ca 9f 58 42 77 79 0c 2d 6f 56 da b2 3a .~...XBwy.-oV..: 00b0 92 b1 bf 5a 7a 19 93 74 10 35 80 f0 84 45 98 4b ...Zz..t.5...E.K 00c0 52 cf 7f 1e e8 b2 ba 10 91 07 24 d1 4d 30 99 a1 R.........$.M0.. 00d0 89 92 fa 9a e1 7c d8 a3 39 1b a9 98 17 fd fa b8 .....|..9....... 00e0 fc a5 d8 fd e1 01 55 1b ......U. No. Time Source Destination Protocol Info 95 61.858739 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (99 bytes) Frame 95 (203 bytes on wire, 203 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1612, Ack: 535, Len: 149 Lightweight Directory Access Protocol SASL Buffer Length: 145 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF8599DF618B99C7077468413D20BB39FF... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 8599DF618B99C707 krb5_sgn_cksum: 7468413D20BB39FF krb5_confounder: 20EEA6C7A44224D4 GSS-API Encrypted payload (99 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bd df f0 40 00 80 06 bf 3e ac 1f 01 68 ac 1f ....@....>...h.. 0020 01 65 07 ee 01 85 54 aa 02 a6 19 95 2f 43 50 18 .e....T...../CP. 0030 f8 da 42 1d 00 00 00 00 00 91 60 81 8e 06 09 2a ..B.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 85 99 df 61 8b 99 c7 07 74 68 41 3d 20 bb 39 ff ...a....thA= .9. 0060 20 ee a6 c7 a4 42 24 d4 20 d9 3a ec d8 09 3b a8 ....B$. .:...;. 0070 d3 61 fc e7 59 d9 a1 ce 32 cd 95 b4 f9 4b 85 64 .a..Y...2....K.d 0080 24 bc 8e 2e ba 57 71 9e 66 3e 17 89 dc 3b 19 08 $....Wq.f>...;.. 0090 a8 9d 22 1d 07 c2 8a da a6 69 77 d1 eb 01 b8 b6 .."......iw..... 00a0 8b c4 4f 02 4c 0e 6d d0 fb a8 45 70 26 b9 6d 94 ..O.L.m...Ep&.m. 00b0 31 09 9c 93 31 a0 0f 5f 83 ef 8c f1 1b 25 7c b2 1...1.._.....%|. 00c0 75 93 17 60 4c a4 ee 22 a5 58 58 u..`L..".XX No. Time Source Destination Protocol Info 96 61.859458 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 96 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 535, Ack: 1761, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4FD32ED21CE3867F0AC7E8865C8A2A28... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4FD32ED21CE3867F krb5_sgn_cksum: 0AC7E8865C8A2A28 krb5_confounder: 89F46F4DF7A67859 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d e5 40 00 80 06 71 2d ac 1f 01 65 ac 1f ..-.@...q-...e.. 0020 01 68 01 85 07 ee 19 95 2f 43 54 aa 03 3b 50 18 .h....../CT..;P. 0030 f9 c8 b1 66 00 00 00 00 00 ae 60 81 ab 06 09 2a ...f......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 4f d3 2e d2 1c e3 86 7f 0a c7 e8 86 5c 8a 2a 28 O...........\.*( 0060 89 f4 6f 4d f7 a6 78 59 9f cc 5d 6e 9f 08 6a 67 ..oM..xY..]n..jg 0070 76 6d 42 76 af 9b 82 87 f5 d9 df d7 a6 71 fd 3d vmBv.........q.= 0080 a7 63 ee 9f 1f 7a 85 07 8d d2 da 0b 72 26 3a 4f .c...z......r&:O 0090 bc 3f 5b b1 4e 30 11 07 d0 30 d4 06 5a d5 b1 d1 .?[.N0...0..Z... 00a0 c2 56 71 3e 30 e2 11 a0 5c 15 9a b4 59 06 2c 39 .Vq>0...\...Y.,9 00b0 ce 29 5f 85 3c 63 d5 a2 d8 1a d0 fe e7 67 fb b2 .)_.#5.F...r 0060 ca 67 77 91 ce af 21 f8 7c 28 f3 21 9a 60 f8 0d .gw...!.|(.!.`.. 0070 75 55 b0 43 9c b2 35 f2 e2 27 d0 2e 31 ea 92 77 uU.C..5..'..1..w 0080 78 e3 6c de 62 8f 13 ac 5e d2 f3 46 aa 92 5d e7 x.l.b...^..F..]. 0090 c2 b8 d9 74 58 2f dd fe d5 79 37 ee 12 f7 e8 25 ...tX/...y7....% 00a0 72 1f c3 c4 9a 69 23 0d cf ec 51 7a d0 ee f7 49 r....i#...Qz...I 00b0 a6 6c 1b e9 b8 47 2c f4 c5 eb c4 83 9c e5 68 7d .l...G,.......h} 00c0 56 e5 dd cf d9 cb c2 c1 35 f1 79 93 97 dd 37 b1 V.......5.y...7. 00d0 2a c4 6b f2 e0 3c 05 5c 32 08 d8 00 96 4e 05 4f *.k..<.\2....N.O 00e0 d0 58 b1 c8 08 ad fd d3 27 31 7f e4 3b b9 62 e8 .X......'1..;.b. 00f0 b4 e9 53 a5 c8 49 af 84 5f 6e aa 57 e7 45 c9 c0 ..S..I.._n.W.E.. 0100 2c 4f 0a 6f c5 e3 5b 01 ca 1a d0 34 90 d9 c3 09 ,O.o..[....4.... 0110 9d 06 57 92 b5 46 2d 3a a7 2b ff 03 3a fb ea 20 ..W..F-:.+..:.. 0120 f8 3c 52 c5 1d 13 a8 64 a6 43 cf 20 5a a0 d5 9c .....B=..7f.... 01d0 27 54 68 67 82 e9 20 2c b8 34 c9 69 95 f6 92 fb 'Thg.. ,.4.i.... 01e0 d0 b7 f9 a7 c4 5e 8a b7 11 06 f2 4d cc f5 fb a6 .....^.....M.... 01f0 75 f2 b6 bf 79 78 9d 76 72 44 aa a3 b4 a5 21 33 u...yx.vrD....!3 0200 e9 1b 83 b6 7a 4d e9 f8 23 ea a5 70 de c6 e4 f8 ....zM..#..p.... 0210 39 4d 49 91 66 ea 19 ea 9a 25 3c 39 8d 9b 50 7f 9MI.f....%<9..P. 0220 7f 27 ec 61 29 08 98 4f 81 7e 3a 16 cf 2b d0 3a .'.a)..O.~:..+.: 0230 ae fe 45 0a fe 2a 06 26 d5 98 0c af cc 37 50 69 ..E..*.&.....7Pi 0240 85 2a f2 0a 91 66 d6 6c d5 04 4b 9e 64 9c ac e8 .*...f.l..K.d... 0250 2a c3 4c 1a bb 85 89 c5 fb db 4a 24 fa b2 4d ad *.L.......J$..M. 0260 53 40 bd f1 b9 05 36 5e eb 44 61 6d 8e 9f 09 cd S@....6^.Dam.... 0270 61 51 91 70 2e b8 23 21 b4 80 cb d1 95 cc 66 fd aQ.p..#!......f. 0280 95 50 9b a2 11 8a e9 56 0d 20 3f b1 cf bf 91 f8 .P.....V. ?..... 0290 b3 a4 41 f2 e1 db e8 57 eb 40 e4 2c 89 09 f2 5b ..A....W.@.,...[ 02a0 a0 88 6d c7 56 fc 65 bf 7b e7 82 cf 0a 7b 09 bf ..m.V.e.{....{.. 02b0 dd b3 c0 97 1c 77 82 98 02 98 65 2b d2 7a 33 d7 .....w....e+.z3. 02c0 8e 52 6e e3 b8 d6 94 67 e4 f4 4b f4 29 65 36 df .Rn....g..K.)e6. 02d0 a3 3d 95 4e df 22 0e 3c 32 19 dd 1f 6d c1 1d 31 .=.N.".<2...m..1 02e0 e5 45 ed 9b 61 55 04 1a 6f 71 39 88 0b 17 65 27 .E..aU..oq9...e' 02f0 13 a7 a1 f9 c7 56 b2 63 6f f0 d4 05 e7 0e 29 ed .....V.co.....). 0300 5b 12 18 fa 3d 9e d8 ff b8 dc f2 0f 60 71 9f 7c [...=.......`q.| 0310 d7 3d 52 f4 12 37 38 1e 19 de 25 11 5b ec 33 94 .=R..78...%.[.3. 0320 e4 bf d8 41 70 71 cc ff 88 b8 9f d9 51 2b 5e 09 ...Apq......Q+^. 0330 6a ef ea 4a 9f 3f 54 ef f4 e7 06 c3 3c 3a 35 32 j..J.?T.....<:52 0340 89 47 f4 4a 33 4f 56 b6 35 d4 92 40 db c3 8a b8 .G.J3OV.5..@.... 0350 d7 d9 2a a1 d0 c9 87 b6 e1 25 98 be 19 56 63 f1 ..*......%...Vc. 0360 06 08 39 cb de d6 55 0c e3 8e a5 09 79 ab 93 7c ..9...U.....y..| 0370 4f ec 13 e0 4d 05 4b db 3e 4f dd c8 7d c2 af 37 O...M.K.>O..}..7 0380 be 05 75 a4 fa 2b 14 2e 46 c2 e2 87 f5 ..u..+..F.... No. Time Source Destination Protocol Info 99 61.861150 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 99 (116 bytes on wire, 116 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1924, Ack: 1568, Len: 62 Lightweight Directory Access Protocol SASL Buffer Length: 58 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFC1FCC863B3B2703F78E068F4D0B1B8EA... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: C1FCC863B3B2703F krb5_sgn_cksum: 78E068F4D0B1B8EA krb5_confounder: B0B2F7A64E57488E [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 66 df f2 40 00 80 06 bf 93 ac 1f 01 68 ac 1f .f..@........h.. 0020 01 65 07 ee 01 85 54 aa 03 de 19 95 33 4c 50 18 .e....T.....3LP. 0030 fa f0 46 d5 00 00 00 00 00 3a 60 38 06 09 2a 86 ..F......:`8..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff c1 H............... 0050 fc c8 63 b3 b2 70 3f 78 e0 68 f4 d0 b1 b8 ea b0 ..c..p?x.h...... 0060 b2 f7 a6 4e 57 48 8e 2f 8c 54 f8 91 43 85 fc 01 ...NWH./.T..C... 0070 3d 8a 89 a0 =... No. Time Source Destination Protocol Info 100 61.861815 172.31.1.104 172.31.1.101 TCP device2 > ldap [FIN, ACK] Seq=1986 Ack=1568 Win=64240 Len=0 Frame 100 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1986, Ack: 1568, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df f3 40 00 80 06 bf d0 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 ee 01 85 54 aa 04 1c 19 95 33 4c 50 11 .e....T.....3LP. 0030 fa f0 aa bc 00 00 ac 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 101 61.861877 172.31.1.101 172.31.1.104 TCP ldap > device2 [FIN, ACK] Seq=1568 Ack=1986 Win=63719 Len=0 Frame 101 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 1568, Ack: 1986, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2d e7 40 00 80 06 71 dd ac 1f 01 65 ac 1f .(-.@...q....e.. 0020 01 68 01 85 07 ee 19 95 33 4c 54 aa 04 1c 50 11 .h......3LT...P. 0030 f8 e7 ac c5 00 00 05 00 00 03 10 00 ............ No. Time Source Destination Protocol Info 102 61.864095 172.31.1.101 172.31.1.104 TCP ldap > device2 [ACK] Seq=1569 Ack=1987 Win=63719 Len=0 Frame 102 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: device2 (2030), Seq: 1569, Ack: 1987, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2d e8 40 00 80 06 71 dc ac 1f 01 65 ac 1f .(-.@...q....e.. 0020 01 68 01 85 07 ee 19 95 33 4d 54 aa 04 1d 50 10 .h......3MT...P. 0030 f8 e7 ac c4 00 00 05 00 00 03 10 00 ............ No. Time Source Destination Protocol Info 103 61.865706 172.31.1.104 172.31.1.101 TCP device2 > ldap [ACK] Seq=1987 Ack=1569 Win=64240 Len=0 Frame 103 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: device2 (2030), Dst Port: ldap (389), Seq: 1987, Ack: 1569, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df f7 40 00 80 06 bf cc ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 ee 01 85 54 aa 04 1d 19 95 33 4d 50 10 .e....T.....3MP. 0030 fa f0 aa bb 00 00 ac 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 104 61.902763 172.31.1.104 172.31.1.101 DNS Standard query SRV _ldap._tcp.Standardname-des-ersten-Standorts._sites.w2k3-101.w2k3.vmnet1.vm.base Frame 104 (140 bytes on wire, 140 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: domain (53) Domain Name System (query) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 7e df fb 00 00 80 11 ff 67 ac 1f 01 68 ac 1f .~.......g...h.. 0020 01 65 04 05 00 35 00 6a c6 37 74 3f 01 00 00 01 .e...5.j.7t?.... 0030 00 00 00 00 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 08 77 32 6b 33 2d rts._sites.w2k3- 0070 31 30 31 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 101.w2k3.vmnet1. 0080 76 6d 04 62 61 73 65 00 00 21 00 01 vm.base..!.. No. Time Source Destination Protocol Info 105 61.903632 172.31.1.101 172.31.1.104 DNS Standard query response, No such name Frame 105 (214 bytes on wire, 214 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: domain (53), Dst Port: 1029 (1029) Domain Name System (response) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 c8 2d e9 00 00 80 11 b1 30 ac 1f 01 65 ac 1f ..-......0...e.. 0020 01 68 00 35 04 05 00 b4 59 e9 74 3f 85 83 00 01 .h.5....Y.t?.... 0030 00 00 00 01 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 21 53 74 61 6e 64 61 72 64 6e 61 6d 65 2d 64 p!Standardname-d 0050 65 73 2d 65 72 73 74 65 6e 2d 53 74 61 6e 64 6f es-ersten-Stando 0060 72 74 73 06 5f 73 69 74 65 73 08 77 32 6b 33 2d rts._sites.w2k3- 0070 31 30 31 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 101.w2k3.vmnet1. 0080 76 6d 04 62 61 73 65 00 00 21 00 01 04 77 32 6b vm.base..!...w2k 0090 33 06 76 6d 6e 65 74 31 02 76 6d 04 62 61 73 65 3.vmnet1.vm.base 00a0 00 00 06 00 01 00 00 0e 10 00 2b 08 77 32 6b 33 ..........+.w2k3 00b0 2d 31 30 31 c0 62 0a 68 6f 73 74 6d 61 73 74 65 -101.b.hostmaste 00c0 72 00 00 00 01 37 00 00 03 84 00 00 02 58 00 01 r....7.......X.. 00d0 51 80 00 00 0e 10 Q..... No. Time Source Destination Protocol Info 106 61.904334 172.31.1.104 172.31.1.101 DNS Standard query SRV _ldap._tcp.w2k3-101.w2k3.vmnet1.vm.base Frame 106 (99 bytes on wire, 99 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: domain (53) Domain Name System (query) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 55 df fc 00 00 80 11 ff 8f ac 1f 01 68 ac 1f .U...........h.. 0020 01 65 04 05 00 35 00 41 ac f1 cc 3e 01 00 00 01 .e...5.A...>.... 0030 00 00 00 00 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 08 77 32 6b 33 2d 31 30 31 04 77 32 6b 33 06 p.w2k3-101.w2k3. 0050 76 6d 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 vmnet1.vm.base.. 0060 21 00 01 !.. No. Time Source Destination Protocol Info 107 61.904846 172.31.1.101 172.31.1.104 DNS Standard query response, No such name Frame 107 (173 bytes on wire, 173 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: domain (53), Dst Port: 1029 (1029) Domain Name System (response) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 9f 2d ea 00 00 80 11 b1 58 ac 1f 01 65 ac 1f ..-......X...e.. 0020 01 68 00 35 04 05 00 8b 1a f2 cc 3e 85 83 00 01 .h.5.......>.... 0030 00 00 00 01 00 00 05 5f 6c 64 61 70 04 5f 74 63 ......._ldap._tc 0040 70 08 77 32 6b 33 2d 31 30 31 04 77 32 6b 33 06 p.w2k3-101.w2k3. 0050 76 6d 6e 65 74 31 02 76 6d 04 62 61 73 65 00 00 vmnet1.vm.base.. 0060 21 00 01 04 77 32 6b 33 06 76 6d 6e 65 74 31 02 !...w2k3.vmnet1. 0070 76 6d 04 62 61 73 65 00 00 06 00 01 00 00 0e 10 vm.base......... 0080 00 2b 08 77 32 6b 33 2d 31 30 31 c0 39 0a 68 6f .+.w2k3-101.9.ho 0090 73 74 6d 61 73 74 65 72 00 00 00 01 37 00 00 03 stmaster....7... 00a0 84 00 00 02 58 00 01 51 80 00 00 0e 10 ....X..Q..... No. Time Source Destination Protocol Info 108 61.906731 172.31.1.104 172.31.1.101 TCP blackboard > ldap [SYN] Seq=0 Ack=0 Win=64240 Len=0 MSS=1460 Frame 108 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 0, Ack: 0, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 30 df fd 40 00 80 06 bf be ac 1f 01 68 ac 1f .0..@........h.. 0020 01 65 07 f0 01 85 d3 1c 06 d0 00 00 00 00 70 02 .e............p. 0030 fa f0 49 c1 00 00 02 04 05 b4 01 01 04 02 ..I........... No. Time Source Destination Protocol Info 109 61.907072 172.31.1.101 172.31.1.104 TCP ldap > blackboard [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 Frame 109 (62 bytes on wire, 62 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 0, Ack: 1, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 30 2d eb 40 00 80 06 71 d1 ac 1f 01 65 ac 1f .0-.@...q....e.. 0020 01 68 01 85 07 f0 0b 68 53 7d d3 1c 06 d1 70 12 .h.....hS}....p. 0030 fa f0 ea ca 00 00 02 04 05 b4 01 01 04 02 .............. No. Time Source Destination Protocol Info 110 61.907356 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=1 Ack=1 Win=64240 Len=0 Frame 110 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 df fe 40 00 80 06 bf c5 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 06 d1 0b 68 53 7e 50 10 .e.........hS~P. 0030 fa f0 17 8f 00 00 00 00 20 46 48 44 ........ FHD No. Time Source Destination Protocol Info 111 61.915292 172.31.1.104 172.31.1.101 LDAP MsgId=237 Bind Request, DN=(null) Frame 111 (1394 bytes on wire, 1394 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1, Ack: 1, Len: 1340 Lightweight Directory Access Protocol, Bind Request Message Id: 237 Message Type: Bind Request (0x00) Message Length: 1324 Response In: 112 Version: 3 DN: (null) Auth Type: SASL (0x03) Mechanism: GSS-SPNEGO GSS-API Token GSS-API OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation) SPNEGO negTokenInit mechType mechToken krb5_blob: 608204CB06092A864886F71201020201006E8204BA308204... OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_tok_id: KRB5_AP_REQ (0x0001) Kerberos AP-REQ Pvno: 5 MSG Type: AP-REQ (14) Padding: 0 APOptions: 20000000 (Mutual required) Ticket Authenticator rc4-hmac Encryption type: rc4-hmac (23) Authenticator data: 4ECBB7161A32C80A4DE199FBAFF5B22A025E259A510DDE04... [Decrypted using: key learnt from frame 111] Authenticator Authenticator vno: 5 Client Realm: SUB1.W2K3.VMNET1.VM.BASE Client Name (Principal): Administrator Checksum cusec: 616676 ctime: 2005-03-06 09:09:43 (Z) Subkey rc4-hmac Key type: rc4-hmac (23) Key value: 2D0C896F0D62AD28703DEB241D3A47DA Seq Number: 1034260900 Frame (1394 bytes): 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 05 64 df ff 40 00 80 06 ba 88 ac 1f 01 68 ac 1f .d..@........h.. 0020 01 65 07 f0 01 85 d3 1c 06 d1 0b 68 53 7e 50 18 .e.........hS~P. 0030 fa f0 e6 ad 00 00 30 84 00 00 05 36 02 02 00 ed ......0....6.... 0040 60 84 00 00 05 2c 02 01 03 04 00 a3 84 00 00 05 `....,.......... 0050 21 04 0a 47 53 53 2d 53 50 4e 45 47 4f 04 82 05 !..GSS-SPNEGO... 0060 11 60 82 05 0d 06 06 2b 06 01 05 05 02 a0 82 05 .`.....+........ 0070 01 30 82 04 fd a0 24 30 22 06 09 2a 86 48 82 f7 .0....$0"..*.H.. 0080 12 01 02 02 06 09 2a 86 48 86 f7 12 01 02 02 06 ......*.H....... 0090 0a 2b 06 01 04 01 82 37 02 02 0a a2 82 04 d3 04 .+.....7........ 00a0 82 04 cf 60 82 04 cb 06 09 2a 86 48 86 f7 12 01 ...`.....*.H.... 00b0 02 02 01 00 6e 82 04 ba 30 82 04 b6 a0 03 02 01 ....n...0....... 00c0 05 a1 03 02 01 0e a2 07 03 05 00 20 00 00 00 a3 ........... .... 00d0 82 03 cd 61 82 03 c9 30 82 03 c5 a0 03 02 01 05 ...a...0........ 00e0 a1 15 1b 13 57 32 4b 33 2e 56 4d 4e 45 54 31 2e ....W2K3.VMNET1. 00f0 56 4d 2e 42 41 53 45 a2 2f 30 2d a0 03 02 01 02 VM.BASE./0-..... 0100 a1 26 30 24 1b 04 6c 64 61 70 1b 1c 77 32 6b 33 .&0$..ldap..w2k3 0110 2d 31 30 31 2e 77 32 6b 33 2e 76 6d 6e 65 74 31 -101.w2k3.vmnet1 0120 2e 76 6d 2e 62 61 73 65 a3 82 03 74 30 82 03 70 .vm.base...t0..p 0130 a0 03 02 01 17 a1 03 02 01 0a a2 82 03 62 04 82 .............b.. 0140 03 5e ec d4 c6 6c f8 b2 98 f1 07 3f f9 49 75 b6 .^...l.....?.Iu. 0150 7a f0 ea fe f3 09 0e 96 89 07 b9 a4 1b 1a 0d 3f z..............? 0160 6e d6 e0 48 fe c8 84 09 9f 04 c8 ce 03 b8 75 1d n..H..........u. 0170 1a 31 6b ad 8d 14 cd de 50 ac 3a 20 b1 9c 77 cf .1k.....P.: ..w. 0180 d8 a3 16 e2 29 40 54 95 78 7c 72 ab e8 c3 cc 1d ....)@T.x|r..... 0190 09 b3 c1 8e ec f0 2c 35 36 51 c6 93 14 3f 3a 5f ......,56Q...?:_ 01a0 0d f3 61 a2 9a a5 82 f8 fd 4d 63 9b 9f 3d bc ac ..a......Mc..=.. 01b0 13 f8 3e a1 40 d1 f1 ba 24 a7 5f f2 b6 4b 0e af ..>.@...$._..K.. 01c0 c7 0b 4a 99 3c ab c6 91 9a 78 c0 86 4e d3 3b 96 ..J.<....x..N.;. 01d0 44 7c a8 23 a6 01 bb 76 90 d9 af f1 ef c5 64 b6 D|.#...v......d. 01e0 94 1b 9d 1e dd b6 ce ee f5 1b e6 d1 aa 16 d7 d6 ................ 01f0 a9 2c 4a ee 8f dd 0e 11 c8 7b d9 cb 4f e6 e7 0b .,J......{..O... 0200 54 b6 84 40 ca 2e 29 45 c7 b9 cd 66 42 a7 2d d5 T..@..)E...fB.-. 0210 8e 07 5b 2f ef 11 21 10 a6 23 60 3b 94 24 03 28 ..[/..!..#`;.$.( 0220 3a 3d 6d ac f9 32 32 7a 7b 89 8c 71 d4 09 d1 6f :=m..22z{..q...o 0230 ab 36 5e fb 28 62 d1 9d fb f2 8f de be e1 6c 74 .6^.(b........lt 0240 98 1c 92 5e 3d 97 28 a7 97 30 6b e3 f1 5e 40 0c ...^=.(..0k..^@. 0250 77 33 bb ef 68 8f be 39 8c 8f b3 e1 17 09 c1 69 w3..h..9.......i 0260 95 29 8f 4b f4 0f 3c f5 e0 91 8c 1c 96 4b 51 02 .).K..<......KQ. 0270 39 30 92 2c ea c2 d7 40 0a 58 04 0a 60 98 dd 85 90.,...@.X..`... 0280 b9 c5 82 ef 84 d4 15 55 0e a9 22 64 a8 32 c3 31 .......U.."d.2.1 0290 d8 a2 33 bf f8 fd e3 52 18 67 c0 76 35 1d 87 c5 ..3....R.g.v5... 02a0 35 29 d4 70 2e cf 1d 69 2d 77 c8 d6 f4 d5 34 c3 5).p...i-w....4. 02b0 a9 09 1f 1a fb ad c5 e0 53 36 6b 4a 45 22 36 5d ........S6kJE"6] 02c0 35 60 70 86 a1 0f a6 b2 53 86 e0 f1 08 5f 33 8b 5`p.....S...._3. 02d0 9a ee 15 cd 6e b9 ad a5 2f 94 4f f5 fa 3b 17 27 ....n.../.O..;.' 02e0 8c 92 44 ee ae f0 0d 0a e2 db df ca 8f 06 fc 1b ..D............. 02f0 88 5b d9 b1 61 dc 53 58 7e 9b 2a f7 29 67 06 2d .[..a.SX~.*.)g.- 0300 34 d4 47 3b c0 16 79 79 b8 ca a8 5c 51 73 be 45 4.G;..yy...\Qs.E 0310 9e 10 89 e5 7b d8 5a 54 c5 32 81 05 c4 c7 25 2f ....{.ZT.2....%/ 0320 91 d6 ed 3a 8d b0 74 ca bf 60 4e ee f3 70 47 d3 ...:..t..`N..pG. 0330 86 82 31 90 4a 49 f7 fc e5 ee c6 10 a5 04 19 d8 ..1.JI.......... 0340 39 af ca fb 5f c1 6d 5e 1f 80 8e 93 86 18 a5 9a 9..._.m^........ 0350 79 f2 0b 42 86 e5 8e 46 e0 a8 e1 0d b1 0b c8 3e y..B...F.......> 0360 62 f7 4e 51 01 41 a3 9e 95 96 39 7c de 6c 4f 2d b.NQ.A....9|.lO- 0370 9a 63 7e b7 a4 92 c4 2b 89 0b 85 d7 c2 5e e6 3d .c~....+.....^.= 0380 a1 a4 8c 61 77 4b 83 8f 28 17 f1 35 fc 56 0e 09 ...awK..(..5.V.. 0390 c9 ce c5 59 09 7f 83 5b be 0e 42 75 77 58 c5 35 ...Y...[..BuwX.5 03a0 49 d2 c8 dc 10 e7 82 57 90 96 82 d0 0b 14 a1 b0 I......W........ 03b0 75 95 9f 4c da f3 99 a7 14 00 f4 85 10 13 2c d7 u..L..........,. 03c0 8a 01 91 2b ce 61 ed 5e 56 38 df 69 cf be 32 e6 ...+.a.^V8.i..2. 03d0 86 ba 3e 35 56 38 ac 5c b1 20 75 86 aa b8 5b 53 ..>5V8.\. u...[S 03e0 4b 02 0b c4 7b dd df 02 28 ba d9 29 f7 f7 c8 bb K...{...(..).... 03f0 64 22 ba 48 a0 e1 08 33 f1 fd 4a 5f d5 e6 59 e9 d".H...3..J_..Y. 0400 84 e1 43 39 64 ad ce 97 f1 0d 1e 01 13 67 e1 a3 ..C9d........g.. 0410 60 bd bd 32 94 be e5 b2 14 08 b4 ca 0f 0a c2 72 `..2...........r 0420 4e e8 7d e8 b9 81 e8 42 a3 90 fe 99 52 71 70 e8 N.}....B....Rqp. 0430 8e f1 7d 12 c3 a2 66 f7 b6 ea 18 f9 45 7d 1c 7b ..}...f.....E}.{ 0440 62 5f 79 ff cd 0d 59 34 68 f8 15 af cd e8 69 ec b_y...Y4h.....i. 0450 f5 64 56 70 8b 70 05 0a b1 c9 ee b7 16 63 0d 6c .dVp.p.......c.l 0460 50 3c 98 cb 89 30 1e 3e 35 7c f3 7d f5 4d 26 bd P<...0.>5|.}.M&. 0470 6e ee af 28 1c 98 be 15 3d 45 58 fb f7 cb 57 9a n..(....=EX...W. 0480 8a 1c d4 e8 16 4e 54 1c 84 dc 8b 45 6b 61 fb 8f .....NT....Eka.. 0490 23 75 8a 27 0c a1 85 bc 8f c2 04 21 72 1d b8 80 #u.'.......!r... 04a0 a4 81 cf 30 81 cc a0 03 02 01 17 a2 81 c4 04 81 ...0............ 04b0 c1 4e cb b7 16 1a 32 c8 0a 4d e1 99 fb af f5 b2 .N....2..M...... 04c0 2a 02 5e 25 9a 51 0d de 04 d3 22 a7 1a 12 c2 a9 *.^%.Q...."..... 04d0 0c 21 c4 26 68 8e 30 15 f2 43 5f 37 40 cc 8b e9 .!.&h.0..C_7@... 04e0 a3 64 40 ba 1d d6 91 ca 62 c3 28 6d ad 9c 4c 01 .d@.....b.(m..L. 04f0 2d 6e e7 d1 ba d3 f6 de d0 30 c1 36 b3 42 0e b0 -n.......0.6.B.. 0500 96 f5 34 39 97 79 06 2a 77 f9 46 f5 11 51 8c a3 ..49.y.*w.F..Q.. 0510 0d 54 37 eb 71 4d f2 dd 61 c3 12 25 33 27 00 ba .T7.qM..a..%3'.. 0520 1b 6f 7b a8 e2 5a 04 cb 82 25 3b 06 57 69 4e 95 .o{..Z...%;.WiN. 0530 e2 cb 0e 44 45 3c 5a 7a ac 85 bf 89 06 6f b3 f6 ...DE.....@.. 0010 00 a1 1b 30 19 a0 03 02 01 17 a1 12 04 10 30 71 ...0..........0q 0020 38 02 d7 fa d7 21 dc 0e 16 9d 26 52 b5 ef a2 1a 8....!....&R.... 0030 1b 18 53 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 ..SUB1.W2K3.VMNE 0040 54 31 2e 56 4d 2e 42 41 53 45 a3 1a 30 18 a0 03 T1.VM.BASE..0... 0050 02 01 01 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 .....0...Adminis 0060 74 72 61 74 6f 72 a4 0b 30 09 a0 03 02 01 01 a1 trator..0....... 0070 02 04 00 a5 11 18 0f 32 30 30 35 30 33 30 36 30 .......200503060 0080 39 30 38 33 35 5a a6 11 18 0f 32 30 30 35 30 33 90835Z....200503 0090 30 36 30 39 30 39 34 33 5a a7 11 18 0f 32 30 30 06090943Z....200 00a0 35 30 33 30 36 31 39 30 38 33 35 5a a8 11 18 0f 50306190835Z.... 00b0 32 30 30 35 30 33 31 33 30 39 30 38 33 35 5a aa 20050313090835Z. 00c0 82 02 83 30 82 02 7f 30 82 02 7b a0 03 02 01 01 ...0...0..{..... 00d0 a1 82 02 72 04 82 02 6e 30 82 02 6a 30 82 02 66 ...r...n0..j0..f 00e0 a0 04 02 02 00 80 a1 82 02 5c 04 82 02 58 04 00 .........\...X.. 00f0 00 00 00 00 00 00 01 00 00 00 b8 01 00 00 48 00 ..............H. 0100 00 00 00 00 00 00 0a 00 00 00 24 00 00 00 00 02 ..........$..... 0110 00 00 00 00 00 00 06 00 00 00 14 00 00 00 28 02 ..............(. 0120 00 00 00 00 00 00 07 00 00 00 14 00 00 00 40 02 ..............@. 0130 00 00 00 00 00 00 01 10 08 00 cc cc cc cc a8 01 ................ 0140 00 00 00 00 00 00 00 00 02 00 12 96 28 c4 6c 12 ............(.l. 0150 c5 01 ff ff ff ff ff ff ff 7f ff ff ff ff ff ff ................ 0160 ff 7f ae 05 77 89 40 72 c4 01 ae c5 e0 b3 09 73 ....w.@r.......s 0170 c4 01 ff ff ff ff ff ff ff 7f 1a 00 1a 00 04 00 ................ 0180 02 00 00 00 00 00 08 00 02 00 00 00 00 00 0c 00 ................ 0190 02 00 00 00 00 00 10 00 02 00 00 00 00 00 14 00 ................ 01a0 02 00 00 00 00 00 18 00 02 00 0f 00 00 00 f4 01 ................ 01b0 00 00 01 02 00 00 03 00 00 00 1c 00 02 00 20 00 .............. . 01c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01d0 00 00 10 00 12 00 20 00 02 00 08 00 0a 00 24 00 ...... .......$. 01e0 02 00 28 00 02 00 00 00 00 00 00 00 00 00 10 02 ..(............. 01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0220 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 41 00 ..............A. 0230 64 00 6d 00 69 00 6e 00 69 00 73 00 74 00 72 00 d.m.i.n.i.s.t.r. 0240 61 00 74 00 6f 00 72 00 00 00 00 00 00 00 00 00 a.t.o.r......... 0250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0280 00 00 00 00 00 00 03 00 00 00 00 02 00 00 07 00 ................ 0290 00 00 08 02 00 00 07 00 00 00 01 02 00 00 07 00 ................ 02a0 00 00 09 00 00 00 00 00 00 00 08 00 00 00 57 00 ..............W. 02b0 32 00 4b 00 33 00 2d 00 31 00 30 00 34 00 05 00 2.K.3.-.1.0.4... 02c0 00 00 00 00 00 00 04 00 00 00 53 00 55 00 42 00 ..........S.U.B. 02d0 31 00 04 00 00 00 01 04 00 00 00 00 00 05 15 00 1............... 02e0 00 00 39 15 ce fd e9 c3 37 9b 6f 15 38 1a 80 eb ..9.....7.o.8... 02f0 70 13 2c 22 c5 01 1a 00 41 00 64 00 6d 00 69 00 p.,"....A.d.m.i. 0300 6e 00 69 00 73 00 74 00 72 00 61 00 74 00 6f 00 n.i.s.t.r.a.t.o. 0310 72 00 00 00 00 00 76 ff ff ff d5 af 37 d7 1b 7e r.....v.....7..~ 0320 3b 3d db 15 2c 67 5b 6e 8f fe 00 00 00 00 76 ff ;=..,g[n......v. 0330 ff ff 19 01 28 c4 3c 29 04 39 1f 56 1a 2f 0e a0 ....(.<).9.V./.. 0340 e5 78 00 00 00 00 76 ff ff ff 19 01 81 00 00 00 .x....v......... 0350 48 b0 5f 08 40 58 1b 41 e5 78 00 00 00 00 H._.@X.A.x.... Decrypted Krb5 (193 bytes): 0000 62 81 a6 30 81 a3 a0 03 02 01 05 a1 1a 1b 18 53 b..0...........S 0010 55 42 31 2e 57 32 4b 33 2e 56 4d 4e 45 54 31 2e UB1.W2K3.VMNET1. 0020 56 4d 2e 42 41 53 45 a2 1a 30 18 a0 03 02 01 01 VM.BASE..0...... 0030 a1 11 30 0f 1b 0d 41 64 6d 69 6e 69 73 74 72 61 ..0...Administra 0040 74 6f 72 a3 25 30 23 a0 05 02 03 00 80 03 a1 1a tor.%0#......... 0050 04 18 10 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0060 00 00 00 00 00 00 3e 40 00 00 a4 05 02 03 09 68 ......>@.......h 0070 e4 a5 11 18 0f 32 30 30 35 30 33 30 36 30 39 30 .....20050306090 0080 39 34 33 5a a6 1b 30 19 a0 03 02 01 17 a1 12 04 943Z..0......... 0090 10 2d 0c 89 6f 0d 62 ad 28 70 3d eb 24 1d 3a 47 .-..o.b.(p=.$.:G 00a0 da a7 06 02 04 3d a5 91 a4 2d 0c 89 39 00 00 00 .....=...-..9... 00b0 65 74 68 3a 69 70 3a 74 63 70 3a 6c 64 61 70 3a eth:ip:tcp:ldap: 00c0 67 g No. Time Source Destination Protocol Info 112 61.917714 172.31.1.101 172.31.1.104 LDAP MsgId=237 Bind Result Frame 112 (245 bytes on wire, 245 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 1, Ack: 1341, Len: 191 Lightweight Directory Access Protocol, Bind Result Message Id: 237 Message Type: Bind Result (0x01) Message Length: 175 Response To: 111 Time: 0.002422000 seconds Result Code: success (0x00) Matched DN: (null) Error Message: (null) GSS-API Token GSS-API SPNEGO negTokenTarg Frame (245 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 e7 2d ec 40 00 80 06 71 19 ac 1f 01 65 ac 1f ..-.@...q....e.. 0020 01 68 01 85 07 f0 0b 68 53 7e d3 1c 0c 0d 50 18 .h.....hS~....P. 0030 f5 b4 84 c3 00 00 30 84 00 00 00 b9 02 02 00 ed ......0......... 0040 61 84 00 00 00 af 0a 01 00 04 00 04 00 87 82 00 a............... 0050 a4 a1 81 a1 30 81 9e a0 03 0a 01 00 a1 0b 06 09 ....0........... 0060 2a 86 48 82 f7 12 01 02 02 a2 81 89 04 81 86 60 *.H............` 0070 81 83 06 09 2a 86 48 86 f7 12 01 02 02 02 00 6f ....*.H........o 0080 74 30 72 a0 03 02 01 05 a1 03 02 01 0f a2 66 30 t0r...........f0 0090 64 a0 03 02 01 17 a2 5d 04 5b 2e 4d 14 05 37 5d d......].[.M..7] 00a0 8b 85 09 c1 a8 34 81 df 66 a6 7d 4c 33 af d4 81 .....4..f.}L3... 00b0 c2 b4 b2 0c 78 b7 18 8f 61 dd 1a 64 96 ae 9c 03 ....x...a..d.... 00c0 13 7f 92 77 d3 27 59 a5 e6 ee a6 bb 22 85 57 b3 ...w.'Y.....".W. 00d0 7c 8a 5f ec 8a 5a bc 1b ef 41 f7 f5 7b 87 9c 96 |._..Z...A..{... 00e0 1c 5a 6b 13 f7 65 29 72 22 2a 5d 5a da 4d f5 52 .Zk..e)r"*]Z.M.R 00f0 9e ce 4c d8 92 ..L.. Decrypted Krb5 (91 bytes): 0000 7b 41 30 3f a0 11 18 0f 32 30 30 35 30 33 30 36 {A0?....20050306 0010 30 39 30 39 34 33 5a a1 05 02 03 09 68 e4 a2 1b 090943Z.....h... 0020 30 19 a0 03 02 01 17 a1 12 04 10 2d 0c 89 6f 0d 0..........-..o. 0030 62 ad 28 70 3d eb 24 1d 3a 47 da a3 06 02 04 3d b.(p=.$.:G.....= 0040 ad 84 bd 2d 21 00 00 00 44 65 63 72 79 70 74 65 ...-!...Decrypte 0050 64 20 4b 72 62 35 20 28 39 31 20 d Krb5 (91 No. Time Source Destination Protocol Info 113 61.921101 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 113 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1341, Ack: 192, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFA8A5FCE9197BA5749552C02AAEEE101A... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: A8A5FCE9197BA574 krb5_sgn_cksum: 9552C02AAEEE101A krb5_confounder: E5B0D6BE11EA3BA7 GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 00 40 00 80 06 bf 30 ac 1f 01 68 ac 1f ....@....0...h.. 0020 01 65 07 f0 01 85 d3 1c 0c 0d 0b 68 54 3d 50 18 .e.........hT=P. 0030 fa 31 77 6c 00 00 00 00 00 8f 60 81 8c 06 09 2a .1wl......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 a8 a5 fc e9 19 7b a5 74 95 52 c0 2a ae ee 10 1a .....{.t.R.*.... 0060 e5 b0 d6 be 11 ea 3b a7 9a 95 d3 ef ec 9b b2 17 ......;......... 0070 e0 f5 66 97 ba 39 4b 5b c0 b6 04 1c 18 af 55 9a ..f..9K[......U. 0080 78 42 e1 87 b9 93 7c 31 83 af 7a fd 09 7f de 87 xB....|1..z..... 0090 2d c2 6f 85 bd 14 5a b3 51 d2 32 a9 c4 a4 73 2f -.o...Z.Q.2...s/ 00a0 59 bd 7a ce 49 6f 01 06 1e 6f 4b 2c a9 4b 2a 0e Y.z.Io...oK,.K*. 00b0 aa 09 12 7f 38 86 44 ef d4 f6 bc 95 2f 2e 10 05 ....8.D...../... 00c0 85 5e fa e6 f2 c9 2a e1 63 .^....*.c No. Time Source Destination Protocol Info 114 61.921941 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 114 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 192, Ack: 1488, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF343061B951D2E6F8B703FDF5310ADC1C... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 343061B951D2E6F8 krb5_sgn_cksum: B703FDF5310ADC1C krb5_confounder: 5B25D3AC21F290E0 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d ed 40 00 80 06 71 25 ac 1f 01 65 ac 1f ..-.@...q%...e.. 0020 01 68 01 85 07 f0 0b 68 54 3d d3 1c 0c a0 50 18 .h.....hT=....P. 0030 fa f0 92 e1 00 00 00 00 00 ae 60 81 ab 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 34 30 61 b9 51 d2 e6 f8 b7 03 fd f5 31 0a dc 1c 40a.Q.......1... 0060 5b 25 d3 ac 21 f2 90 e0 fd f5 96 86 8c 84 11 a6 [%..!........... 0070 48 1a e2 e9 74 85 84 cf 8c 3e 34 8a 07 f5 4d 9a H...t....>4...M. 0080 e6 60 ea 35 cd d4 7d 42 e2 a1 9e c2 31 b9 f1 9a .`.5..}B....1... 0090 6f 3c 1e c8 cd 5a 74 00 3f e2 f9 df cd a2 86 68 o<...Zt.?......h 00a0 20 c7 cd f5 97 11 37 e9 4d 6f 04 d1 c8 10 d2 01 .....7.Mo...... 00b0 12 84 4e a6 e3 aa 50 16 fb aa f0 14 2a e2 10 89 ..N...P.....*... 00c0 76 15 bb 02 ec 8c da 7f 45 5d 48 f6 4c 92 07 24 v.......E]H.L..$ 00d0 76 13 35 03 74 d5 c0 50 43 49 59 75 b3 c0 49 16 v.5.t..PCIYu..I. 00e0 50 56 0f e1 02 86 09 7a PV.....z No. Time Source Destination Protocol Info 115 61.923011 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (261 bytes) Frame 115 (366 bytes on wire, 366 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1488, Ack: 370, Len: 312 Lightweight Directory Access Protocol SASL Buffer Length: 308 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF67B4C9FB500CBD466C6FFAFD92560A91... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 67B4C9FB500CBD46 krb5_sgn_cksum: 6C6FFAFD92560A91 krb5_confounder: 18B5B5712682E014 GSS-API Encrypted payload (261 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 60 e0 01 40 00 80 06 be 8a ac 1f 01 68 ac 1f .`..@........h.. 0020 01 65 07 f0 01 85 d3 1c 0c a0 0b 68 54 ef 50 18 .e.........hT.P. 0030 f9 7f c7 81 00 00 00 00 01 34 60 82 01 30 06 09 .........4`..0.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 67 b4 c9 fb 50 0c bd 46 6c 6f fa fd 92 56 0a .g...P..Flo...V. 0060 91 18 b5 b5 71 26 82 e0 14 85 d5 67 0d c9 28 b3 ....q&.....g..(. 0070 63 63 73 a1 34 37 ef 1c cc a3 18 1b 67 2f c9 e3 ccs.47......g/.. 0080 63 3f 4d 9a 6c d0 fb 3c ab d9 79 e7 36 73 a3 b1 c?M.l..<..y.6s.. 0090 da bc 1e 59 94 0f 4f c7 af 85 a4 20 65 b7 ab d1 ...Y..O.... e... 00a0 89 6b f1 95 44 b0 dd 09 f9 85 a7 ae 90 6a c5 04 .k..D........j.. 00b0 55 78 d9 53 74 2d f8 a6 88 1c 44 16 fc 28 21 2a Ux.St-....D..(!* 00c0 a2 62 4f 56 39 a3 66 c6 4b 44 b8 97 49 b5 62 97 .bOV9.f.KD..I.b. 00d0 43 7e 48 e5 a1 b5 ab d8 1f 8f 4b 0b e1 8d dd 9b C~H.......K..... 00e0 7a a4 00 1a 6a 18 6b 26 bf ea c0 5d 1a 43 87 7c z...j.k&...].C.| 00f0 c2 0a 00 b9 0c aa 50 d8 23 f6 b3 60 7f 28 1c d6 ......P.#..`.(.. 0100 f0 fa 66 34 2b 46 56 b8 e9 85 1b 1b 6c ef 07 36 ..f4+FV.....l..6 0110 59 4b b8 56 18 b3 e9 60 f9 47 c8 ed d1 1c de 81 YK.V...`.G...... 0120 23 74 bc 3d 67 3c 46 13 02 bc 86 3d 8c 56 a7 3e #t.=g 0130 f2 58 d8 86 98 74 2a 7f 5d d1 7d 75 a9 1e ab b1 .X...t*.].}u.... 0140 19 33 0a cd df d7 c0 ac 79 78 dc 21 b9 94 3b 54 .3......yx.!..;T 0150 78 b1 86 6f df f4 90 9c c1 a1 a5 8f 72 d8 08 9b x..o........r... 0160 9b 39 58 ba dc 49 26 18 2d 6a 17 28 04 cb .9X..I&.-j.(.. No. Time Source Destination Protocol Info 116 61.924971 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (239 bytes) Frame 116 (344 bytes on wire, 344 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 370, Ack: 1800, Len: 290 Lightweight Directory Access Protocol SASL Buffer Length: 286 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF43134EFC8920E6E6C4D2054ECEF9D493... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 43134EFC8920E6E6 krb5_sgn_cksum: C4D2054ECEF9D493 krb5_confounder: 9C0FEDE9BEAC1318 GSS-API Encrypted payload (239 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 4a 2d ee 40 00 80 06 70 b4 ac 1f 01 65 ac 1f .J-.@...p....e.. 0020 01 68 01 85 07 f0 0b 68 54 ef d3 1c 0d d8 50 18 .h.....hT.....P. 0030 f9 b8 4b 5d 00 00 00 00 01 1e 60 82 01 1a 06 09 ..K]......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 43 13 4e fc 89 20 e6 e6 c4 d2 05 4e ce f9 d4 .C.N.. .....N... 0060 93 9c 0f ed e9 be ac 13 18 89 57 87 df bb 6c c9 ..........W...l. 0070 b6 3f a7 89 46 f8 48 46 fd 70 ff c8 51 6f d5 ee .?..F.HF.p..Qo.. 0080 c6 fb 77 c9 3a 0e 5d 3c 24 33 6a 73 bc 19 bb e0 ..w.:.]<$3js.... 0090 78 fc 82 b8 6f 7e 0b cc 3b 44 b3 b3 31 df ba fe x...o~..;D..1... 00a0 cf a4 d8 b1 53 a2 c8 b1 1e 1c 3a 04 04 d6 18 dd ....S.....:..... 00b0 b7 95 e1 4e 76 e2 24 c2 22 bd 05 f8 ed c8 68 23 ...Nv.$.".....h# 00c0 03 65 ef c7 e8 51 6d 61 19 b2 0c e5 e3 ec 5e 1d .e...Qma......^. 00d0 ad 35 11 5c 25 97 fb 63 95 85 e8 d0 21 6a bc c2 .5.\%..c....!j.. 00e0 f2 40 dc ba 93 2f 4e d0 8e 38 af 51 d4 1e 1c fe .@.../N..8.Q.... 00f0 b1 ef 6f 59 76 4c 90 64 08 35 5c 94 d3 1a cb 13 ..oYvL.d.5\..... 0100 19 7b 3c 82 f1 cc a5 78 cc 56 81 5e a8 1c 29 b9 .{<....x.V.^..). 0110 eb 58 fc 0f 6f d0 19 9f 00 8e f7 dd 3d 3a f0 79 .X..o.......=:.y 0120 e8 9e 05 50 f8 14 de ee df 11 3d ba 69 6a cc 69 ...P......=.ij.i 0130 ae 73 ee 77 7c 36 b8 5d c6 eb 41 64 c9 98 00 7f .s.w|6.]..Ad.... 0140 62 b8 ab 6b 00 c5 fb b4 e8 a6 f7 a8 18 51 bd 6a b..k.........Q.j 0150 fa 6a bb 22 ec dd db 11 .j.".... No. Time Source Destination Protocol Info 117 61.931287 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 117 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1800, Ack: 660, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6F2D6787D870B0CB43D91490EA8E4101... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6F2D6787D870B0CB krb5_sgn_cksum: 43D91490EA8E4101 krb5_confounder: ED501511DB3CB6B9 GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 02 40 00 80 06 bf 2e ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 0d d8 0b 68 56 11 50 18 .e.........hV.P. 0030 f8 5d 0a 58 00 00 00 00 00 8f 60 81 8c 06 09 2a .].X......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 6f 2d 67 87 d8 70 b0 cb 43 d9 14 90 ea 8e 41 01 o-g..p..C.....A. 0060 ed 50 15 11 db 3c b6 b9 3b 27 d8 f8 5c 0c 57 8d .P...<..;'..\.W. 0070 9f cc 2e 4a 54 70 d1 db 14 7c 9e c0 75 59 d7 67 ...JTp...|..uY.g 0080 9d e1 7b cf b7 70 84 9d 13 87 a8 1d 9b 24 af 4f ..{..p.......$.O 0090 60 5e f9 b7 41 9b 3c d4 3e 65 52 9b 35 8c b2 12 `^..A.<.>eR.5... 00a0 7c e6 aa 21 16 03 5d 91 ad 85 64 9c 7c e8 99 2c |..!..]...d.|.., 00b0 f0 3c f1 32 1d 94 36 53 cb ac b5 39 f4 ba 18 42 .<.2..6S...9...B 00c0 0b 53 76 c1 36 ba ed d5 bd .Sv.6.... No. Time Source Destination Protocol Info 118 61.932101 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 118 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 660, Ack: 1947, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFC9AB8ECCC5D36C9CAD48CC0F3940510E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: C9AB8ECCC5D36C9C krb5_sgn_cksum: AD48CC0F3940510E krb5_confounder: 40136B9ADA6D88AF GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d ef 40 00 80 06 71 23 ac 1f 01 65 ac 1f ..-.@...q#...e.. 0020 01 68 01 85 07 f0 0b 68 56 11 d3 1c 0e 6b 50 18 .h.....hV....kP. 0030 f9 25 8f 54 00 00 00 00 00 ae 60 81 ab 06 09 2a .%.T......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 c9 ab 8e cc c5 d3 6c 9c ad 48 cc 0f 39 40 51 0e ......l..H..9@Q. 0060 40 13 6b 9a da 6d 88 af 0b b0 6e 13 63 87 ce 8f @.k..m....n.c... 0070 44 fd 8e 86 6e 05 35 7a 72 4d be 1a 77 8c 42 95 D...n.5zrM..w.B. 0080 15 74 41 a9 43 02 d7 35 28 db 40 27 19 16 c9 98 .tA.C..5(.@'.... 0090 f4 e3 a5 2e 1b f2 e7 87 54 b1 d0 a7 10 aa f1 69 ........T......i 00a0 a4 f3 38 10 98 28 8b 37 2d 76 61 08 0a 0b 68 a1 ..8..(.7-va...h. 00b0 79 d1 16 ef 15 cb bf 7f d2 79 aa 05 97 33 54 33 y........y...3T3 00c0 36 33 cf 09 9c a8 28 d0 62 79 ff 8e 4c 6a 5f 4f 63....(.by..Lj_O 00d0 5c a0 4c 47 24 35 63 d3 f9 12 34 e3 3e 23 2f 27 \.LG$5c...4.>#/' 00e0 19 b4 d6 40 95 e9 fe ae ...@.... No. Time Source Destination Protocol Info 119 61.934553 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (272 bytes) Frame 119 (377 bytes on wire, 377 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 1947, Ack: 838, Len: 323 Lightweight Directory Access Protocol SASL Buffer Length: 319 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE31CDFB9F2694AADADBD6F4D742F6974... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E31CDFB9F2694AAD krb5_sgn_cksum: ADBD6F4D742F6974 krb5_confounder: AE0B0279B5A23521 GSS-API Encrypted payload (272 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 6b e0 03 40 00 80 06 be 7d ac 1f 01 68 ac 1f .k..@....}...h.. 0020 01 65 07 f0 01 85 d3 1c 0e 6b 0b 68 56 c3 50 18 .e.......k.hV.P. 0030 f7 ab ae 51 00 00 00 00 01 3f 60 82 01 3b 06 09 ...Q.....?`..;.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff e3 1c df b9 f2 69 4a ad ad bd 6f 4d 74 2f 69 ......iJ...oMt/i 0060 74 ae 0b 02 79 b5 a2 35 21 0e b9 e3 bc 9d b3 1a t...y..5!....... 0070 ae 89 8a 29 04 63 ca fc b8 50 48 a0 8e 51 a0 a8 ...).c...PH..Q.. 0080 76 91 d3 7d 7d b3 48 07 53 4d 30 ab 86 b1 66 2a v..}}.H.SM0...f* 0090 0e b6 c8 10 51 b0 95 3e 7e 4e 98 78 91 9e 36 62 ....Q..>~N.x..6b 00a0 ba 52 fc fe ca e5 14 4d 48 63 be 7d 21 ba b5 a8 .R.....MHc.}!... 00b0 90 b0 a2 36 14 b2 7e 29 01 10 b2 c5 de f4 83 b4 ...6..~)........ 00c0 d7 85 e3 d8 5d 07 b3 00 06 f2 2d ca 35 7b d0 0d ....].....-.5{.. 00d0 66 6e 42 7a 1a 9e 7c e1 d3 96 17 22 8f 1d f3 e7 fnBz..|....".... 00e0 3e ea ec a5 d0 3a 6b 8b 7b 31 af bd 9e ae ef d1 >....:k.{1...... 00f0 a1 59 b9 f3 65 90 eb e0 e7 1e 34 e5 c5 df 76 51 .Y..e.....4...vQ 0100 4d 7d 9e d2 69 62 08 c3 3a 38 c8 a2 ed 94 e4 83 M}..ib..:8...... 0110 60 25 ef f8 a4 63 e9 a5 72 c7 b0 e4 9c 96 27 02 `%...c..r.....'. 0120 3f 35 85 73 99 cb ac 51 c2 95 8d b8 2f 6a a4 c9 ?5.s...Q..../j.. 0130 bb ea 7f 8a 3c 81 de 69 8d ec e3 67 72 c2 34 c6 ....<..i...gr.4. 0140 88 73 89 b9 5b 02 80 b2 59 f9 ba 10 7a 41 ad 58 .s..[...Y...zA.X 0150 82 f0 f0 13 00 0c c0 06 00 b9 ae 9c 9f 61 03 d4 .............a.. 0160 f4 f7 5a 4e 9f 7b 58 9c fe 5b c3 66 81 67 12 24 ..ZN.{X..[.f.g.$ 0170 b9 5e 32 a1 cf 29 84 c1 d7 .^2..)... No. Time Source Destination Protocol Info 120 62.015192 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (844 bytes) Frame 120 (949 bytes on wire, 949 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 838, Ack: 2270, Len: 895 Lightweight Directory Access Protocol SASL Buffer Length: 891 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF67B656B8ED0F92BBEEEF33BA2653A806... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 67B656B8ED0F92BB krb5_sgn_cksum: EEEF33BA2653A806 krb5_confounder: ECFD826D386E01E8 GSS-API Encrypted payload (844 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 a7 2d f0 40 00 80 06 6e 55 ac 1f 01 65 ac 1f ..-.@...nU...e.. 0020 01 68 01 85 07 f0 0b 68 56 c3 d3 1c 0f ae 50 18 .h.....hV.....P. 0030 f7 e2 3c 76 00 00 00 00 03 7b 60 82 03 77 06 09 ....>.}. 0070 cb 6b 59 f4 77 cb 10 ae 55 78 dc dd 1c 06 e2 4e .kY.w...Ux.....N 0080 d6 fc f7 2e f4 6f 1d b5 35 69 de 33 45 a5 8b 58 .....o..5i.3E..X 0090 1c 5b 1b 53 60 0c b1 3e 52 f6 c3 83 ba bf 4a ec .[.S`..>R.....J. 00a0 c0 0e ac 33 d2 09 eb e4 28 de 98 41 99 02 14 e8 ...3....(..A.... 00b0 1e 6a 2a c3 cf f7 c6 20 08 ca f8 08 f9 c6 83 f2 .j*.... ........ 00c0 e2 23 56 63 21 5e d6 10 3a c9 3e 2f ac 25 25 0d .#Vc!^..:.>/.%%. 00d0 6b c6 ac 59 1f 12 6f 88 f3 16 b1 0a 21 6c 66 42 k..Y..o.....!lfB 00e0 c5 47 fd 6f 44 8b 0a b3 cb 3f af c6 39 27 d4 ef .G.oD....?..9'.. 00f0 e2 c2 bd 9b c6 62 fb c9 04 df f7 6d 22 20 73 ce .....b.....m" s. 0100 52 ea 27 1e 9e 3a 27 69 96 d7 cc 5f af 9a eb b2 R.'..:'i..._.... 0110 01 e2 88 75 7c 22 49 86 54 0e c6 83 5b 35 85 c1 ...u|"I.T...[5.. 0120 cb d0 6d 98 a0 66 a3 ef c0 a1 63 93 25 77 9c d2 ..m..f....c.%w.. 0130 69 1b 87 93 8f d0 de 08 7a 5e ed c4 f3 d9 31 7a i.......z^....1z 0140 83 09 31 ae a6 74 4f 23 71 14 a2 0d 6f ab 47 f9 ..1..tO#q...o.G. 0150 64 bf 18 2b a0 b6 da 75 ff 4b 37 6c b5 4a 43 a1 d..+...u.K7l.JC. 0160 6a 4b e6 01 5b 5c 10 56 46 3a d8 74 28 12 94 11 jK..[\.VF:.t(... 0170 8a 9d 90 c1 27 8e 57 d1 5b 72 82 a4 6d d1 97 45 ....'.W.[r..m..E 0180 fe 6d 8d cc e2 ba b7 39 1d fc 01 ad 0e 30 cf 85 .m.....9.....0.. 0190 3e 53 a0 d9 01 56 4d 6a 42 60 46 49 22 93 5e a3 >S...VMjB`FI".^. 01a0 c8 1b a5 96 25 22 e1 2e 4f 0f 73 72 9f 98 8c d9 ....%"..O.sr.... 01b0 5c e9 16 d8 02 ed 39 7a ca 55 ad bb 6a e8 3d 04 \.....9z.U..j.=. 01c0 76 b0 29 a4 30 d4 60 69 93 b1 f6 30 d8 83 2a 11 v.).0.`i...0..*. 01d0 41 0b cb 37 73 49 dd d4 ff 6e be 94 06 e3 ee 85 A..7sI...n...... 01e0 87 01 d9 2f bf e6 4b 24 c2 6e 21 7e a9 6c cc 0d .../..K$.n!~.l.. 01f0 02 75 80 73 47 0b 8e cd f7 50 2a b5 bd 70 63 9e .u.sG....P*..pc. 0200 46 7b 1d db 3d 63 bb 3c 7f b2 07 53 91 d8 7c 8e F{..=c.<...S..|. 0210 9b bf 95 0a 93 80 52 28 6a b1 87 5e c1 03 90 a5 ......R(j..^.... 0220 f3 13 9e 3c eb b6 9c 12 dc aa d4 b1 8b ef 20 a1 ...<.......... . 0230 db bd 9c b5 38 f2 0f 59 8d d8 11 83 08 59 5b 59 ....8..Y.....Y[Y 0240 f4 83 8c b7 46 e2 00 c0 e8 a3 eb 4a f0 a7 5c 37 ....F......J..\7 0250 8c db 30 80 52 10 43 de 33 55 a6 fc 34 43 ed 81 ..0.R.C.3U..4C.. 0260 80 2b 9d cc 37 85 77 42 9d b7 99 12 fa 83 c5 4b .+..7.wB.......K 0270 aa a3 4c 78 b6 17 b8 b0 ea 77 c2 39 eb 1e f9 5f ..Lx.....w.9..._ 0280 6e ae 74 59 e8 39 34 b9 3f 43 b2 2e 44 05 8f c6 n.tY.94.?C..D... 0290 01 c7 4b 1c c3 5c 04 e9 59 c2 c7 d7 3c 94 44 3e ..K..\..Y...<.D> 02a0 14 4e fd 3b b0 5e 44 5f 4d f7 9e 24 43 5f 96 d7 .N.;.^D_M..$C_.. 02b0 47 af aa 76 f2 b5 cc 61 de 48 08 1d 6f 30 2c 14 G..v...a.H..o0,. 02c0 9c b4 2a e8 7e c9 70 9c 06 4d 32 15 b8 c3 c5 45 ..*.~.p..M2....E 02d0 5d ca d0 1e 3d f0 cd fd ad 38 8e c9 2c 2f 9b 86 ]...=....8..,/.. 02e0 76 f8 13 57 33 da 19 19 bb 64 55 c5 1d 19 e4 da v..W3....dU..... 02f0 b1 cf d5 d4 f6 07 0e cd 94 9d 74 f1 56 8b 0d ff ..........t.V... 0300 4a d9 83 ee 7c 8f 69 ec 0e 75 68 7b 97 2b da 96 J...|.i..uh{.+.. 0310 18 f6 0f 49 be cd 3b 9d 60 90 90 0f 37 df 62 71 ...I..;.`...7.bq 0320 1c f9 10 df 0a 2f b7 4b 0a b5 63 b8 9d dc 0d 9e ...../.K..c..... 0330 61 9a 0f 82 07 ad 03 6b 9c d2 16 e8 33 c7 3d a1 a......k....3.=. 0340 ac ca c0 da 8a f8 2c 9f 4e e7 a0 aa a0 ca 06 3d ......,.N......= 0350 ec 75 7c ae 6b 62 31 81 e3 64 52 4d 34 48 12 9f .u|.kb1..dRM4H.. 0360 0d f5 52 37 a9 2b 9c 34 2a 53 2e 57 64 f8 91 e2 ..R7.+.4*S.Wd... 0370 e0 71 42 71 d1 1a b8 36 d1 bf f5 dd 8d 86 18 b7 .qBq...6........ 0380 95 33 09 5f 86 14 ae 9a 34 e8 11 c7 3d eb cd 1a .3._....4...=... 0390 8a d4 2c 27 17 50 37 ba 83 76 50 9c 8b 1f 13 ea ..,'.P7..vP..... 03a0 0a 2d 65 44 8f 98 cb 44 22 dc f3 bd e0 f2 4e 3e .-eD...D".....N> 03b0 09 f6 2a ce d5 ..*.. No. Time Source Destination Protocol Info 121 62.018840 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 121 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2270, Ack: 1733, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF69829707FA8C7FC890332FCA39469A2E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 69829707FA8C7FC8 krb5_sgn_cksum: 90332FCA39469A2E krb5_confounder: E9C49DBF82FAB965 GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 04 40 00 80 06 bf 59 ac 1f 01 68 ac 1f ....@....Y...h.. 0020 01 65 07 f0 01 85 d3 1c 0f ae 0b 68 5a 42 50 18 .e.........hZBP. 0030 fa f0 43 65 00 00 00 00 00 62 60 60 06 09 2a 86 ..Ce.....b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 69 H..............i 0050 82 97 07 fa 8c 7f c8 90 33 2f ca 39 46 9a 2e e9 ........3/.9F... 0060 c4 9d bf 82 fa b9 65 8a 67 ff df 46 b5 fc 3b ea ......e.g..F..;. 0070 5d ec 46 62 07 43 6d 98 b2 50 05 d9 ed 8c aa ec ].Fb.Cm..P...... 0080 3e ea 8a 36 53 6b c7 63 fa 52 7e 4d ba 63 77 1b >..6Sk.c.R~M.cw. 0090 4e 6d 1f 5a d0 62 7a 6a 7d 31 50 de Nm.Z.bzj}1P. No. Time Source Destination Protocol Info 122 62.019768 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 122 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 1733, Ack: 2372, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d f1 40 00 80 06 6c 1f ac 1f 01 65 ac 1f ..-.@...l....e.. 0020 01 68 01 85 07 f0 0b 68 5a 42 d3 1c 10 14 50 10 .h.....hZB....P. 0030 f7 7c c3 01 00 00 00 00 09 dd 60 82 09 d9 06 09 .|........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 56 b5 2b 37 57 b7 71 60 8a 22 8a 9c 4b d9 40 .V.+7W.q`."..K.@ 0060 8d 74 32 1c 7b 84 a1 b5 f2 4a 3d ab 35 df 4f 99 .t2.{....J=.5.O. 0070 75 b6 61 82 65 d3 f8 57 b6 4a a3 4a 60 bc ab dd u.a.e..W.J.J`... 0080 08 4b a2 ff 92 69 78 f2 07 a7 5c af 04 f8 6d 10 .K...ix...\...m. 0090 f8 02 be fa 5e f3 2c a6 76 55 e6 55 05 0c 77 94 ....^.,.vU.U..w. 00a0 8d 56 c6 cb 93 76 af 4e 77 d7 69 e2 a9 c9 30 b3 .V...v.Nw.i...0. 00b0 06 0e 12 70 f4 4c d8 75 2e 60 d8 48 67 fa 5f b7 ...p.L.u.`.Hg._. 00c0 a9 94 f9 f6 1c 35 3c 79 83 a2 46 5e 95 c6 2e 92 .....5.....O.1..K.. 0270 c0 86 8b 2e d3 7d b9 2d 45 35 60 c9 64 e2 23 c6 .....}.-E5`.d.#. 0280 7a d8 94 42 cd f8 84 cf f7 84 e1 a7 b2 e3 36 53 z..B..........6S 0290 64 22 d8 96 44 ae f2 4f c9 65 82 9b 89 ac 55 68 d"..D..O.e....Uh 02a0 70 20 4a 89 ae 06 1e 9a e1 80 09 30 ed d0 14 e8 p J........0.... 02b0 8b 1a 80 66 e4 5d da 38 c5 28 f9 c6 11 dc 07 93 ...f.].8.(...... 02c0 02 94 47 8a 43 a6 b3 ba 42 ac 56 ad 4d 54 2d 00 ..G.C...B.V.MT-. 02d0 87 02 d0 46 f9 f9 c0 cd bd d1 3e 9b 11 db af 4f ...F......>....O 02e0 98 62 cb 6b 42 a7 65 bd 74 40 85 93 af 92 66 6f .b.kB.e.t@....fo 02f0 ae 16 83 c1 91 7d 01 28 fd cb f4 ba b0 a8 f5 c7 .....}.(........ 0300 37 91 55 f0 90 ec 9b 80 9b e7 44 c6 35 e0 2e e9 7.U.......D.5... 0310 42 c3 7e 59 c3 3d 1c 6b 0b a0 e6 be 0f f7 b8 b5 B.~Y.=.k........ 0320 cf c7 9b e3 39 d0 67 f1 60 c1 76 19 a3 ed 07 8c ....9.g.`.v..... 0330 4a 58 4c 7a 42 d6 5f 6f 68 da 16 cd ad 68 44 d0 JXLzB._oh....hD. 0340 68 ec 45 d4 ad 2d 63 48 86 93 9c d6 72 9b 20 a2 h.E..-cH....r. . 0350 41 3d 36 06 ae f6 4d 7e bc 8c 17 bb 8a aa 48 2f A=6...M~......H/ 0360 a5 d2 7c d6 49 9b 1a 29 78 04 b0 de 75 2e a1 9f ..|.I..)x...u... 0370 f4 88 19 59 9e ce 6a 52 93 45 12 6a 0c f7 2e 05 ...Y..jR.E.j.... 0380 7f 46 9a 22 84 90 9e 65 9e c6 ed 7c 34 f1 c6 64 .F."...e...|4..d 0390 cd f7 b4 10 15 d2 a2 d2 c9 d2 96 fe 83 c6 22 28 .............."( 03a0 16 e2 9e c0 e4 ed 09 8e 80 f9 be 85 1a 10 bf f9 ................ 03b0 85 47 20 80 36 8d c8 af 4a 13 cf 51 ac 67 f7 30 .G .6...J..Q.g.0 03c0 19 29 e7 a2 00 bb 62 ec bf 7b 45 9d 6c ab f4 aa .)....b..{E.l... 03d0 9f 9b 8f 72 8f 56 72 5e a9 73 bd e3 5a d1 48 38 ...r.Vr^.s..Z.H8 03e0 a7 19 ea 1a c1 07 e4 d4 d7 9a d8 7c e4 3d 0e a8 ...........|.=.. 03f0 b0 19 83 9f 24 68 b3 a0 b6 f3 9a ea 01 e1 05 b0 ....$h.......... 0400 8a 81 81 d8 95 d4 11 f9 5c ba ca 26 89 78 9c 65 ........\..&.x.e 0410 42 c3 60 30 89 96 00 07 b3 ad bc 4f ff 9e c9 36 B.`0.......O...6 0420 73 bd ca fa 26 d3 ad 89 51 e2 31 6b 17 e0 a6 23 s...&...Q.1k...# 0430 d5 2c 1c d2 0a d9 2a 07 36 e7 04 04 d6 74 a5 f2 .,....*.6....t.. 0440 aa 71 17 cc 9c f1 a3 b2 35 53 d5 09 fc cb fb ea .q......5S...... 0450 3c d0 47 50 8e 2c f6 5f 48 81 ab f5 76 38 bd 43 <.GP.,._H...v8.C 0460 af e7 9b 0c 4c 65 64 34 d2 ee e2 00 07 e7 71 78 ....Led4......qx 0470 a6 8c 00 23 b1 bb a6 d5 b3 c6 c2 16 e3 76 bf c1 ...#.........v.. 0480 fc 51 b4 0a b2 35 3f 3d 3f 2c 1a 84 f2 dc 1d 6c .Q...5?=?,.....l 0490 c8 bd 79 2b 05 b6 ea e5 9e 92 b1 c1 64 ce 1e fd ..y+........d... 04a0 da b2 9d 16 17 a4 04 ea 26 a9 5c 28 8f 0e 78 af ........&.\(..x. 04b0 43 c3 33 ab af b6 d1 69 d8 af 0d 2c c1 33 9d ed C.3....i...,.3.. 04c0 52 56 09 25 70 a8 01 af ad 97 a8 bf 1c 9b 04 9f RV.%p........... 04d0 2e 2f 26 5d 0b 66 5d 96 08 ab f7 8c cd 97 5b 6f ./&].f].......[o 04e0 96 16 68 f7 43 16 e2 ee 79 ff 44 f1 2a a7 ff b8 ..h.C...y.D.*... 04f0 a6 b0 c6 e3 b1 d7 b2 ec 33 9c b3 03 1e 29 74 a5 ........3....)t. 0500 8e cf 01 92 cb 1b e7 ab d4 91 07 3d d3 5a 99 08 ...........=.Z.. 0510 f6 b8 fb 59 3f 5d 57 9f 2f b6 52 ea 7f 7e 7d 8b ...Y?]W./.R..~}. 0520 7e a9 23 4f 9c 48 fc a5 71 f8 dc 34 7f cf a6 27 ~.#O.H..q..4...' 0530 66 b2 c0 52 8c 6a df dd 15 f3 12 98 e9 bb d3 32 f..R.j.........2 0540 2a 10 6f c9 fa 59 46 0c 92 f6 6e c9 a9 09 19 3b *.o..YF...n....; 0550 b1 44 d0 8e a3 a7 e7 c5 52 b4 c8 86 cb a3 44 f8 .D......R.....D. 0560 02 73 4f 49 f1 6c a6 02 41 aa a7 d0 98 38 4d 5a .sOI.l..A....8MZ 0570 cc 93 11 fe 31 36 68 1c be 97 ed 2a 6b ed e7 9a ....16h....*k... 0580 ed 25 b1 b4 05 d2 75 cf 6b 96 6a 60 36 fd 89 ac .%....u.k.j`6... 0590 92 c8 45 9b 04 ac 3a 15 b0 0f 49 2a 4f 1b ea 34 ..E...:...I*O..4 05a0 c6 91 a3 35 f0 e0 32 4b 8b 71 f4 e0 67 0c 49 95 ...5..2K.q..g.I. 05b0 a0 fd 72 85 62 6c e7 71 57 c4 b5 57 e0 9c 3f b5 ..r.bl.qW..W..?. 05c0 22 a3 1b 8d d9 52 44 e9 06 21 2c b4 3d 85 ae fe "....RD..!,.=... 05d0 ae 9b 8f 43 97 bc 1a ca 26 e7 50 35 51 3c 4d 31 ...C....&.P5Qf@y.` 01a0 89 e0 1e 61 fb 1b 3b 8b 39 71 79 06 34 d5 e3 d4 ...a..;.9qy.4... 01b0 1b c3 42 a8 20 cf f4 a5 6b 64 64 be a0 84 ac b4 ..B. ...kdd..... 01c0 8e c8 0e ed b2 db 59 8f 86 5c a0 db e2 4e 06 26 ......Y..\...N.& 01d0 c5 cb 74 13 15 79 1d a9 a4 97 9f 17 72 8a 83 f2 ..t..y......r... 01e0 3b 79 72 7a 87 da 54 a7 00 1a 01 82 84 34 73 3a ;yrz..T......4s: 01f0 38 57 5b ad 0b 3a 22 69 f4 0b 26 d4 94 c4 1c 5d 8W[..:"i..&....] 0200 bb 27 de 12 26 f0 26 66 6f c3 22 25 c9 13 b2 13 .'..&.&fo."%.... 0210 8d ac bf 23 f7 99 07 7f 57 85 40 0d df 15 ab 97 ...#....W.@..... 0220 6c e2 de ee 44 f2 d8 d7 ff 47 d6 47 10 39 61 6d l...D....G.G.9am 0230 24 b8 27 b8 cd 16 27 8c c4 56 83 59 92 7d d3 7e $.'...'..V.Y.}.~ 0240 50 ed 3d 4e c5 86 4d e7 be fe b4 bb c3 f6 bc 40 P.=N..M........@ 0250 9d 58 22 22 b6 55 7b 61 e5 47 81 bc c6 02 80 b2 .X"".U{a.G...... 0260 ce 0f 72 c4 1a a6 48 58 0c c9 76 eb 07 99 17 b5 ..r...HX..v..... 0270 b1 6a 4d 05 9f 62 34 3b 5d 3b 3c 9a 0f bc 60 88 .jM..b4;];<...`. 0280 39 ba ee 79 63 fe b9 fd e8 cb c9 b2 55 61 ca 28 9..yc.......Ua.( 0290 81 a0 0c d6 75 77 bb 16 b8 24 95 a1 05 05 05 65 ....uw...$.....e 02a0 30 c1 34 ac 13 3c 5e ed 21 0a 1e 76 26 d5 4d 9a 0.4..<^.!..v&.M. 02b0 e8 d9 e3 8d 23 53 e1 40 f0 76 4d 62 a5 7f 18 6b ....#S.@.vMb...k 02c0 1d 1f dd 05 b8 e9 f3 0e 55 11 6f f6 5b 8f 37 82 ........U.o.[.7. 02d0 8a 39 41 56 74 df 0d 49 9c af 12 d2 8b 80 c7 4b .9AVt..I.......K 02e0 36 ca 18 e4 6d fe 47 39 25 ce 38 95 9f f7 43 e1 6...m.G9%.8...C. 02f0 b2 13 fe 46 60 ad b0 67 24 64 b5 aa d8 76 a0 b2 ...F`..g$d...v.. 0300 69 8b bf 86 88 6f 9c 10 23 3f 65 f9 f7 33 bf 30 i....o..#?e..3.0 0310 dc fe 6a be e5 87 f1 43 52 96 5c 1e 84 93 00 d4 ..j....CR.\..... 0320 12 2e b0 3e 26 83 25 02 cc 5b db dc 15 af 57 3e ...>&.%..[....W> 0330 3f 37 37 a2 94 09 34 ca 5f 08 b1 c1 85 b1 d7 fd ?77...4._....... 0340 37 b9 fa 70 52 8e ab 75 13 68 85 15 e8 eb 9e b6 7..pR..u.h...... 0350 fa 8e 11 4b 68 1b 5e c9 bc 4a d1 98 ba e9 fa 22 ...Kh.^..J....." 0360 10 d5 e0 13 3f da e5 47 81 4c 0d 41 a9 bd 5f 7a ....?..G.L.A.._z 0370 b9 b3 f9 e6 a5 6b c5 13 0c a3 34 38 85 c8 f4 07 .....k....48.... 0380 8d dc ed 20 b8 c3 7a 9a 77 5d 08 62 59 36 15 a2 ... ..z.w].bY6.. 0390 b7 01 b5 d0 f4 1b 7f d6 46 65 d3 58 40 bc 9f 6f ........Fe.X@..o 03a0 18 92 6d 34 5e 81 83 2d 4c 7b e2 7e 90 e8 da c4 ..m4^..-L{.~.... 03b0 24 e6 02 0a 3b d7 99 c0 9e a1 23 f5 26 ec b0 63 $...;.....#.&..c 03c0 8f da ab 07 76 3a 97 a4 34 70 68 c2 a2 04 dd ef ....v:..4ph..... 03d0 9a 10 95 77 79 34 b9 36 9c ee 2a 29 8d 26 17 32 ...wy4.6..*).&.2 03e0 ff 42 cf f3 14 8d 01 a7 51 11 50 51 00 7d 26 8c .B......Q.PQ.}&. 03f0 57 97 c6 1c 74 a6 d9 f3 2b f6 af 74 cd de 36 d4 W...t...+..t..6. 0400 70 3d 12 46 ff 74 c9 33 45 ce 6b 7e 37 f2 1d ad p=.F.t.3E.k~7... 0410 79 2f 6c c9 66 cf b8 5c 7f 89 98 40 bc ef 42 d8 y/l.f..\...@..B. 0420 36 60 bb e5 f9 95 8d 5b dd ab 11 24 e6 e0 90 1d 6`.....[...$.... 0430 e2 3d 8e 45 b2 64 c2 bc 8c 9b 51 7f a1 b7 ee 6e .=.E.d....Q....n 0440 1d 16 8a 8b c4 b0 19 03 b3 5e 25 1f 18 97 94 bd .........^%..... 0450 a5 0c c8 de 32 92 9f 6c 39 de 4e e1 5e 54 aa 79 ....2..l9.N.^T.y 0460 74 f3 ca t.. Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 56 b5 2b 37 57 ...........V.+7W 0020 b7 71 60 8a 22 8a 9c 4b d9 40 8d 74 32 1c 7b 84 .q`."..K.@.t2.{. 0030 a1 b5 f2 4a 3d ab 35 df 4f 99 75 b6 61 82 65 d3 ...J=.5.O.u.a.e. 0040 f8 57 b6 4a a3 4a 60 bc ab dd 08 4b a2 ff 92 69 .W.J.J`....K...i 0050 78 f2 07 a7 5c af 04 f8 6d 10 f8 02 be fa 5e f3 x...\...m.....^. 0060 2c a6 76 55 e6 55 05 0c 77 94 8d 56 c6 cb 93 76 ,.vU.U..w..V...v 0070 af 4e 77 d7 69 e2 a9 c9 30 b3 06 0e 12 70 f4 4c .Nw.i...0....p.L 0080 d8 75 2e 60 d8 48 67 fa 5f b7 a9 94 f9 f6 1c 35 .u.`.Hg._......5 0090 3c 79 83 a2 46 5e 95 c6 2e 92 31 94 09 dd 33 b1 ... 0230 c2 85 4f 19 31 e3 d3 4b 9a 07 c0 86 8b 2e d3 7d ..O.1..K.......} 0240 b9 2d 45 35 60 c9 64 e2 23 c6 7a d8 94 42 cd f8 .-E5`.d.#.z..B.. 0250 84 cf f7 84 e1 a7 b2 e3 36 53 64 22 d8 96 44 ae ........6Sd"..D. 0260 f2 4f c9 65 82 9b 89 ac 55 68 70 20 4a 89 ae 06 .O.e....Uhp J... 0270 1e 9a e1 80 09 30 ed d0 14 e8 8b 1a 80 66 e4 5d .....0.......f.] 0280 da 38 c5 28 f9 c6 11 dc 07 93 02 94 47 8a 43 a6 .8.(........G.C. 0290 b3 ba 42 ac 56 ad 4d 54 2d 00 87 02 d0 46 f9 f9 ..B.V.MT-....F.. 02a0 c0 cd bd d1 3e 9b 11 db af 4f 98 62 cb 6b 42 a7 ....>....O.b.kB. 02b0 65 bd 74 40 85 93 af 92 66 6f ae 16 83 c1 91 7d e.t@....fo.....} 02c0 01 28 fd cb f4 ba b0 a8 f5 c7 37 91 55 f0 90 ec .(........7.U... 02d0 9b 80 9b e7 44 c6 35 e0 2e e9 42 c3 7e 59 c3 3d ....D.5...B.~Y.= 02e0 1c 6b 0b a0 e6 be 0f f7 b8 b5 cf c7 9b e3 39 d0 .k............9. 02f0 67 f1 60 c1 76 19 a3 ed 07 8c 4a 58 4c 7a 42 d6 g.`.v.....JXLzB. 0300 5f 6f 68 da 16 cd ad 68 44 d0 68 ec 45 d4 ad 2d _oh....hD.h.E..- 0310 63 48 86 93 9c d6 72 9b 20 a2 41 3d 36 06 ae f6 cH....r. .A=6... 0320 4d 7e bc 8c 17 bb 8a aa 48 2f a5 d2 7c d6 49 9b M~......H/..|.I. 0330 1a 29 78 04 b0 de 75 2e a1 9f f4 88 19 59 9e ce .)x...u......Y.. 0340 6a 52 93 45 12 6a 0c f7 2e 05 7f 46 9a 22 84 90 jR.E.j.....F.".. 0350 9e 65 9e c6 ed 7c 34 f1 c6 64 cd f7 b4 10 15 d2 .e...|4..d...... 0360 a2 d2 c9 d2 96 fe 83 c6 22 28 16 e2 9e c0 e4 ed ........"(...... 0370 09 8e 80 f9 be 85 1a 10 bf f9 85 47 20 80 36 8d ...........G .6. 0380 c8 af 4a 13 cf 51 ac 67 f7 30 19 29 e7 a2 00 bb ..J..Q.g.0.).... 0390 62 ec bf 7b 45 9d 6c ab f4 aa 9f 9b 8f 72 8f 56 b..{E.l......r.V 03a0 72 5e a9 73 bd e3 5a d1 48 38 a7 19 ea 1a c1 07 r^.s..Z.H8...... 03b0 e4 d4 d7 9a d8 7c e4 3d 0e a8 b0 19 83 9f 24 68 .....|.=......$h 03c0 b3 a0 b6 f3 9a ea 01 e1 05 b0 8a 81 81 d8 95 d4 ................ 03d0 11 f9 5c ba ca 26 89 78 9c 65 42 c3 60 30 89 96 ..\..&.x.eB.`0.. 03e0 00 07 b3 ad bc 4f ff 9e c9 36 73 bd ca fa 26 d3 .....O...6s...&. 03f0 ad 89 51 e2 31 6b 17 e0 a6 23 d5 2c 1c d2 0a d9 ..Q.1k...#.,.... 0400 2a 07 36 e7 04 04 d6 74 a5 f2 aa 71 17 cc 9c f1 *.6....t...q.... 0410 a3 b2 35 53 d5 09 fc cb fb ea 3c d0 47 50 8e 2c ..5S......<.GP., 0420 f6 5f 48 81 ab f5 76 38 bd 43 af e7 9b 0c 4c 65 ._H...v8.C....Le 0430 64 34 d2 ee e2 00 07 e7 71 78 a6 8c 00 23 b1 bb d4......qx...#.. 0440 a6 d5 b3 c6 c2 16 e3 76 bf c1 fc 51 b4 0a b2 35 .......v...Q...5 0450 3f 3d 3f 2c 1a 84 f2 dc 1d 6c c8 bd 79 2b 05 b6 ?=?,.....l..y+.. 0460 ea e5 9e 92 b1 c1 64 ce 1e fd da b2 9d 16 17 a4 ......d......... 0470 04 ea 26 a9 5c 28 8f 0e 78 af 43 c3 33 ab af b6 ..&.\(..x.C.3... 0480 d1 69 d8 af 0d 2c c1 33 9d ed 52 56 09 25 70 a8 .i...,.3..RV.%p. 0490 01 af ad 97 a8 bf 1c 9b 04 9f 2e 2f 26 5d 0b 66 .........../&].f 04a0 5d 96 08 ab f7 8c cd 97 5b 6f 96 16 68 f7 43 16 ].......[o..h.C. 04b0 e2 ee 79 ff 44 f1 2a a7 ff b8 a6 b0 c6 e3 b1 d7 ..y.D.*......... 04c0 b2 ec 33 9c b3 03 1e 29 74 a5 8e cf 01 92 cb 1b ..3....)t....... 04d0 e7 ab d4 91 07 3d d3 5a 99 08 f6 b8 fb 59 3f 5d .....=.Z.....Y?] 04e0 57 9f 2f b6 52 ea 7f 7e 7d 8b 7e a9 23 4f 9c 48 W./.R..~}.~.#O.H 04f0 fc a5 71 f8 dc 34 7f cf a6 27 66 b2 c0 52 8c 6a ..q..4...'f..R.j 0500 df dd 15 f3 12 98 e9 bb d3 32 2a 10 6f c9 fa 59 .........2*.o..Y 0510 46 0c 92 f6 6e c9 a9 09 19 3b b1 44 d0 8e a3 a7 F...n....;.D.... 0520 e7 c5 52 b4 c8 86 cb a3 44 f8 02 73 4f 49 f1 6c ..R.....D..sOI.l 0530 a6 02 41 aa a7 d0 98 38 4d 5a cc 93 11 fe 31 36 ..A....8MZ....16 0540 68 1c be 97 ed 2a 6b ed e7 9a ed 25 b1 b4 05 d2 h....*k....%.... 0550 75 cf 6b 96 6a 60 36 fd 89 ac 92 c8 45 9b 04 ac u.k.j`6.....E... 0560 3a 15 b0 0f 49 2a 4f 1b ea 34 c6 91 a3 35 f0 e0 :...I*O..4...5.. 0570 32 4b 8b 71 f4 e0 67 0c 49 95 a0 fd 72 85 62 6c 2K.q..g.I...r.bl 0580 e7 71 57 c4 b5 57 e0 9c 3f b5 22 a3 1b 8d d9 52 .qW..W..?."....R 0590 44 e9 06 21 2c b4 3d 85 ae fe ae 9b 8f 43 97 bc D..!,.=......C.. 05a0 1a ca 26 e7 50 35 51 3c 4d 31 63 24 3a a9 fc 91 ..&.P5Qf@y.`.. 0720 1e 61 fb 1b 3b 8b 39 71 79 06 34 d5 e3 d4 1b c3 .a..;.9qy.4..... 0730 42 a8 20 cf f4 a5 6b 64 64 be a0 84 ac b4 8e c8 B. ...kdd....... 0740 0e ed b2 db 59 8f 86 5c a0 db e2 4e 06 26 c5 cb ....Y..\...N.&.. 0750 74 13 15 79 1d a9 a4 97 9f 17 72 8a 83 f2 3b 79 t..y......r...;y 0760 72 7a 87 da 54 a7 00 1a 01 82 84 34 73 3a 38 57 rz..T......4s:8W 0770 5b ad 0b 3a 22 69 f4 0b 26 d4 94 c4 1c 5d bb 27 [..:"i..&....].' 0780 de 12 26 f0 26 66 6f c3 22 25 c9 13 b2 13 8d ac ..&.&fo."%...... 0790 bf 23 f7 99 07 7f 57 85 40 0d df 15 ab 97 6c e2 .#....W.@.....l. 07a0 de ee 44 f2 d8 d7 ff 47 d6 47 10 39 61 6d 24 b8 ..D....G.G.9am$. 07b0 27 b8 cd 16 27 8c c4 56 83 59 92 7d d3 7e 50 ed '...'..V.Y.}.~P. 07c0 3d 4e c5 86 4d e7 be fe b4 bb c3 f6 bc 40 9d 58 =N..M........@.X 07d0 22 22 b6 55 7b 61 e5 47 81 bc c6 02 80 b2 ce 0f "".U{a.G........ 07e0 72 c4 1a a6 48 58 0c c9 76 eb 07 99 17 b5 b1 6a r...HX..v......j 07f0 4d 05 9f 62 34 3b 5d 3b 3c 9a 0f bc 60 88 39 ba M..b4;];<...`.9. 0800 ee 79 63 fe b9 fd e8 cb c9 b2 55 61 ca 28 81 a0 .yc.......Ua.(.. 0810 0c d6 75 77 bb 16 b8 24 95 a1 05 05 05 65 30 c1 ..uw...$.....e0. 0820 34 ac 13 3c 5e ed 21 0a 1e 76 26 d5 4d 9a e8 d9 4..<^.!..v&.M... 0830 e3 8d 23 53 e1 40 f0 76 4d 62 a5 7f 18 6b 1d 1f ..#S.@.vMb...k.. 0840 dd 05 b8 e9 f3 0e 55 11 6f f6 5b 8f 37 82 8a 39 ......U.o.[.7..9 0850 41 56 74 df 0d 49 9c af 12 d2 8b 80 c7 4b 36 ca AVt..I.......K6. 0860 18 e4 6d fe 47 39 25 ce 38 95 9f f7 43 e1 b2 13 ..m.G9%.8...C... 0870 fe 46 60 ad b0 67 24 64 b5 aa d8 76 a0 b2 69 8b .F`..g$d...v..i. 0880 bf 86 88 6f 9c 10 23 3f 65 f9 f7 33 bf 30 dc fe ...o..#?e..3.0.. 0890 6a be e5 87 f1 43 52 96 5c 1e 84 93 00 d4 12 2e j....CR.\....... 08a0 b0 3e 26 83 25 02 cc 5b db dc 15 af 57 3e 3f 37 .>&.%..[....W>?7 08b0 37 a2 94 09 34 ca 5f 08 b1 c1 85 b1 d7 fd 37 b9 7...4._.......7. 08c0 fa 70 52 8e ab 75 13 68 85 15 e8 eb 9e b6 fa 8e .pR..u.h........ 08d0 11 4b 68 1b 5e c9 bc 4a d1 98 ba e9 fa 22 10 d5 .Kh.^..J.....".. 08e0 e0 13 3f da e5 47 81 4c 0d 41 a9 bd 5f 7a b9 b3 ..?..G.L.A.._z.. 08f0 f9 e6 a5 6b c5 13 0c a3 34 38 85 c8 f4 07 8d dc ...k....48...... 0900 ed 20 b8 c3 7a 9a 77 5d 08 62 59 36 15 a2 b7 01 . ..z.w].bY6.... 0910 b5 d0 f4 1b 7f d6 46 65 d3 58 40 bc 9f 6f 18 92 ......Fe.X@..o.. 0920 6d 34 5e 81 83 2d 4c 7b e2 7e 90 e8 da c4 24 e6 m4^..-L{.~....$. 0930 02 0a 3b d7 99 c0 9e a1 23 f5 26 ec b0 63 8f da ..;.....#.&..c.. 0940 ab 07 76 3a 97 a4 34 70 68 c2 a2 04 dd ef 9a 10 ..v:..4ph....... 0950 95 77 79 34 b9 36 9c ee 2a 29 8d 26 17 32 ff 42 .wy4.6..*).&.2.B 0960 cf f3 14 8d 01 a7 51 11 50 51 00 7d 26 8c 57 97 ......Q.PQ.}&.W. 0970 c6 1c 74 a6 d9 f3 2b f6 af 74 cd de 36 d4 70 3d ..t...+..t..6.p= 0980 12 46 ff 74 c9 33 45 ce 6b 7e 37 f2 1d ad 79 2f .F.t.3E.k~7...y/ 0990 6c c9 66 cf b8 5c 7f 89 98 40 bc ef 42 d8 36 60 l.f..\...@..B.6` 09a0 bb e5 f9 95 8d 5b dd ab 11 24 e6 e0 90 1d e2 3d .....[...$.....= 09b0 8e 45 b2 64 c2 bc 8c 9b 51 7f a1 b7 ee 6e 1d 16 .E.d....Q....n.. 09c0 8a 8b c4 b0 19 03 b3 5e 25 1f 18 97 94 bd a5 0c .......^%....... 09d0 c8 de 32 92 9f 6c 39 de 4e e1 5e 54 aa 79 74 f3 ..2..l9.N.^T.yt. 09e0 ca . No. Time Source Destination Protocol Info 124 62.020605 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=2372 Ack=4262 Win=64240 Len=0 Frame 124 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2372, Ack: 4262, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 05 40 00 80 06 bf be ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 10 14 0b 68 64 23 50 10 .e.........hd#P. 0030 fa f0 fd a6 00 00 02 04 05 b4 01 01 ............ No. Time Source Destination Protocol Info 125 62.023886 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (163 bytes) Frame 125 (267 bytes on wire, 267 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2372, Ack: 4262, Len: 213 Lightweight Directory Access Protocol SASL Buffer Length: 209 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE6035B2ABBF98A6C14A33780E5A1A10E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E6035B2ABBF98A6C krb5_sgn_cksum: 14A33780E5A1A10E krb5_confounder: 75EFA5C76E3BB9EA GSS-API Encrypted payload (163 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fd e0 06 40 00 80 06 be e8 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 10 14 0b 68 64 23 50 18 .e.........hd#P. 0030 fa f0 8b f3 00 00 00 00 00 d1 60 81 ce 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 e6 03 5b 2a bb f9 8a 6c 14 a3 37 80 e5 a1 a1 0e ..[*...l..7..... 0060 75 ef a5 c7 6e 3b b9 ea 8a 42 80 e8 20 d8 ed af u...n;...B.. ... 0070 11 e6 12 c9 a0 37 79 2a 26 5a 9e b4 af 96 45 74 .....7y*&Z....Et 0080 10 c3 d2 5c b4 b9 ba 54 0d 3e 94 5a 12 9e ed f1 ...\...T.>.Z.... 0090 4d 9e 60 6e 6c ee 04 19 ef a5 e1 03 9b 76 d6 7d M.`nl........v.} 00a0 d1 8c 70 b5 4d ac 9c 76 ac e4 71 08 d7 41 96 61 ..p.M..v..q..A.a 00b0 db 6e 3e 35 0e 7b 9c f5 51 32 1b 89 5b a5 71 d4 .n>5.{..Q2..[.q. 00c0 39 ac 6c c2 b2 0b c4 19 ca b3 3d 87 74 ff a7 cc 9.l.......=.t... 00d0 43 5b 7f 88 60 31 21 99 7d cc 66 99 4f 12 d7 70 C[..`1!.}.f.O..p 00e0 98 09 54 a0 92 59 3b 5e 43 91 c8 f7 c4 a9 88 4d ..T..Y;^C......M 00f0 e7 5d ff b2 51 c1 3c 81 20 65 40 0e f0 06 d1 32 .]..Q.<. e@....2 0100 55 0c e9 14 b5 c1 78 59 cc 4f c2 U.....xY.O. No. Time Source Destination Protocol Info 126 62.047642 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [ACK] Seq=1933 Ack=805 Win=63436 Len=0 Frame 126 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1933, Ack: 805, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 07 40 00 80 06 bf bc ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 ca 04 01 e7 79 57 af 52 21 b8 a4 50 10 .e.....yW.R!..P. 0030 f7 cc 07 42 00 00 05 00 0b 07 10 00 ...B........ No. Time Source Destination Protocol Info 127 62.047861 172.31.1.104 172.31.1.101 TCP shadowserver > ldap [ACK] Seq=3406 Ack=16281 Win=63858 Len=0 Frame 127 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: shadowserver (2027), Dst Port: ldap (389), Seq: 3406, Ack: 16281, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 08 40 00 80 06 bf bb ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 eb 01 85 c4 68 51 e6 f8 ee 32 20 50 10 .e.....hQ...2 P. 0030 f9 72 10 88 00 00 05 00 0e 03 10 00 .r.......... No. Time Source Destination Protocol Info 128 62.064088 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (193 bytes) Frame 128 (297 bytes on wire, 297 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 4262, Ack: 2585, Len: 243 Lightweight Directory Access Protocol SASL Buffer Length: 239 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF960AAE53E7F47EF8A1653219A3C4B0BC... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 960AAE53E7F47EF8 krb5_sgn_cksum: A1653219A3C4B0BC krb5_confounder: C562D98C8F09845E GSS-API Encrypted payload (193 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 1b 2d f3 40 00 80 06 70 de ac 1f 01 65 ac 1f ..-.@...p....e.. 0020 01 68 01 85 07 f0 0b 68 64 23 d3 1c 10 e9 50 18 .h.....hd#....P. 0030 f6 a7 ce 96 00 00 00 00 00 ef 60 81 ec 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 96 0a ae 53 e7 f4 7e f8 a1 65 32 19 a3 c4 b0 bc ...S..~..e2..... 0060 c5 62 d9 8c 8f 09 84 5e 17 3f 6f d3 5c 81 c6 ac .b.....^.?o.\... 0070 cc ed 37 22 0a 9b 18 ee 41 4c 69 28 23 98 38 84 ..7"....ALi(#.8. 0080 66 7d 7e d6 f1 c9 a6 ae e8 c2 98 1b 24 e7 3e ce f}~.........$.>. 0090 02 57 b2 21 2c 08 a8 c7 bf 97 da b2 c7 a0 1a 33 .W.!,..........3 00a0 38 67 a7 4b a6 87 f9 33 b7 6e 29 b7 ab 36 98 d2 8g.K...3.n)..6.. 00b0 c6 37 59 49 12 10 ec 62 09 07 30 09 d7 67 2f 3e .7YI...b..0..g/> 00c0 cb b2 fc de 4c fe 9e 63 67 e0 28 12 93 87 68 73 ....L..cg.(...hs 00d0 45 fc 6f e1 0d 69 47 fd ab 55 74 1b 59 ab 16 fa E.o..iG..Ut.Y... 00e0 11 fb 50 b5 7c d8 b0 91 2c 20 f0 c8 24 e6 af 47 ..P.|..., ..$..G 00f0 23 bb e6 4f 33 9e 58 87 97 50 63 e0 a3 cf d0 e0 #..O3.X..Pc..... 0100 64 20 22 d1 c3 07 26 08 08 ae 94 56 ab 2f df 0e d "...&....V./.. 0110 3d d0 52 41 50 9f 00 0a 15 ce c0 0c 42 37 a2 e0 =.RAP.......B7.. 0120 2f 37 47 77 19 25 79 40 30 /7Gw.%y@0 No. Time Source Destination Protocol Info 129 62.065237 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (197 bytes) Frame 129 (301 bytes on wire, 301 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2585, Ack: 4505, Len: 247 Lightweight Directory Access Protocol SASL Buffer Length: 243 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4DD1875864CDCBD827370524F794E925... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4DD1875864CDCBD8 krb5_sgn_cksum: 27370524F794E925 krb5_confounder: 6A63F3A59EB8A1FE GSS-API Encrypted payload (197 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 1f e0 09 40 00 80 06 be c3 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 10 e9 0b 68 65 16 50 18 .e.........he.P. 0030 f9 fd 14 a7 00 00 00 00 00 f3 60 81 f0 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 4d d1 87 58 64 cd cb d8 27 37 05 24 f7 94 e9 25 M..Xd...'7.$...% 0060 6a 63 f3 a5 9e b8 a1 fe 0c 0e 5c b5 72 8c ae 04 jc........\.r... 0070 eb a1 85 b9 6c 6e 82 f2 8a c5 8e bd 77 36 b2 59 ....ln......w6.Y 0080 4a f2 5b ba 05 70 bf 75 6f 2e f5 db 20 06 d7 78 J.[..p.uo... ..x 0090 56 ee 26 a6 cd b5 df d6 99 d4 22 74 9e 37 aa 6b V.&......."t.7.k 00a0 58 3b e9 cd fc a1 32 52 be 02 7e cb 5a f7 21 ce X;....2R..~.Z.!. 00b0 04 ce 56 30 e0 26 ef 7b 06 2b 5c 96 64 11 03 f7 ..V0.&.{.+\.d... 00c0 78 6d 43 3f fa 84 91 c9 d8 4b c2 e5 3e e4 2f b6 xmC?.....K..>./. 00d0 ae 69 af 71 37 ce f3 ba 31 d9 7f 0d 91 98 9a ef .i.q7...1....... 00e0 d7 a5 04 e6 c2 e5 e0 a4 70 96 94 2c 3a f8 01 e7 ........p..,:... 00f0 ab 2c 8c 6c 5c 60 b4 c3 70 dc a6 59 25 d0 8e 42 .,.l\`..p..Y%..B 0100 9f b3 a4 84 22 83 13 97 57 23 df 76 48 f1 9e ea ...."...W#.vH... 0110 17 0f 87 46 86 6c b7 48 53 90 8f 03 5a 0e 61 b8 ...F.l.HS...Z.a. 0120 cd 3d 81 b3 46 2a fa 6c 04 3c be 05 5e .=..F*.l.<..^ No. Time Source Destination Protocol Info 130 62.114122 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 130 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 4505, Ack: 2832, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d f4 40 00 80 06 6c 1c ac 1f 01 65 ac 1f ..-.@...l....e.. 0020 01 68 01 85 07 f0 0b 68 65 16 d3 1c 11 e0 50 10 .h.....he.....P. 0030 f5 b0 65 b5 00 00 00 00 06 59 60 82 06 55 06 09 ..e......Y`..U.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff aa b8 23 1e 4b 50 3e f9 b7 f3 19 a1 f2 a5 e1 ...#.KP>........ 0060 7d 69 64 06 66 89 aa 8f 8e f9 25 76 33 c7 dd 44 }id.f.....%v3..D 0070 92 57 d2 61 ae a7 71 f8 b5 c8 33 27 b2 07 76 32 .W.a..q...3'..v2 0080 5b 54 77 7f 54 19 fd e2 85 26 b9 37 7d dc 60 b6 [Tw.T....&.7}.`. 0090 bd c2 d7 67 84 28 b1 c9 1f 18 fd 54 05 83 4c 92 ...g.(.....T..L. 00a0 64 ed 52 d9 60 d8 2f ed b7 e5 a5 3c 7d c6 0f 2a d.R.`./....<}..* 00b0 82 f1 b4 f8 f8 85 79 85 91 d3 b2 f9 43 d7 1e 00 ......y.....C... 00c0 c1 b6 c9 34 4c 98 27 4a a7 90 9b b4 9f 03 a5 21 ...4L.'J.......! 00d0 6c 7d a6 23 5e c0 bf 2f 54 01 77 05 f0 98 5d e5 l}.#^../T.w...]. 00e0 83 ae 20 cc 2e 16 26 a8 08 2d f9 63 6d bd 2a 7f .. ...&..-.cm.*. 00f0 06 63 2c 63 70 a7 c3 1a 7c b2 d9 9b d4 91 ce e5 .c,cp...|....... 0100 63 0c d9 8f 65 00 ec 5d cf f3 e3 e6 2d cb fc 51 c...e..]....-..Q 0110 57 db 75 cf e6 a2 41 e0 46 24 e4 46 f1 29 5d b0 W.u...A.F$.F.)]. 0120 1b f1 af 5f 75 d7 fe 83 75 65 3b cb a6 bd d8 1c ..._u...ue;..... 0130 f0 d6 96 65 d9 1e e7 3d d4 98 fc e1 52 84 18 af ...e...=....R... 0140 26 3f de 80 b8 e8 44 c8 02 58 a1 54 22 14 52 3a &?....D..X.T".R: 0150 2c ce c2 60 6a ca 12 a1 ed c4 a4 4a 83 ca fd a0 ,..`j......J.... 0160 5b c5 c9 7b 13 8b af cb 81 cc d6 af 44 12 c3 b2 [..{........D... 0170 d4 c1 53 67 e3 25 0a f5 2b e2 49 d2 89 15 b9 2a ..Sg.%..+.I....* 0180 40 ed c1 b4 37 21 8c b9 5b 28 72 24 ff 40 d1 92 @...7!..[(r$.@.. 0190 1e 1b 88 35 a0 f7 bc 6d 4e 36 b5 5c 28 9e ce d0 ...5...mN6.\(... 01a0 b0 59 b8 85 f0 ec 74 42 b1 17 55 0f a3 c6 fb ab .Y....tB..U..... 01b0 17 a4 4b e2 fb ce f3 a3 7b d0 44 7a ce 08 a9 c8 ..K.....{.Dz.... 01c0 28 2a c2 1a 18 c9 95 4d fe 66 65 af 14 be 40 ea (*.....M.fe...@. 01d0 3d 3a 0d 60 19 16 00 d8 1f 7f e8 91 e9 30 31 b2 =:.`.........01. 01e0 ce 5f dc cb 6b e1 7d 5d a5 d2 a4 06 e5 8d c7 80 ._..k.}]........ 01f0 be f7 ee e2 95 09 71 64 62 a5 b1 8d 0b 9a 69 99 ......qdb.....i. 0200 a0 39 ff b2 e1 e6 13 70 1e 0a a4 19 a5 9b d4 31 .9.....p.......1 0210 de d1 9e 21 81 8a 1b e6 29 95 40 d8 b6 f7 4c 65 ...!....).@...Le 0220 f1 45 c6 32 64 ca 8f 7c 09 46 f2 cd 80 a0 d2 a7 .E.2d..|.F...... 0230 54 00 c5 87 e2 11 a0 f9 33 30 7e 3a 02 da f8 a8 T.......30~:.... 0240 a9 ec f2 a5 a6 cb 6c e4 10 23 97 00 bb b1 6a 95 ......l..#....j. 0250 bb 6c 75 ec ad c0 83 36 fd 24 12 c8 4e b5 ac 7e .lu....6.$..N..~ 0260 26 8b 26 43 3e 82 fc 9d d7 bf 7f e8 de 33 db 4a &.&C>........3.J 0270 83 1b 82 a2 72 55 27 5e ec fe 25 bc cb 12 c6 88 ....rU'^..%..... 0280 c7 34 26 a4 d0 fa 7e 96 67 0b 12 86 36 fa 0c 58 .4&...~.g...6..X 0290 1c 27 9a 45 10 89 4e cd 3b b8 c4 a1 e3 0d 38 3f .'.E..N.;.....8? 02a0 b5 21 9c 63 86 5c e8 2e 12 15 53 bc 2c 55 d6 0a .!.c.\....S.,U.. 02b0 03 65 fe 83 e2 c8 3b 46 4c a7 ac bb 1f 5a 4c e3 .e....;FL....ZL. 02c0 59 75 13 50 77 59 9b 93 29 2f bf 29 bf 31 b1 d1 Yu.PwY..)/.).1.. 02d0 60 ab 42 42 fc 83 4a 1c 32 2d 26 df 7e be 3f 79 `.BB..J.2-&.~.?y 02e0 45 f6 56 ab 6e be 8d aa dc 62 29 ea 3c a0 9e 2a E.V.n....b).<..* 02f0 3f 10 57 45 a1 e3 4b 22 30 10 e4 a4 ce 00 31 59 ?.WE..K"0.....1Y 0300 89 20 5a b3 ed de 70 ff 78 c8 4d 64 ae a1 89 cd . Z...p.x.Md.... 0310 41 4f 9d db 6a 2b 5c b7 44 1c b4 4d e3 c9 82 2f AO..j+\.D..M.../ 0320 2c f5 ec e3 7c 8f ba 9d 66 68 46 96 94 44 44 49 ,...|...fhF..DDI 0330 61 86 56 8a 32 11 d5 9b 8c cf a9 13 8b 77 0b ba a.V.2........w.. 0340 de 27 dc 20 d4 d4 12 90 94 89 fd bb 7f 58 71 11 .'. .........Xq. 0350 e0 30 2c 44 db da 2b 18 04 89 55 49 f4 17 85 ed .0,D..+...UI.... 0360 f6 f4 c8 e7 b5 f7 8c eb 68 3d 80 f4 fc a6 d4 67 ........h=.....g 0370 dc be 7a 2a 52 0c c7 69 f7 ea 08 b0 2b 0c 55 fb ..z*R..i....+.U. 0380 8a 2b 8c 4a ab f6 d9 c5 c7 b1 9e 30 a3 49 56 92 .+.J.......0.IV. 0390 9b 8f 49 06 34 29 ef c4 e8 3a d0 0d 19 fe 30 ed ..I.4)...:....0. 03a0 ab 55 1a 73 de 82 08 90 54 b9 34 31 8c 1c 54 d8 .U.s....T.41..T. 03b0 8b 76 53 89 a4 d5 c9 ec ac f4 2b 39 9f 54 eb f9 .vS.......+9.T.. 03c0 0a ca af e9 09 bd 52 2a 03 c9 9f 6d 56 04 b0 33 ......R*...mV..3 03d0 d8 2e 7d c8 48 ee 96 7e ea 4b 3d 98 de 49 c4 78 ..}.H..~.K=..I.x 03e0 5b 99 18 0c db 39 3b 6e 2c d5 ce b6 9e 06 cc a7 [....9;n,....... 03f0 59 5e fa c3 0e 7e 07 f6 9a 47 66 57 bf 5f 23 c4 Y^...~...GfW._#. 0400 47 60 6a 39 1c 28 95 d4 64 d7 d2 e9 9d ef b8 1a G`j9.(..d....... 0410 a3 24 7c 2f cd c9 82 be 2d 5c b4 fb 15 e7 bd 9c .$|/....-\...... 0420 af 4b bd c3 ac f9 87 24 d9 b8 5b e1 23 16 22 1b .K.....$..[.#.". 0430 be d4 fd fe cd e8 62 0d 6f 27 7f 98 3a 9b 9f d3 ......b.o'..:... 0440 bb bf d1 de 1c a3 0c 72 38 76 d0 89 15 7a fa 12 .......r8v...z.. 0450 91 ab bc eb cf db a5 7f 75 6d 48 c6 88 69 72 98 ........umH..ir. 0460 83 7f da 27 87 76 9c 8c d0 47 85 9e 15 01 6f e6 ...'.v...G....o. 0470 f3 9b da 8c 66 64 14 18 fe 5f 82 69 a1 de ef f5 ....fd..._.i.... 0480 aa 9a ae 59 4c 21 9a a1 8f 35 ec 48 a0 41 a7 b6 ...YL!...5.H.A.. 0490 a3 58 a0 bd 90 7b f2 3b 84 4a b6 61 86 13 29 f2 .X...{.;.J.a..). 04a0 31 3d c5 b0 17 86 6f 3e 53 3f ec b0 1a 40 93 8f 1=....o>S?...@.. 04b0 7f 3c d2 23 53 b0 9d 6a 82 b0 c4 ba c9 ee b7 06 .<.#S..j........ 04c0 22 84 8b de b9 bc 4b c1 85 e5 79 3f e0 3e ee 97 ".....K...y?.>.. 04d0 ad 22 b8 20 34 bd 23 c9 e6 32 bf ae f0 2c d4 cc .". 4.#..2...,.. 04e0 9b b8 e3 a8 d6 d5 6b d9 6c 07 bb 71 7b e6 59 da ......k.l..q{.Y. 04f0 21 f8 c5 09 6a 89 67 e0 1f 4c e2 4a d4 47 b6 79 !...j.g..L.J.G.y 0500 8c 16 dd 2d 46 eb bb 5c 05 4a 3d 1e 5a 07 ac b8 ...-F..\.J=.Z... 0510 aa 8c f9 e0 ce fe 89 b2 9a 33 87 86 06 1b 92 ec .........3...... 0520 99 35 6d 28 b6 af a5 11 fd cf 43 a8 5d 57 c5 9c .5m(......C.]W.. 0530 a3 5c d1 f7 bd 0c c8 a8 61 ad 60 6e 43 b9 fe 44 .\......a.`nC..D 0540 be 1c 4f 17 65 b7 92 6c 43 a0 9f 1f 83 7b 21 33 ..O.e..lC....{!3 0550 63 77 85 50 5a 46 3c ae d9 a6 f8 6b f2 55 5b 81 cw.PZF<....k.U[. 0560 d3 12 5b 7a 25 df 13 cf ab bd e8 ba 3c 1a 54 52 ..[z%.......<.TR 0570 35 59 7e e4 d3 89 4d d5 ba 36 80 48 67 dc bb cf 5Y~...M..6.Hg... 0580 9c 7d f9 19 21 df 58 f9 d5 b4 13 70 ed da 77 9a .}..!.X....p..w. 0590 cd 87 b9 9c e4 42 07 71 a6 9f 2e 06 ef 77 f3 ac .....B.q.....w.. 05a0 e3 40 5c 8e ef d1 a8 ec 70 2c 9b 51 a4 6c 72 e9 .@\.....p,.Q.lr. 05b0 5d 16 59 95 1e f3 f8 c4 1f b6 c1 0f 0f 7c 1a cf ].Y..........|.. 05c0 62 5f 8b ed 9c bb cd 6a 24 1a 07 40 83 e3 c9 b2 b_.....j$..@.... 05d0 7b 4a a9 94 92 34 94 ba 81 0b e5 ab 48 36 17 e9 {J...4......H6.. 05e0 59 75 81 4c 57 b3 61 43 a5 de Yu.LW.aC.. No. Time Source Destination Protocol Info 131 62.114251 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1578 bytes) Frame 131 (223 bytes on wire, 223 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 5965, Ack: 2832, Len: 169 Lightweight Directory Access Protocol SASL Buffer Length: 1625 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFAAB8231E4B503EF9B7F319A1F2A5E17D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: AAB8231E4B503EF9 krb5_sgn_cksum: B7F319A1F2A5E17D krb5_confounder: 6964066689AA8F8E GSS-API Encrypted payload (1578 bytes) Frame (223 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 d1 2d f5 40 00 80 06 71 26 ac 1f 01 65 ac 1f ..-.@...q&...e.. 0020 01 68 01 85 07 f0 0b 68 6a ca d3 1c 11 e0 50 18 .h.....hj.....P. 0030 f5 b0 c4 15 00 00 0b 08 29 97 bb 72 13 32 b1 22 ........)..r.2." 0040 16 42 29 4a e3 76 4d 05 2e f4 f4 78 01 62 3f 48 .B)J.vM....x.b?H 0050 80 31 e4 b8 4b c6 08 fa a6 59 83 b7 bc af 51 93 .1..K....Y....Q. 0060 b8 70 50 db c3 8c d0 18 2f cd 39 e6 e7 8b a1 15 .pP...../.9..... 0070 84 8c 8e 8d fc f0 90 b8 ee 48 11 92 ee f2 8d 29 .........H.....) 0080 2d f2 1f ba 3e 08 59 50 3d d2 1c ce d2 9f 84 35 -...>.YP=......5 0090 c3 4a 19 34 f2 d2 12 df 41 89 36 57 5a 97 16 f0 .J.4....A.6WZ... 00a0 69 8a 8c 14 b0 d1 98 f9 ec 0e 47 41 92 a0 6e 9b i.........GA..n. 00b0 47 e1 25 8b a3 d6 05 3e 78 0a 5d 47 e3 63 89 93 G.%....>x.]G.c.. 00c0 b7 ab a7 33 86 ff c4 3c 3f 12 8b d4 8b b2 9f c1 ...3...........}id.f. 0030 aa 8f 8e f9 25 76 33 c7 dd 44 92 57 d2 61 ae a7 ....%v3..D.W.a.. 0040 71 f8 b5 c8 33 27 b2 07 76 32 5b 54 77 7f 54 19 q...3'..v2[Tw.T. 0050 fd e2 85 26 b9 37 7d dc 60 b6 bd c2 d7 67 84 28 ...&.7}.`....g.( 0060 b1 c9 1f 18 fd 54 05 83 4c 92 64 ed 52 d9 60 d8 .....T..L.d.R.`. 0070 2f ed b7 e5 a5 3c 7d c6 0f 2a 82 f1 b4 f8 f8 85 /....<}..*...... 0080 79 85 91 d3 b2 f9 43 d7 1e 00 c1 b6 c9 34 4c 98 y.....C......4L. 0090 27 4a a7 90 9b b4 9f 03 a5 21 6c 7d a6 23 5e c0 'J.......!l}.#^. 00a0 bf 2f 54 01 77 05 f0 98 5d e5 83 ae 20 cc 2e 16 ./T.w...]... ... 00b0 26 a8 08 2d f9 63 6d bd 2a 7f 06 63 2c 63 70 a7 &..-.cm.*..c,cp. 00c0 c3 1a 7c b2 d9 9b d4 91 ce e5 63 0c d9 8f 65 00 ..|.......c...e. 00d0 ec 5d cf f3 e3 e6 2d cb fc 51 57 db 75 cf e6 a2 .]....-..QW.u... 00e0 41 e0 46 24 e4 46 f1 29 5d b0 1b f1 af 5f 75 d7 A.F$.F.)]...._u. 00f0 fe 83 75 65 3b cb a6 bd d8 1c f0 d6 96 65 d9 1e ..ue;........e.. 0100 e7 3d d4 98 fc e1 52 84 18 af 26 3f de 80 b8 e8 .=....R...&?.... 0110 44 c8 02 58 a1 54 22 14 52 3a 2c ce c2 60 6a ca D..X.T".R:,..`j. 0120 12 a1 ed c4 a4 4a 83 ca fd a0 5b c5 c9 7b 13 8b .....J....[..{.. 0130 af cb 81 cc d6 af 44 12 c3 b2 d4 c1 53 67 e3 25 ......D.....Sg.% 0140 0a f5 2b e2 49 d2 89 15 b9 2a 40 ed c1 b4 37 21 ..+.I....*@...7! 0150 8c b9 5b 28 72 24 ff 40 d1 92 1e 1b 88 35 a0 f7 ..[(r$.@.....5.. 0160 bc 6d 4e 36 b5 5c 28 9e ce d0 b0 59 b8 85 f0 ec .mN6.\(....Y.... 0170 74 42 b1 17 55 0f a3 c6 fb ab 17 a4 4b e2 fb ce tB..U.......K... 0180 f3 a3 7b d0 44 7a ce 08 a9 c8 28 2a c2 1a 18 c9 ..{.Dz....(*.... 0190 95 4d fe 66 65 af 14 be 40 ea 3d 3a 0d 60 19 16 .M.fe...@.=:.`.. 01a0 00 d8 1f 7f e8 91 e9 30 31 b2 ce 5f dc cb 6b e1 .......01.._..k. 01b0 7d 5d a5 d2 a4 06 e5 8d c7 80 be f7 ee e2 95 09 }].............. 01c0 71 64 62 a5 b1 8d 0b 9a 69 99 a0 39 ff b2 e1 e6 qdb.....i..9.... 01d0 13 70 1e 0a a4 19 a5 9b d4 31 de d1 9e 21 81 8a .p.......1...!.. 01e0 1b e6 29 95 40 d8 b6 f7 4c 65 f1 45 c6 32 64 ca ..).@...Le.E.2d. 01f0 8f 7c 09 46 f2 cd 80 a0 d2 a7 54 00 c5 87 e2 11 .|.F......T..... 0200 a0 f9 33 30 7e 3a 02 da f8 a8 a9 ec f2 a5 a6 cb ..30~:.......... 0210 6c e4 10 23 97 00 bb b1 6a 95 bb 6c 75 ec ad c0 l..#....j..lu... 0220 83 36 fd 24 12 c8 4e b5 ac 7e 26 8b 26 43 3e 82 .6.$..N..~&.&C>. 0230 fc 9d d7 bf 7f e8 de 33 db 4a 83 1b 82 a2 72 55 .......3.J....rU 0240 27 5e ec fe 25 bc cb 12 c6 88 c7 34 26 a4 d0 fa '^..%......4&... 0250 7e 96 67 0b 12 86 36 fa 0c 58 1c 27 9a 45 10 89 ~.g...6..X.'.E.. 0260 4e cd 3b b8 c4 a1 e3 0d 38 3f b5 21 9c 63 86 5c N.;.....8?.!.c.\ 0270 e8 2e 12 15 53 bc 2c 55 d6 0a 03 65 fe 83 e2 c8 ....S.,U...e.... 0280 3b 46 4c a7 ac bb 1f 5a 4c e3 59 75 13 50 77 59 ;FL....ZL.Yu.PwY 0290 9b 93 29 2f bf 29 bf 31 b1 d1 60 ab 42 42 fc 83 ..)/.).1..`.BB.. 02a0 4a 1c 32 2d 26 df 7e be 3f 79 45 f6 56 ab 6e be J.2-&.~.?yE.V.n. 02b0 8d aa dc 62 29 ea 3c a0 9e 2a 3f 10 57 45 a1 e3 ...b).<..*?.WE.. 02c0 4b 22 30 10 e4 a4 ce 00 31 59 89 20 5a b3 ed de K"0.....1Y. Z... 02d0 70 ff 78 c8 4d 64 ae a1 89 cd 41 4f 9d db 6a 2b p.x.Md....AO..j+ 02e0 5c b7 44 1c b4 4d e3 c9 82 2f 2c f5 ec e3 7c 8f \.D..M.../,...|. 02f0 ba 9d 66 68 46 96 94 44 44 49 61 86 56 8a 32 11 ..fhF..DDIa.V.2. 0300 d5 9b 8c cf a9 13 8b 77 0b ba de 27 dc 20 d4 d4 .......w...'. .. 0310 12 90 94 89 fd bb 7f 58 71 11 e0 30 2c 44 db da .......Xq..0,D.. 0320 2b 18 04 89 55 49 f4 17 85 ed f6 f4 c8 e7 b5 f7 +...UI.......... 0330 8c eb 68 3d 80 f4 fc a6 d4 67 dc be 7a 2a 52 0c ..h=.....g..z*R. 0340 c7 69 f7 ea 08 b0 2b 0c 55 fb 8a 2b 8c 4a ab f6 .i....+.U..+.J.. 0350 d9 c5 c7 b1 9e 30 a3 49 56 92 9b 8f 49 06 34 29 .....0.IV...I.4) 0360 ef c4 e8 3a d0 0d 19 fe 30 ed ab 55 1a 73 de 82 ...:....0..U.s.. 0370 08 90 54 b9 34 31 8c 1c 54 d8 8b 76 53 89 a4 d5 ..T.41..T..vS... 0380 c9 ec ac f4 2b 39 9f 54 eb f9 0a ca af e9 09 bd ....+9.T........ 0390 52 2a 03 c9 9f 6d 56 04 b0 33 d8 2e 7d c8 48 ee R*...mV..3..}.H. 03a0 96 7e ea 4b 3d 98 de 49 c4 78 5b 99 18 0c db 39 .~.K=..I.x[....9 03b0 3b 6e 2c d5 ce b6 9e 06 cc a7 59 5e fa c3 0e 7e ;n,.......Y^...~ 03c0 07 f6 9a 47 66 57 bf 5f 23 c4 47 60 6a 39 1c 28 ...GfW._#.G`j9.( 03d0 95 d4 64 d7 d2 e9 9d ef b8 1a a3 24 7c 2f cd c9 ..d........$|/.. 03e0 82 be 2d 5c b4 fb 15 e7 bd 9c af 4b bd c3 ac f9 ..-\.......K.... 03f0 87 24 d9 b8 5b e1 23 16 22 1b be d4 fd fe cd e8 .$..[.#."....... 0400 62 0d 6f 27 7f 98 3a 9b 9f d3 bb bf d1 de 1c a3 b.o'..:......... 0410 0c 72 38 76 d0 89 15 7a fa 12 91 ab bc eb cf db .r8v...z........ 0420 a5 7f 75 6d 48 c6 88 69 72 98 83 7f da 27 87 76 ..umH..ir....'.v 0430 9c 8c d0 47 85 9e 15 01 6f e6 f3 9b da 8c 66 64 ...G....o.....fd 0440 14 18 fe 5f 82 69 a1 de ef f5 aa 9a ae 59 4c 21 ..._.i.......YL! 0450 9a a1 8f 35 ec 48 a0 41 a7 b6 a3 58 a0 bd 90 7b ...5.H.A...X...{ 0460 f2 3b 84 4a b6 61 86 13 29 f2 31 3d c5 b0 17 86 .;.J.a..).1=.... 0470 6f 3e 53 3f ec b0 1a 40 93 8f 7f 3c d2 23 53 b0 o>S?...@...<.#S. 0480 9d 6a 82 b0 c4 ba c9 ee b7 06 22 84 8b de b9 bc .j........"..... 0490 4b c1 85 e5 79 3f e0 3e ee 97 ad 22 b8 20 34 bd K...y?.>...". 4. 04a0 23 c9 e6 32 bf ae f0 2c d4 cc 9b b8 e3 a8 d6 d5 #..2...,........ 04b0 6b d9 6c 07 bb 71 7b e6 59 da 21 f8 c5 09 6a 89 k.l..q{.Y.!...j. 04c0 67 e0 1f 4c e2 4a d4 47 b6 79 8c 16 dd 2d 46 eb g..L.J.G.y...-F. 04d0 bb 5c 05 4a 3d 1e 5a 07 ac b8 aa 8c f9 e0 ce fe .\.J=.Z......... 04e0 89 b2 9a 33 87 86 06 1b 92 ec 99 35 6d 28 b6 af ...3.......5m(.. 04f0 a5 11 fd cf 43 a8 5d 57 c5 9c a3 5c d1 f7 bd 0c ....C.]W...\.... 0500 c8 a8 61 ad 60 6e 43 b9 fe 44 be 1c 4f 17 65 b7 ..a.`nC..D..O.e. 0510 92 6c 43 a0 9f 1f 83 7b 21 33 63 77 85 50 5a 46 .lC....{!3cw.PZF 0520 3c ae d9 a6 f8 6b f2 55 5b 81 d3 12 5b 7a 25 df <....k.U[...[z%. 0530 13 cf ab bd e8 ba 3c 1a 54 52 35 59 7e e4 d3 89 ......<.TR5Y~... 0540 4d d5 ba 36 80 48 67 dc bb cf 9c 7d f9 19 21 df M..6.Hg....}..!. 0550 58 f9 d5 b4 13 70 ed da 77 9a cd 87 b9 9c e4 42 X....p..w......B 0560 07 71 a6 9f 2e 06 ef 77 f3 ac e3 40 5c 8e ef d1 .q.....w...@\... 0570 a8 ec 70 2c 9b 51 a4 6c 72 e9 5d 16 59 95 1e f3 ..p,.Q.lr.].Y... 0580 f8 c4 1f b6 c1 0f 0f 7c 1a cf 62 5f 8b ed 9c bb .......|..b_.... 0590 cd 6a 24 1a 07 40 83 e3 c9 b2 7b 4a a9 94 92 34 .j$..@....{J...4 05a0 94 ba 81 0b e5 ab 48 36 17 e9 59 75 81 4c 57 b3 ......H6..Yu.LW. 05b0 61 43 a5 de 0b 08 29 97 bb 72 13 32 b1 22 16 42 aC....)..r.2.".B 05c0 29 4a e3 76 4d 05 2e f4 f4 78 01 62 3f 48 80 31 )J.vM....x.b?H.1 05d0 e4 b8 4b c6 08 fa a6 59 83 b7 bc af 51 93 b8 70 ..K....Y....Q..p 05e0 50 db c3 8c d0 18 2f cd 39 e6 e7 8b a1 15 84 8c P...../.9....... 05f0 8e 8d fc f0 90 b8 ee 48 11 92 ee f2 8d 29 2d f2 .......H.....)-. 0600 1f ba 3e 08 59 50 3d d2 1c ce d2 9f 84 35 c3 4a ..>.YP=......5.J 0610 19 34 f2 d2 12 df 41 89 36 57 5a 97 16 f0 69 8a .4....A.6WZ...i. 0620 8c 14 b0 d1 98 f9 ec 0e 47 41 92 a0 6e 9b 47 e1 ........GA..n.G. 0630 25 8b a3 d6 05 3e 78 0a 5d 47 e3 63 89 93 b7 ab %....>x.]G.c.... 0640 a7 33 86 ff c4 3c 3f 12 8b d4 8b b2 9f c1 f4 33 .3... ldap [ACK] Seq=2832 Ack=6134 Win=64240 Len=0 Frame 132 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2832, Ack: 6134, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 0a 40 00 80 06 bf b9 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 11 e0 0b 68 6b 73 50 10 .e.........hksP. 0030 fa f0 f4 8a 00 00 00 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 133 62.117562 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 133 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2832, Ack: 6134, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFDDA552721D346BFB10F657505896B394... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: DDA552721D346BFB krb5_sgn_cksum: 10F657505896B394 krb5_confounder: C1A62ED391BAE138 GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 0b 40 00 80 06 bf 52 ac 1f 01 68 ac 1f ....@....R...h.. 0020 01 65 07 f0 01 85 d3 1c 11 e0 0b 68 6b 73 50 18 .e.........hksP. 0030 fa f0 43 c5 00 00 00 00 00 62 60 60 06 09 2a 86 ..C......b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff dd H............... 0050 a5 52 72 1d 34 6b fb 10 f6 57 50 58 96 b3 94 c1 .Rr.4k...WPX.... 0060 a6 2e d3 91 ba e1 38 2a 41 c4 af ac 7a 80 cf 60 ......8*A...z..` 0070 fb a4 0e 03 37 21 2d 1f 0b 6b f8 0e a1 39 b0 b9 ....7!-..k...9.. 0080 14 0b 3b b0 de fb b0 be 3d 72 3a ff 11 f0 1f 65 ..;.....=r:....e 0090 d8 fb 1f 16 3c 6e fb 61 fe bd fe 07 ....>i;...w...... 0110 2b d8 6e f0 99 33 e2 06 af 28 65 bd 6e 25 65 3d +.n..3...(e.n%e= 0120 3b 99 da a9 ae 95 d9 20 74 5a e5 a5 91 26 2b 00 ;...... tZ...&+. 0130 ab bd 1c 5d b0 db 00 19 86 c5 da 55 4e 9a 82 8e ...].......UN... 0140 bd 24 d8 fc ad 27 a7 0f b3 41 56 03 80 8d c2 a7 .$...'...AV..... 0150 50 71 c5 ae ac 88 d8 46 4b 71 50 9a 81 e1 26 bc Pq.....FKqP...&. 0160 14 93 fe cb d1 14 51 0b e1 c2 59 98 4a a8 43 a5 ......Q...Y.J.C. 0170 57 74 c5 cc 6c de a5 61 b0 a2 37 ab 94 b3 4a 69 Wt..l..a..7...Ji 0180 ec f7 05 83 b6 ec e4 ac ee b9 b3 81 01 60 7b a2 .............`{. 0190 2a d7 99 13 87 c4 5a c4 3c 27 ec fd 52 54 66 6d *.....Z.<'..RTfm 01a0 e6 46 c4 38 fd 64 05 6c 59 2e 72 f3 95 9c ef 8d .F.8.d.lY.r..... 01b0 05 28 2f 38 aa 58 4f 4f 2b db 68 67 92 1c d7 01 .(/8.XOO+.hg.... 01c0 26 e2 ad 98 1b 88 b0 15 2c eb 2c 94 d7 4d 30 de &.......,.,..M0. 01d0 64 04 34 61 0c e3 b1 1b 1d 73 cb 2f ab a3 51 c7 d.4a.....s./..Q. 01e0 e9 c6 e9 aa 7f 52 60 e1 d4 8c c1 52 d5 5b 87 ae .....R`....R.[.. 01f0 03 55 da ab 98 6e 4b b5 b3 70 17 86 6b 78 bd 3c .U...nK..p..kx.< 0200 d3 ec c5 a0 9a ed 57 f8 17 fa e0 7b dd 7f 77 cb ......W....{..w. 0210 15 cb ee 9f 79 25 4c d1 33 ac 76 fe 6e a4 47 60 ....y%L.3.v.n.G` 0220 3f 03 f2 03 3a 97 08 04 6c 10 35 51 71 ba c6 39 ?...:...l.5Qq..9 0230 83 6e 06 fd 70 91 89 b2 12 f0 1b 04 f4 fa 5b 70 .n..p.........[p 0240 9c 80 75 0c 44 6c 59 aa 44 cd e5 09 2d 43 f3 ca ..u.DlY.D...-C.. 0250 19 a3 36 eb fc fe 1c e7 10 3f c9 17 4c d0 54 81 ..6......?..L.T. 0260 fb 43 40 85 ec 4b e5 06 56 b1 19 63 61 bb 54 c0 .C@..K..V..ca.T. 0270 90 b8 4b f7 65 8c 2f cf 9b 71 7c 2e ae f9 52 ef ..K.e./..q|...R. 0280 53 68 55 b2 97 31 0b 26 56 cc d7 17 77 cb c1 c9 ShU..1.&V...w... 0290 9a 85 7e ba ed d7 d9 ac 27 78 7f 39 75 e5 89 5a ..~.....'x.9u..Z 02a0 e0 ca da 30 4f 6a 1f b7 ab 56 90 91 4a a8 05 89 ...0Oj...V..J... 02b0 a0 e3 cf 6f 1f 05 16 d3 f0 41 8f 6b 85 61 59 54 ...o.....A.k.aYT 02c0 ad d4 8b f5 2a 8c 03 af 59 97 6d 16 35 e6 a3 8f ....*...Y.m.5... 02d0 cd a7 d4 dd 2c cc 9c 64 30 bc 47 14 02 fb 4d c8 ....,..d0.G...M. 02e0 b9 b6 8f 55 67 44 b8 25 f4 d0 84 4d 0a 99 7c 51 ...UgD.%...M..|Q 02f0 06 b8 38 52 48 82 c0 c4 73 3a 74 ab 6d b9 29 38 ..8RH...s:t.m.)8 0300 69 e0 eb 1f 6f e2 f8 02 65 cc 16 38 0a 92 d3 ce i...o...e..8.... 0310 4b dc 4a 73 66 87 41 33 c3 73 4a d0 91 37 9d 91 K.Jsf.A3.sJ..7.. 0320 db 75 d7 e8 b4 92 99 08 e5 62 08 25 48 e1 56 59 .u.......b.%H.VY 0330 0e cb 8c 6b a5 3b 7f ef 15 9e e5 ea 47 75 7a 6f ...k.;......Guzo 0340 a8 ff 03 84 7e 78 1e 4a d7 ae a2 71 21 7d 39 79 ....~x.J...q!}9y 0350 cf 25 20 7f 71 ee 5c 6d 82 15 85 ad 3f e5 3b 4f .% .q.\m....?.;O 0360 74 bb ff 29 f5 14 c8 bd 87 58 47 aa c4 5a 77 86 t..).....XG..Zw. 0370 86 27 a7 76 d6 2f 67 db dd 42 05 a1 18 03 03 e8 .'.v./g..B...... 0380 19 80 98 f1 8f dd 5a 84 61 98 1b f9 e4 df 4e 09 ......Z.a.....N. 0390 d4 ca 6a 49 fa 31 2f 6b b6 a1 64 1c 32 f7 d0 b4 ..jI.1/k..d.2... 03a0 32 ba b8 60 7d a8 1e fe ec f4 5e 88 6a 53 b9 12 2..`}.....^.jS.. 03b0 ce 5e be 83 95 45 56 ad f4 80 22 2a 38 a9 fb aa .^...EV..."*8... 03c0 44 09 61 81 aa 01 4e 5b 19 58 e4 25 35 d0 34 5f D.a...N[.X.%5.4_ 03d0 9f d2 50 02 92 78 80 ff 93 b1 28 53 dd 73 d5 d3 ..P..x....(S.s.. 03e0 cb 6d d1 b2 b0 5a 5e 5d 06 74 e1 6a f6 13 38 68 .m...Z^].t.j..8h 03f0 82 34 a1 1c 92 25 c8 7a df 8a 78 f3 f0 7b eb 06 .4...%.z..x..{.. 0400 a8 35 ec b3 68 8a 13 12 e4 1b 3f e0 eb 8d 2e e5 .5..h.....?..... 0410 b0 cb 96 82 66 fc 18 6b 20 fa dc 63 8d 09 db 64 ....f..k ..c...d 0420 7a 4b cf fd ea e8 14 71 7a 9d 74 0d 0c f1 24 4e zK.....qz.t...$N 0430 b6 b3 c4 df e4 5d 9a 6b 7c 6b 8c a3 5e 52 42 8f .....].k|k..^RB. 0440 75 54 b5 58 03 4f a2 66 27 13 96 45 6e 4f a0 a8 uT.X.O.f'..EnO.. 0450 d1 c9 1d af 7c 58 b5 0d d1 59 22 b6 c4 d8 96 b6 ....|X...Y"..... 0460 8d 95 5c 9c 7c 99 4e 46 09 db 3d d6 c3 d7 74 7e ..\.|.NF..=...t~ 0470 5e f2 f5 1f 38 2c ee 53 8a f8 63 93 22 33 dd 77 ^...8,.S..c."3.w 0480 f4 31 d0 47 70 cb bc c9 78 5d 2b 5b c1 3f 77 15 .1.Gp...x]+[.?w. 0490 b0 f9 b9 80 9f 0d 2b 3d c2 d2 9b 0e 33 e9 ce 89 ......+=....3... 04a0 08 96 d5 56 eb 37 af 9a 02 ce 8d 4c 69 44 39 56 ...V.7.....LiD9V 04b0 d4 b8 69 37 ce 5b e4 cd 3e 06 54 b7 21 c5 53 77 ..i7.[..>.T.!.Sw 04c0 2a 3b a8 91 f9 73 02 20 58 6d 34 69 c0 b9 27 e3 *;...s. Xm4i..'. 04d0 35 15 03 f2 3f 5f 6c 25 5f 0e b9 09 f1 9a bf f6 5...?_l%_....... 04e0 3d 8f 78 dd 77 2a 7a 16 1b 1e c1 59 0d 6c 02 28 =.x.w*z....Y.l.( 04f0 ee 72 49 19 bd bc 9d 67 a6 6f c2 c4 df 6c 76 03 .rI....g.o...lv. 0500 f2 d4 12 d1 2a 55 ff a0 1b 23 d9 45 c5 26 06 98 ....*U...#.E.&.. 0510 b7 da 68 ce b8 f6 df 28 54 41 b7 a2 f0 a0 f5 ed ..h....(TA...... 0520 0e 5c a5 a2 95 c4 75 e6 2b 0b 3f 35 b1 46 48 7c .\....u.+.?5.FH| 0530 e1 e3 a9 ee f4 79 36 36 e3 4e 05 14 72 a6 80 00 .....y66.N..r... 0540 b2 10 05 a0 02 8a 89 28 3e bb ab 30 24 b2 ad 37 .......(>..0$..7 0550 24 b2 fe db e4 2b 45 42 12 a1 3f 44 88 f6 ce b1 $....+EB..?D.... 0560 4a fd ce e7 18 d0 57 f8 54 6e c8 35 6c 01 75 14 J.....W.Tn.5l.u. 0570 06 51 2b d0 b6 34 ff e8 97 1d 75 12 da 3f 6f d4 .Q+..4....u..?o. 0580 b8 c8 cd f4 b5 dc b0 c1 b8 0f e5 14 b4 d5 8a a0 ................ 0590 74 98 0e 60 c6 f2 0e e7 44 e1 9d c5 bf 69 11 ad t..`....D....i.. 05a0 d5 de 22 4d d3 05 bd 9b ec 5d b5 de 50 b1 e1 ae .."M.....]..P... 05b0 c4 44 ee ef 3b eb 90 1e 4f d0 eb 16 3e b1 d3 ab .D..;...O...>... 05c0 e6 9e 5c 05 36 2d d2 9a 5d 26 ed 3a 54 cf b4 ff ..\.6-..]&.:T... 05d0 5f 3b 76 c0 e5 17 0b c5 19 85 93 ed bb cc fc b7 _;v............. 05e0 10 fb 8b 8d 79 2c 86 53 55 73 ....y,.SUs No. Time Source Destination Protocol Info 135 62.118550 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 135 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 7594, Ack: 2934, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9E8A6B30E8559B64CF0666B2D1896B3F... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9E8A6B30E8559B64 krb5_sgn_cksum: CF0666B2D1896B3F krb5_confounder: FFD2F26FE4D992D2 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2d f7 40 00 80 06 6d a0 ac 1f 01 65 ac 1f .U-.@...m....e.. 0020 01 68 01 85 07 f0 0b 68 71 27 d3 1c 12 46 50 18 .h.....hq'...FP. 0030 f5 4a 1e 76 00 00 f9 6e b4 42 f0 14 f1 31 14 2c .J.v...n.B...1., 0040 ff 9b a7 a2 59 a4 ab 1c 74 b5 97 d1 16 46 18 a7 ....Y...t....F.. 0050 7b 0e 3e 64 35 8d f0 81 96 34 84 03 c7 2a 66 e1 {.>d5....4...*f. 0060 79 d1 3c a6 48 21 5d e8 9c a4 ac 91 f5 9f e8 37 y.<.H!]........7 0070 72 ce 2e b1 ca b7 b4 52 10 d2 e2 aa 05 51 7a e1 r......R.....Qz. 0080 5e 50 57 c3 d3 54 54 1d b6 57 1b 7c 70 ee e6 5f ^PW..TT..W.|p.._ 0090 68 3e 4a 7c e2 6f 7b 56 d0 f9 63 a0 c3 1b 93 1e h>J|.o{V..c..... 00a0 5f 26 a1 79 c4 d2 ea df 5c d4 e5 7f 6a 6a 96 0b _&.y....\...jj.. 00b0 b8 3f 3d 33 48 6c b7 db c4 df 57 2f e7 47 f8 6e .?=3Hl....W/.G.n 00c0 69 74 1b 87 b5 69 ef 19 ba 9d 7e 15 9b 63 63 3a it...i....~..cc: 00d0 76 33 d5 37 7b 4b 58 fb 7a 94 a6 f1 f0 fb ed 30 v3.7{KX.z......0 00e0 78 8c de e5 40 e0 9f 74 44 e4 87 8e 69 63 97 65 x...@..tD...ic.e 00f0 eb 69 ce 90 35 53 07 3b 33 ab 4f 03 bf b6 c5 0c .i..5S.;3.O..... 0100 4a 40 fa 9a c5 71 9c d6 0b 79 40 6c ac 05 e9 e6 J@...q...y@l.... 0110 f4 d2 79 e8 a2 5f 4c 6f 9c 91 66 68 9a 87 34 e8 ..y.._Lo..fh..4. 0120 c2 7c 55 b2 c4 c9 80 3f ee e5 dd 4c 4d 9f cf 18 .|U....?...LM... 0130 0c c1 7b d3 24 c6 f7 fb a3 db 2e 9c 5d b3 ad eb ..{.$.......]... 0140 ac cc f5 a6 f4 3f ca b6 f4 29 c3 5a b7 e2 85 6c .....?...).Z...l 0150 26 3b 58 3a c8 f5 5d 41 03 b2 f1 34 21 3d a7 45 &;X:..]A...4!=.E 0160 e5 a2 de 80 c5 ea 64 72 c8 80 e6 6f 75 d4 2c 54 ......dr...ou.,T 0170 e8 63 49 57 6f 60 2d 62 bc a9 d5 63 e1 32 07 28 .cIWo`-b...c.2.( 0180 f5 3f e9 7a ce 23 ee d3 47 e0 d3 bf ef b9 2e f1 .?.z.#..G....... 0190 1d d1 ed 6f 6a dd 20 10 c1 81 c6 06 df 77 87 d8 ...oj. ......w.. 01a0 0f 59 5e 94 93 1c af d7 0e dd 4d bf 6d 99 0e 94 .Y^.......M.m... 01b0 54 f4 ea 7b 56 0c 22 24 66 c3 23 e1 0a 82 b4 80 T..{V."$f.#..... 01c0 f0 c4 92 52 ce 13 bf f8 a1 1d de d7 e6 70 05 3e ...R.........p.> 01d0 90 08 b7 0f 9c 31 9b 40 a0 2f 79 7b 08 ea 74 b2 .....1.@./y{..t. 01e0 bd 60 17 67 c6 06 02 b6 cf 9c 17 94 8c ba 2f 42 .`.g........../B 01f0 6f c2 fd ae f8 39 e0 5e a0 d9 61 2f e4 65 61 e2 o....9.^..a/.ea. 0200 57 0a 88 79 21 ee ea 68 99 45 9f 45 8b ea 4e 34 W..y!..h.E.E..N4 0210 46 2a 17 18 c4 c5 7c e1 ae 29 d9 38 29 76 14 f9 F*....|..).8)v.. 0220 02 27 57 1e a1 7a 8b 4a b1 db 30 bf 6a 0b 0e 0b .'W..z.J..0.j... 0230 40 f1 e6 9a 55 d8 a4 cf b7 8b d2 1f 3a 66 e0 db @...U.......:f.. 0240 c5 44 65 bc 45 47 a9 01 d2 70 05 58 f3 e1 75 f9 .De.EG...p.X..u. 0250 90 49 f7 b9 0a ab 97 d6 45 ec 44 2b c4 ae ee ca .I......E.D+.... 0260 57 3e b1 69 23 f1 97 e3 26 b7 e1 87 ba 35 3b 85 W>.i#...&....5;. 0270 db 9d 7a fe 4f 93 3e 38 8a 6c 17 4d a8 0f 66 7a ..z.O.>8.l.M..fz 0280 15 ec be b9 d4 a2 53 3d d9 c3 e9 ba 89 5c cd 84 ......S=.....\.. 0290 b4 fa 63 a6 53 d2 d0 8d 3c 90 a9 5f 18 e8 ef 08 ..c.S...<.._.... 02a0 fc a2 04 e9 53 59 98 fd 56 6a 3e 65 f3 72 99 6f ....SY..Vj>e.r.o 02b0 e1 ea 13 a9 28 80 f4 f0 3c 2a 1d e3 3e 90 96 a4 ....(...<*..>... 02c0 a5 3a 68 15 7f 9b c0 96 6f 58 71 cf 2d 42 f5 b5 .:h.....oXq.-B.. 02d0 f2 fd 86 84 3f 39 14 b6 50 f0 70 19 2a c4 5a 17 ....?9..P.p.*.Z. 02e0 bc 07 15 b5 31 c1 63 1f 68 c9 c6 8e 8d 9d da af ....1.c.h....... 02f0 f0 6e af 68 d9 9c 18 55 a1 82 ba c8 12 68 76 f3 .n.h...U.....hv. 0300 5c 81 f9 c5 b4 31 2d d8 92 24 a2 2b cb dd 06 29 \....1-..$.+...) 0310 aa 32 ff ff 11 3a d2 71 16 3d ae c4 6e de 66 da .2...:.q.=..n.f. 0320 8d d3 a1 13 d9 43 c1 b5 61 7f 2f c4 44 f3 40 18 .....C..a./.D.@. 0330 8a 5b 30 86 ad 99 fd 2f 03 e1 34 d0 62 7f 7a 57 .[0..../..4.b.zW 0340 77 46 d6 5f 48 fc 6c 5f 12 e1 6a 68 ef e0 94 97 wF._H.l_..jh.... 0350 4e 08 bc fa 15 28 08 12 b3 f5 7a 89 fe bf a1 2f N....(....z..../ 0360 e4 db 6d cc 36 59 81 55 04 f6 b5 cc 33 f8 4f 12 ..m.6Y.U....3.O. 0370 ac 99 e4 c0 f6 70 d1 bf 1c aa e6 6c 36 03 28 b3 .....p.....l6.(. 0380 b8 9e 76 5a d0 f2 89 74 31 ee 7a f6 9b 1a 8a c5 ..vZ...t1.z..... 0390 a7 f7 38 3c 9d 05 bd b1 16 e1 a5 36 1d 97 c9 31 ..8<.......6...1 03a0 bd 12 a7 89 0b 14 a3 e3 30 d1 b1 e3 87 1d 7a 57 ........0.....zW 03b0 b1 4d a7 a0 89 4a c7 ec 32 03 45 e4 80 23 5f d6 .M...J..2.E..#_. 03c0 b7 ec 11 06 09 4a e8 35 8a 59 fb dd 63 fd 6f fc .....J.5.Y..c.o. 03d0 2a 27 45 b6 17 ca 90 99 ac ec c7 ce e7 a0 18 f9 *'E............. 03e0 5b 6f ab 20 3d f4 fa 06 c3 59 e0 ee 89 30 a6 81 [o. =....Y...0.. 03f0 90 8e fa 08 8f 2e 50 bb 4d 1d 00 4f 00 f8 13 d0 ......P.M..O.... 0400 5b 68 ad 4d 4a 28 a0 0e 32 47 01 7c 01 52 68 84 [h.MJ(..2G.|.Rh. 0410 75 b0 0a 46 62 f4 36 a2 1c 07 85 91 0a 13 b0 bd u..Fb.6......... 0420 fb 7d 25 27 4d f6 2a 64 d2 29 aa 3a 2b be f1 6c .}%'M.*d.).:+..l 0430 0b 9f a3 da bd 32 07 11 a0 77 63 c8 cf bf ca 95 .....2...wc..... 0440 08 c2 cd 1e c9 8f 99 7e fa 5e 86 40 55 3f d7 60 .......~.^.@U?.` 0450 42 27 6f ca 4a 9d 12 85 b1 b5 d3 89 df 17 f9 9c B'o.J........... 0460 ab 97 9e ... Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 9e 8a 6b 30 e8 .............k0. 0020 55 9b 64 cf 06 66 b2 d1 89 6b 3f ff d2 f2 6f e4 U.d..f...k?...o. 0030 d9 92 d2 38 e7 c3 52 ec e3 14 6e fd e5 8f 52 e2 ...8..R...n...R. 0040 40 d8 10 45 23 52 5d ba 90 f8 ba 76 6a d1 a1 bc @..E#R]....vj... 0050 df 35 9f 9a 7a 99 89 ca 4a 82 3d 44 80 4a 9f e9 .5..z...J.=D.J.. 0060 d4 5e cf e7 6d f3 47 93 51 b9 fc 9e f2 d5 01 4a .^..m.G.Q......J 0070 4b 88 05 da a8 22 dc d3 15 a7 a0 99 0e 3a ac e1 K....".......:.. 0080 f5 2e 7e 4c 68 b9 16 91 d6 89 18 66 4d ad ca 51 ..~Lh......fM..Q 0090 97 df 2b 95 dc a1 36 90 a3 d7 92 c1 1d cf 79 8c ..+...6.......y. 00a0 c5 cc f4 59 12 a7 1c cc de e8 58 62 cc 84 68 0f ...Y......Xb..h. 00b0 90 0e 93 49 c5 3d 9c 80 38 c6 3b 4b 9c 6d d7 49 ...I.=..8.;K.m.I 00c0 e1 49 9c 8f ef 79 da 88 20 cd 1a e3 3e 3e 69 3b .I...y.. ...>>i; 00d0 d0 e3 b5 77 d3 bc a2 df c1 2e 2b d8 6e f0 99 33 ...w......+.n..3 00e0 e2 06 af 28 65 bd 6e 25 65 3d 3b 99 da a9 ae 95 ...(e.n%e=;..... 00f0 d9 20 74 5a e5 a5 91 26 2b 00 ab bd 1c 5d b0 db . tZ...&+....].. 0100 00 19 86 c5 da 55 4e 9a 82 8e bd 24 d8 fc ad 27 .....UN....$...' 0110 a7 0f b3 41 56 03 80 8d c2 a7 50 71 c5 ae ac 88 ...AV.....Pq.... 0120 d8 46 4b 71 50 9a 81 e1 26 bc 14 93 fe cb d1 14 .FKqP...&....... 0130 51 0b e1 c2 59 98 4a a8 43 a5 57 74 c5 cc 6c de Q...Y.J.C.Wt..l. 0140 a5 61 b0 a2 37 ab 94 b3 4a 69 ec f7 05 83 b6 ec .a..7...Ji...... 0150 e4 ac ee b9 b3 81 01 60 7b a2 2a d7 99 13 87 c4 .......`{.*..... 0160 5a c4 3c 27 ec fd 52 54 66 6d e6 46 c4 38 fd 64 Z.<'..RTfm.F.8.d 0170 05 6c 59 2e 72 f3 95 9c ef 8d 05 28 2f 38 aa 58 .lY.r......(/8.X 0180 4f 4f 2b db 68 67 92 1c d7 01 26 e2 ad 98 1b 88 OO+.hg....&..... 0190 b0 15 2c eb 2c 94 d7 4d 30 de 64 04 34 61 0c e3 ..,.,..M0.d.4a.. 01a0 b1 1b 1d 73 cb 2f ab a3 51 c7 e9 c6 e9 aa 7f 52 ...s./..Q......R 01b0 60 e1 d4 8c c1 52 d5 5b 87 ae 03 55 da ab 98 6e `....R.[...U...n 01c0 4b b5 b3 70 17 86 6b 78 bd 3c d3 ec c5 a0 9a ed K..p..kx.<...... 01d0 57 f8 17 fa e0 7b dd 7f 77 cb 15 cb ee 9f 79 25 W....{..w.....y% 01e0 4c d1 33 ac 76 fe 6e a4 47 60 3f 03 f2 03 3a 97 L.3.v.n.G`?...:. 01f0 08 04 6c 10 35 51 71 ba c6 39 83 6e 06 fd 70 91 ..l.5Qq..9.n..p. 0200 89 b2 12 f0 1b 04 f4 fa 5b 70 9c 80 75 0c 44 6c ........[p..u.Dl 0210 59 aa 44 cd e5 09 2d 43 f3 ca 19 a3 36 eb fc fe Y.D...-C....6... 0220 1c e7 10 3f c9 17 4c d0 54 81 fb 43 40 85 ec 4b ...?..L.T..C@..K 0230 e5 06 56 b1 19 63 61 bb 54 c0 90 b8 4b f7 65 8c ..V..ca.T...K.e. 0240 2f cf 9b 71 7c 2e ae f9 52 ef 53 68 55 b2 97 31 /..q|...R.ShU..1 0250 0b 26 56 cc d7 17 77 cb c1 c9 9a 85 7e ba ed d7 .&V...w.....~... 0260 d9 ac 27 78 7f 39 75 e5 89 5a e0 ca da 30 4f 6a ..'x.9u..Z...0Oj 0270 1f b7 ab 56 90 91 4a a8 05 89 a0 e3 cf 6f 1f 05 ...V..J......o.. 0280 16 d3 f0 41 8f 6b 85 61 59 54 ad d4 8b f5 2a 8c ...A.k.aYT....*. 0290 03 af 59 97 6d 16 35 e6 a3 8f cd a7 d4 dd 2c cc ..Y.m.5.......,. 02a0 9c 64 30 bc 47 14 02 fb 4d c8 b9 b6 8f 55 67 44 .d0.G...M....UgD 02b0 b8 25 f4 d0 84 4d 0a 99 7c 51 06 b8 38 52 48 82 .%...M..|Q..8RH. 02c0 c0 c4 73 3a 74 ab 6d b9 29 38 69 e0 eb 1f 6f e2 ..s:t.m.)8i...o. 02d0 f8 02 65 cc 16 38 0a 92 d3 ce 4b dc 4a 73 66 87 ..e..8....K.Jsf. 02e0 41 33 c3 73 4a d0 91 37 9d 91 db 75 d7 e8 b4 92 A3.sJ..7...u.... 02f0 99 08 e5 62 08 25 48 e1 56 59 0e cb 8c 6b a5 3b ...b.%H.VY...k.; 0300 7f ef 15 9e e5 ea 47 75 7a 6f a8 ff 03 84 7e 78 ......Guzo....~x 0310 1e 4a d7 ae a2 71 21 7d 39 79 cf 25 20 7f 71 ee .J...q!}9y.% .q. 0320 5c 6d 82 15 85 ad 3f e5 3b 4f 74 bb ff 29 f5 14 \m....?.;Ot..).. 0330 c8 bd 87 58 47 aa c4 5a 77 86 86 27 a7 76 d6 2f ...XG..Zw..'.v./ 0340 67 db dd 42 05 a1 18 03 03 e8 19 80 98 f1 8f dd g..B............ 0350 5a 84 61 98 1b f9 e4 df 4e 09 d4 ca 6a 49 fa 31 Z.a.....N...jI.1 0360 2f 6b b6 a1 64 1c 32 f7 d0 b4 32 ba b8 60 7d a8 /k..d.2...2..`}. 0370 1e fe ec f4 5e 88 6a 53 b9 12 ce 5e be 83 95 45 ....^.jS...^...E 0380 56 ad f4 80 22 2a 38 a9 fb aa 44 09 61 81 aa 01 V..."*8...D.a... 0390 4e 5b 19 58 e4 25 35 d0 34 5f 9f d2 50 02 92 78 N[.X.%5.4_..P..x 03a0 80 ff 93 b1 28 53 dd 73 d5 d3 cb 6d d1 b2 b0 5a ....(S.s...m...Z 03b0 5e 5d 06 74 e1 6a f6 13 38 68 82 34 a1 1c 92 25 ^].t.j..8h.4...% 03c0 c8 7a df 8a 78 f3 f0 7b eb 06 a8 35 ec b3 68 8a .z..x..{...5..h. 03d0 13 12 e4 1b 3f e0 eb 8d 2e e5 b0 cb 96 82 66 fc ....?.........f. 03e0 18 6b 20 fa dc 63 8d 09 db 64 7a 4b cf fd ea e8 .k ..c...dzK.... 03f0 14 71 7a 9d 74 0d 0c f1 24 4e b6 b3 c4 df e4 5d .qz.t...$N.....] 0400 9a 6b 7c 6b 8c a3 5e 52 42 8f 75 54 b5 58 03 4f .k|k..^RB.uT.X.O 0410 a2 66 27 13 96 45 6e 4f a0 a8 d1 c9 1d af 7c 58 .f'..EnO......|X 0420 b5 0d d1 59 22 b6 c4 d8 96 b6 8d 95 5c 9c 7c 99 ...Y".......\.|. 0430 4e 46 09 db 3d d6 c3 d7 74 7e 5e f2 f5 1f 38 2c NF..=...t~^...8, 0440 ee 53 8a f8 63 93 22 33 dd 77 f4 31 d0 47 70 cb .S..c."3.w.1.Gp. 0450 bc c9 78 5d 2b 5b c1 3f 77 15 b0 f9 b9 80 9f 0d ..x]+[.?w....... 0460 2b 3d c2 d2 9b 0e 33 e9 ce 89 08 96 d5 56 eb 37 +=....3......V.7 0470 af 9a 02 ce 8d 4c 69 44 39 56 d4 b8 69 37 ce 5b .....LiD9V..i7.[ 0480 e4 cd 3e 06 54 b7 21 c5 53 77 2a 3b a8 91 f9 73 ..>.T.!.Sw*;...s 0490 02 20 58 6d 34 69 c0 b9 27 e3 35 15 03 f2 3f 5f . Xm4i..'.5...?_ 04a0 6c 25 5f 0e b9 09 f1 9a bf f6 3d 8f 78 dd 77 2a l%_.......=.x.w* 04b0 7a 16 1b 1e c1 59 0d 6c 02 28 ee 72 49 19 bd bc z....Y.l.(.rI... 04c0 9d 67 a6 6f c2 c4 df 6c 76 03 f2 d4 12 d1 2a 55 .g.o...lv.....*U 04d0 ff a0 1b 23 d9 45 c5 26 06 98 b7 da 68 ce b8 f6 ...#.E.&....h... 04e0 df 28 54 41 b7 a2 f0 a0 f5 ed 0e 5c a5 a2 95 c4 .(TA.......\.... 04f0 75 e6 2b 0b 3f 35 b1 46 48 7c e1 e3 a9 ee f4 79 u.+.?5.FH|.....y 0500 36 36 e3 4e 05 14 72 a6 80 00 b2 10 05 a0 02 8a 66.N..r......... 0510 89 28 3e bb ab 30 24 b2 ad 37 24 b2 fe db e4 2b .(>..0$..7$....+ 0520 45 42 12 a1 3f 44 88 f6 ce b1 4a fd ce e7 18 d0 EB..?D....J..... 0530 57 f8 54 6e c8 35 6c 01 75 14 06 51 2b d0 b6 34 W.Tn.5l.u..Q+..4 0540 ff e8 97 1d 75 12 da 3f 6f d4 b8 c8 cd f4 b5 dc ....u..?o....... 0550 b0 c1 b8 0f e5 14 b4 d5 8a a0 74 98 0e 60 c6 f2 ..........t..`.. 0560 0e e7 44 e1 9d c5 bf 69 11 ad d5 de 22 4d d3 05 ..D....i...."M.. 0570 bd 9b ec 5d b5 de 50 b1 e1 ae c4 44 ee ef 3b eb ...]..P....D..;. 0580 90 1e 4f d0 eb 16 3e b1 d3 ab e6 9e 5c 05 36 2d ..O...>.....\.6- 0590 d2 9a 5d 26 ed 3a 54 cf b4 ff 5f 3b 76 c0 e5 17 ..]&.:T..._;v... 05a0 0b c5 19 85 93 ed bb cc fc b7 10 fb 8b 8d 79 2c ..............y, 05b0 86 53 55 73 f9 6e b4 42 f0 14 f1 31 14 2c ff 9b .SUs.n.B...1.,.. 05c0 a7 a2 59 a4 ab 1c 74 b5 97 d1 16 46 18 a7 7b 0e ..Y...t....F..{. 05d0 3e 64 35 8d f0 81 96 34 84 03 c7 2a 66 e1 79 d1 >d5....4...*f.y. 05e0 3c a6 48 21 5d e8 9c a4 ac 91 f5 9f e8 37 72 ce <.H!]........7r. 05f0 2e b1 ca b7 b4 52 10 d2 e2 aa 05 51 7a e1 5e 50 .....R.....Qz.^P 0600 57 c3 d3 54 54 1d b6 57 1b 7c 70 ee e6 5f 68 3e W..TT..W.|p.._h> 0610 4a 7c e2 6f 7b 56 d0 f9 63 a0 c3 1b 93 1e 5f 26 J|.o{V..c....._& 0620 a1 79 c4 d2 ea df 5c d4 e5 7f 6a 6a 96 0b b8 3f .y....\...jj...? 0630 3d 33 48 6c b7 db c4 df 57 2f e7 47 f8 6e 69 74 =3Hl....W/.G.nit 0640 1b 87 b5 69 ef 19 ba 9d 7e 15 9b 63 63 3a 76 33 ...i....~..cc:v3 0650 d5 37 7b 4b 58 fb 7a 94 a6 f1 f0 fb ed 30 78 8c .7{KX.z......0x. 0660 de e5 40 e0 9f 74 44 e4 87 8e 69 63 97 65 eb 69 ..@..tD...ic.e.i 0670 ce 90 35 53 07 3b 33 ab 4f 03 bf b6 c5 0c 4a 40 ..5S.;3.O.....J@ 0680 fa 9a c5 71 9c d6 0b 79 40 6c ac 05 e9 e6 f4 d2 ...q...y@l...... 0690 79 e8 a2 5f 4c 6f 9c 91 66 68 9a 87 34 e8 c2 7c y.._Lo..fh..4..| 06a0 55 b2 c4 c9 80 3f ee e5 dd 4c 4d 9f cf 18 0c c1 U....?...LM..... 06b0 7b d3 24 c6 f7 fb a3 db 2e 9c 5d b3 ad eb ac cc {.$.......]..... 06c0 f5 a6 f4 3f ca b6 f4 29 c3 5a b7 e2 85 6c 26 3b ...?...).Z...l&; 06d0 58 3a c8 f5 5d 41 03 b2 f1 34 21 3d a7 45 e5 a2 X:..]A...4!=.E.. 06e0 de 80 c5 ea 64 72 c8 80 e6 6f 75 d4 2c 54 e8 63 ....dr...ou.,T.c 06f0 49 57 6f 60 2d 62 bc a9 d5 63 e1 32 07 28 f5 3f IWo`-b...c.2.(.? 0700 e9 7a ce 23 ee d3 47 e0 d3 bf ef b9 2e f1 1d d1 .z.#..G......... 0710 ed 6f 6a dd 20 10 c1 81 c6 06 df 77 87 d8 0f 59 .oj. ......w...Y 0720 5e 94 93 1c af d7 0e dd 4d bf 6d 99 0e 94 54 f4 ^.......M.m...T. 0730 ea 7b 56 0c 22 24 66 c3 23 e1 0a 82 b4 80 f0 c4 .{V."$f.#....... 0740 92 52 ce 13 bf f8 a1 1d de d7 e6 70 05 3e 90 08 .R.........p.>.. 0750 b7 0f 9c 31 9b 40 a0 2f 79 7b 08 ea 74 b2 bd 60 ...1.@./y{..t..` 0760 17 67 c6 06 02 b6 cf 9c 17 94 8c ba 2f 42 6f c2 .g........../Bo. 0770 fd ae f8 39 e0 5e a0 d9 61 2f e4 65 61 e2 57 0a ...9.^..a/.ea.W. 0780 88 79 21 ee ea 68 99 45 9f 45 8b ea 4e 34 46 2a .y!..h.E.E..N4F* 0790 17 18 c4 c5 7c e1 ae 29 d9 38 29 76 14 f9 02 27 ....|..).8)v...' 07a0 57 1e a1 7a 8b 4a b1 db 30 bf 6a 0b 0e 0b 40 f1 W..z.J..0.j...@. 07b0 e6 9a 55 d8 a4 cf b7 8b d2 1f 3a 66 e0 db c5 44 ..U.......:f...D 07c0 65 bc 45 47 a9 01 d2 70 05 58 f3 e1 75 f9 90 49 e.EG...p.X..u..I 07d0 f7 b9 0a ab 97 d6 45 ec 44 2b c4 ae ee ca 57 3e ......E.D+....W> 07e0 b1 69 23 f1 97 e3 26 b7 e1 87 ba 35 3b 85 db 9d .i#...&....5;... 07f0 7a fe 4f 93 3e 38 8a 6c 17 4d a8 0f 66 7a 15 ec z.O.>8.l.M..fz.. 0800 be b9 d4 a2 53 3d d9 c3 e9 ba 89 5c cd 84 b4 fa ....S=.....\.... 0810 63 a6 53 d2 d0 8d 3c 90 a9 5f 18 e8 ef 08 fc a2 c.S...<.._...... 0820 04 e9 53 59 98 fd 56 6a 3e 65 f3 72 99 6f e1 ea ..SY..Vj>e.r.o.. 0830 13 a9 28 80 f4 f0 3c 2a 1d e3 3e 90 96 a4 a5 3a ..(...<*..>....: 0840 68 15 7f 9b c0 96 6f 58 71 cf 2d 42 f5 b5 f2 fd h.....oXq.-B.... 0850 86 84 3f 39 14 b6 50 f0 70 19 2a c4 5a 17 bc 07 ..?9..P.p.*.Z... 0860 15 b5 31 c1 63 1f 68 c9 c6 8e 8d 9d da af f0 6e ..1.c.h........n 0870 af 68 d9 9c 18 55 a1 82 ba c8 12 68 76 f3 5c 81 .h...U.....hv.\. 0880 f9 c5 b4 31 2d d8 92 24 a2 2b cb dd 06 29 aa 32 ...1-..$.+...).2 0890 ff ff 11 3a d2 71 16 3d ae c4 6e de 66 da 8d d3 ...:.q.=..n.f... 08a0 a1 13 d9 43 c1 b5 61 7f 2f c4 44 f3 40 18 8a 5b ...C..a./.D.@..[ 08b0 30 86 ad 99 fd 2f 03 e1 34 d0 62 7f 7a 57 77 46 0..../..4.b.zWwF 08c0 d6 5f 48 fc 6c 5f 12 e1 6a 68 ef e0 94 97 4e 08 ._H.l_..jh....N. 08d0 bc fa 15 28 08 12 b3 f5 7a 89 fe bf a1 2f e4 db ...(....z..../.. 08e0 6d cc 36 59 81 55 04 f6 b5 cc 33 f8 4f 12 ac 99 m.6Y.U....3.O... 08f0 e4 c0 f6 70 d1 bf 1c aa e6 6c 36 03 28 b3 b8 9e ...p.....l6.(... 0900 76 5a d0 f2 89 74 31 ee 7a f6 9b 1a 8a c5 a7 f7 vZ...t1.z....... 0910 38 3c 9d 05 bd b1 16 e1 a5 36 1d 97 c9 31 bd 12 8<.......6...1.. 0920 a7 89 0b 14 a3 e3 30 d1 b1 e3 87 1d 7a 57 b1 4d ......0.....zW.M 0930 a7 a0 89 4a c7 ec 32 03 45 e4 80 23 5f d6 b7 ec ...J..2.E..#_... 0940 11 06 09 4a e8 35 8a 59 fb dd 63 fd 6f fc 2a 27 ...J.5.Y..c.o.*' 0950 45 b6 17 ca 90 99 ac ec c7 ce e7 a0 18 f9 5b 6f E.............[o 0960 ab 20 3d f4 fa 06 c3 59 e0 ee 89 30 a6 81 90 8e . =....Y...0.... 0970 fa 08 8f 2e 50 bb 4d 1d 00 4f 00 f8 13 d0 5b 68 ....P.M..O....[h 0980 ad 4d 4a 28 a0 0e 32 47 01 7c 01 52 68 84 75 b0 .MJ(..2G.|.Rh.u. 0990 0a 46 62 f4 36 a2 1c 07 85 91 0a 13 b0 bd fb 7d .Fb.6..........} 09a0 25 27 4d f6 2a 64 d2 29 aa 3a 2b be f1 6c 0b 9f %'M.*d.).:+..l.. 09b0 a3 da bd 32 07 11 a0 77 63 c8 cf bf ca 95 08 c2 ...2...wc....... 09c0 cd 1e c9 8f 99 7e fa 5e 86 40 55 3f d7 60 42 27 .....~.^.@U?.`B' 09d0 6f ca 4a 9d 12 85 b1 b5 d3 89 df 17 f9 9c ab 97 o.J............. 09e0 9e . No. Time Source Destination Protocol Info 136 62.118941 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=2934 Ack=8663 Win=64240 Len=0 Frame 136 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2934, Ack: 8663, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 0c 40 00 80 06 bf b7 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 12 46 0b 68 75 54 50 10 .e.......F.huTP. 0030 fa f0 ea 43 00 00 ac 1f 01 65 c5 d5 ...C.....e.. No. Time Source Destination Protocol Info 137 62.120033 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 137 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 2934, Ack: 8663, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF543E87611EB446D79D38B9DC210844CE... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 543E87611EB446D7 krb5_sgn_cksum: 9D38B9DC210844CE krb5_confounder: 27EC85A5B1FF438E GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 0d 40 00 80 06 bf 23 ac 1f 01 68 ac 1f ....@....#...h.. 0020 01 65 07 f0 01 85 d3 1c 12 46 0b 68 75 54 50 18 .e.......F.huTP. 0030 fa f0 4b 70 00 00 00 00 00 8f 60 81 8c 06 09 2a ..Kp......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 54 3e 87 61 1e b4 46 d7 9d 38 b9 dc 21 08 44 ce T>.a..F..8..!.D. 0060 27 ec 85 a5 b1 ff 43 8e 45 d1 f2 0a 6b d6 b6 84 '.....C.E...k... 0070 30 21 59 f2 04 71 01 65 77 b8 c1 f8 14 53 be d5 0!Y..q.ew....S.. 0080 b7 87 9a db dd f1 1d 11 4c 14 eb a4 80 d3 f7 16 ........L....... 0090 fd 29 ba d0 ef c0 3b 05 e3 b1 ce 92 78 6d 51 ad .)....;.....xmQ. 00a0 f6 17 6b 69 15 75 ca 04 71 5c ab df 2b 91 23 61 ..ki.u..q\..+.#a 00b0 59 cc c7 2d 52 99 df 6f fb 8f 52 cf 96 be 47 1d Y..-R..o..R...G. 00c0 b0 2e 8d 79 be a5 49 a0 fd ...y..I.. No. Time Source Destination Protocol Info 138 62.120740 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 138 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 8663, Ack: 3081, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE9A80C5B35C66EB2317FC8F8D5259592... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E9A80C5B35C66EB2 krb5_sgn_cksum: 317FC8F8D5259592 krb5_confounder: 0EC428E52CC8C14D GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2d f8 40 00 80 06 71 1a ac 1f 01 65 ac 1f ..-.@...q....e.. 0020 01 68 01 85 07 f0 0b 68 75 54 d3 1c 12 d9 50 18 .h.....huT....P. 0030 fa f0 2d 4f 00 00 00 00 00 ae 60 81 ab 06 09 2a ..-O......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 e9 a8 0c 5b 35 c6 6e b2 31 7f c8 f8 d5 25 95 92 ...[5.n.1....%.. 0060 0e c4 28 e5 2c c8 c1 4d 82 0a 1a bd 85 d4 d8 a9 ..(.,..M........ 0070 2c 25 f9 31 d3 ab bd 65 c4 40 7d 21 95 7e dc cb ,%.1...e.@}!.~.. 0080 e8 a7 bf af 22 25 5e 21 e0 ff 16 80 d6 d8 c2 72 ...."%^!.......r 0090 f4 8f 00 b0 92 b1 3b 8f 87 33 d3 17 40 18 cf 8b ......;..3..@... 00a0 cf cf a9 c8 04 a2 eb ae 6b da a3 31 1b d4 99 3a ........k..1...: 00b0 d5 ad 77 c3 d6 ba 4c d2 d2 40 22 5a f5 69 39 33 ..w...L..@"Z.i93 00c0 81 70 e7 c9 bd 9b 68 cb 2a ee 0b 4b 50 13 8c 4a .p....h.*..KP..J 00d0 13 92 2d 1b 6e 9f ab 91 a8 c9 27 b0 3d 29 36 07 ..-.n.....'.=)6. 00e0 dc 8f 7a 32 a6 13 f0 8f ..z2.... No. Time Source Destination Protocol Info 139 62.141304 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (187 bytes) Frame 139 (291 bytes on wire, 291 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3081, Ack: 8841, Len: 237 Lightweight Directory Access Protocol SASL Buffer Length: 233 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFDE28C11D5181E44708E78B86109D276A... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: DE28C11D5181E447 krb5_sgn_cksum: 08E78B86109D276A krb5_confounder: 42160A6D66E17F2C GSS-API Encrypted payload (187 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 15 e0 0e 40 00 80 06 be c8 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 12 d9 0b 68 76 06 50 18 .e.........hv.P. 0030 fa 3e 56 e4 00 00 00 00 00 e9 60 81 e6 06 09 2a .>V.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 de 28 c1 1d 51 81 e4 47 08 e7 8b 86 10 9d 27 6a .(..Q..G......'j 0060 42 16 0a 6d 66 e1 7f 2c f7 04 e6 e1 e5 f4 2b b3 B..mf..,......+. 0070 5a 49 19 b4 e7 63 9b 1a f1 df fd 72 69 3d b8 11 ZI...c.....ri=.. 0080 17 76 60 91 82 a0 c1 bd ff f5 42 12 f3 a1 8e 3d .v`.......B....= 0090 f2 eb f1 4f 26 ef 17 38 dd 74 f9 28 ef 40 f9 16 ...O&..8.t.(.@.. 00a0 df 89 9c 11 90 5d 2f d2 e8 a6 da ad 1d a2 b0 6f .....]/........o 00b0 26 46 8e 26 77 d7 84 7e 7c bb a9 ad 63 dc b8 86 &F.&w..~|...c... 00c0 a5 a9 b8 d4 e2 09 a1 e8 85 7d f5 07 ea 12 8c cd .........}...... 00d0 a4 69 2a 7a 21 d4 07 88 db 95 25 ff 42 15 9d 6f .i*z!.....%.B..o 00e0 a0 11 7a b5 9a 4e 8c c4 56 bf 9e 95 ed ec 34 2b ..z..N..V.....4+ 00f0 92 7f 49 ce a5 fc f5 06 82 2c c6 2e 93 ba c8 21 ..I......,.....! 0100 71 38 db f7 c2 bd 05 0b e0 68 92 83 61 b9 6b f7 q8.......h..a.k. 0110 41 f4 36 df 5a 3e 49 ff 33 81 21 42 cb 70 25 ea A.6.Z>I.3.!B.p%. 0120 47 06 ee G.. No. Time Source Destination Protocol Info 140 62.142519 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (177 bytes) Frame 140 (281 bytes on wire, 281 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 8841, Ack: 3318, Len: 227 Lightweight Directory Access Protocol SASL Buffer Length: 223 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF2974320FCF84A66F52156892144E2097... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 2974320FCF84A66F krb5_sgn_cksum: 52156892144E2097 krb5_confounder: 40A6382CFF5C1226 GSS-API Encrypted payload (177 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 0b 2d f9 40 00 80 06 70 e8 ac 1f 01 65 ac 1f ..-.@...p....e.. 0020 01 68 01 85 07 f0 0b 68 76 06 d3 1c 13 c6 50 18 .h.....hv.....P. 0030 fa 03 b1 53 00 00 00 00 00 df 60 81 dc 06 09 2a ...S......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 29 74 32 0f cf 84 a6 6f 52 15 68 92 14 4e 20 97 )t2....oR.h..N . 0060 40 a6 38 2c ff 5c 12 26 c0 8a b1 6e e3 13 30 2d @.8,.\.&...n..0- 0070 ad 95 43 2c fa 95 03 d0 f1 22 72 63 b9 69 37 d6 ..C,....."rc.i7. 0080 76 45 69 7d 8c 7c 1f 86 d8 f5 17 f5 81 1c a0 2a vEi}.|.........* 0090 03 e6 5a cb 09 f3 dd 1b e3 f6 c8 ac 17 5f e9 7b ..Z.........._.{ 00a0 19 4e 5a 4a c3 52 eb 37 6e 2c 55 89 6f 16 53 4f .NZJ.R.7n,U.o.SO 00b0 5e 1d 53 6c 01 1e dc 29 58 fc 22 62 ca b7 3f a7 ^.Sl...)X."b..?. 00c0 f0 20 ef 87 67 7d 1a 76 45 19 f8 d7 38 b4 64 26 . ..g}.vE...8.d& 00d0 ee 6d ff 05 61 2e 12 0a 82 05 fb e8 fd 92 30 59 .m..a.........0Y 00e0 45 9b 1f 2d 1b 32 e7 3a f3 bf 19 53 1a ec d6 4b E..-.2.:...S...K 00f0 70 59 1a 9f bc e4 43 d1 86 0d be 0b db f4 2f 01 pY....C......./. 0100 8b 4b dd 0d 55 1c 3c 7e bd ea 7f e0 4b ba 3e ae .K..U.<~....K.>. 0110 ca ab ee 11 57 ee 25 61 c8 ....W.%a. No. Time Source Destination Protocol Info 141 62.273769 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=3318 Ack=9068 Win=63835 Len=0 Frame 141 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3318, Ack: 9068, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 0f 40 00 80 06 bf b4 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 13 c6 0b 68 76 e9 50 10 .e.........hv.P. 0030 f9 5b e8 c3 00 00 05 00 00 03 10 00 .[.......... No. Time Source Destination Protocol Info 142 66.298622 172.31.1.110 172.31.255.255 BROWSER Local Master Announcement NT4PDC-110, Workstation, Server, Domain Controller, NT Workstation, Master Browser Frame 142 (243 bytes on wire, 243 bytes captured) Ethernet II, Src: 00:0c:29:a9:cd:43, Dst: ff:ff:ff:ff:ff:ff Internet Protocol, Src Addr: 172.31.1.110 (172.31.1.110), Dst Addr: 172.31.255.255 (172.31.255.255) User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port: netbios-dgm (138) NetBIOS Datagram Service SMB (Server Message Block Protocol) SMB MailSlot Protocol Microsoft Windows Browser Protocol 0000 ff ff ff ff ff ff 00 0c 29 a9 cd 43 08 00 45 00 ........)..C..E. 0010 00 e5 8d b0 00 00 80 11 52 ab ac 1f 01 6e ac 1f ........R....n.. 0020 ff ff 00 8a 00 8a 00 d1 08 f2 11 1a d9 6c ac 1f .............l.. 0030 01 6e 00 8a 00 bb 00 00 20 45 4f 46 45 44 45 46 .n...... EOFEDEF 0040 41 45 45 45 44 43 4e 44 42 44 42 44 41 43 41 43 AEEEDCNDBDBDACAC 0050 41 43 41 43 41 43 41 43 41 00 20 45 4f 46 45 44 ACACACACA. EOFED 0060 45 45 45 44 43 43 41 43 41 43 41 43 41 43 41 43 EEEDCCACACACACAC 0070 41 43 41 43 41 43 41 43 41 42 4f 00 ff 53 4d 42 ACACACACABO..SMB 0080 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 %............... 0090 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 21 ...............! 00a0 00 00 00 00 00 00 00 00 00 e8 03 00 00 00 00 00 ................ 00b0 00 00 00 21 00 56 00 03 00 01 00 00 00 02 00 32 ...!.V.........2 00c0 00 5c 4d 41 49 4c 53 4c 4f 54 5c 42 52 4f 57 53 .\MAILSLOT\BROWS 00d0 45 00 0f 00 80 fc 0a 00 4e 54 34 50 44 43 2d 31 E.......NT4PDC-1 00e0 31 30 00 00 00 00 00 00 04 00 0b 10 04 00 0f 01 10.............. 00f0 55 aa 00 U.. No. Time Source Destination Protocol Info 143 67.565905 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 143 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3318, Ack: 9068, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF0E7C485F2C0BAB7E034C07F34B02B1E8... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 0E7C485F2C0BAB7E krb5_sgn_cksum: 034C07F34B02B1E8 krb5_confounder: 39A16B88EE7C21BC GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 10 40 00 80 06 bf 4d ac 1f 01 68 ac 1f ....@....M...h.. 0020 01 65 07 f0 01 85 d3 1c 13 c6 0b 68 76 e9 50 18 .e.........hv.P. 0030 f9 5b 8d bd 00 00 00 00 00 62 60 60 06 09 2a 86 .[.......b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 0e H............... 0050 7c 48 5f 2c 0b ab 7e 03 4c 07 f3 4b 02 b1 e8 39 |H_,..~.L..K...9 0060 a1 6b 88 ee 7c 21 bc 02 a0 0a 5e 63 85 f7 0e 80 .k..|!....^c.... 0070 53 c1 61 ec b0 5f 7e ef 48 b2 b8 0e 38 54 ec a4 S.a.._~.H...8T.. 0080 6b d0 45 39 9a 8d 5f c3 49 11 89 00 1c c8 58 62 k.E9.._.I.....Xb 0090 c3 cf d6 dc b0 71 3d e6 58 a1 21 c1 .....q=.X.!. No. Time Source Destination Protocol Info 144 67.567007 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 144 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 9068, Ack: 3420, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d fa 40 00 80 06 6c 16 ac 1f 01 65 ac 1f ..-.@...l....e.. 0020 01 68 01 85 07 f0 0b 68 76 e9 d3 1c 14 2c 50 10 .h.....hv....,P. 0030 f9 9d 28 05 00 00 00 00 09 dd 60 82 09 d9 06 09 ..(.......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff d9 f1 69 64 be fb e3 10 0d 72 74 46 ba 8b 09 ...id.....rtF... 0060 af e7 8d 7b 55 6d b7 fd 71 00 98 73 50 ff a1 8d ...{Um..q..sP... 0070 69 72 f1 70 b7 b8 4e d8 8b 8c 57 b7 4d 3c b9 21 ir.p..N...W.M<.! 0080 4f 87 54 07 07 72 35 ba 51 aa f4 88 02 c8 62 11 O.T..r5.Q.....b. 0090 40 7d 40 8d a5 0c c3 32 35 d8 0b a8 e0 dc 9e 1c @}@....25....... 00a0 ef c1 28 10 46 db 82 d1 ed 75 e6 4e eb 01 95 94 ..(.F....u.N.... 00b0 70 2a 74 56 e1 26 a3 0e 4f 30 e1 e3 a5 81 b7 b7 p*tV.&..O0...... 00c0 95 61 cc ee 67 55 ef ba d6 db 51 7b 5b 5d 01 07 .a..gU....Q{[].. 00d0 1d c0 09 e1 c7 f2 49 26 3d 3d 56 d3 3f a5 53 ca ......I&==V.?.S. 00e0 30 e3 47 3e 01 91 93 8b 8f 09 be a3 e0 cf 2e 04 0.G>............ 00f0 f5 30 92 cc fb 3b d4 0c 63 a7 ec 32 ef 95 b2 1a .0...;..c..2.... 0100 51 97 0b 65 65 f2 f3 35 00 f9 8e e1 46 9b b2 07 Q..ee..5....F... 0110 a6 5a 58 3f b0 28 b5 4f 4c 3b 60 7c 76 ec 12 17 .ZX?.(.OL;`|v... 0120 f4 f4 db fb 80 1a cc 13 67 ef 31 e8 7d 56 89 49 ........g.1.}V.I 0130 e2 b6 a9 3d 35 d3 b4 57 2e b3 8c ac c1 9c 3e 47 ...=5..W......>G 0140 0c 43 61 4e 78 4b f9 22 0e a5 6f 5a fc a3 49 1f .CaNxK."..oZ..I. 0150 81 00 32 84 38 9a 6e 5d fa 2f 1d 21 8d 4e 36 1e ..2.8.n]./.!.N6. 0160 22 9f b2 60 7b 95 c3 ee 30 ca c4 35 b2 0a 28 b8 "..`{...0..5..(. 0170 d8 30 dc 47 d8 de 27 ae b4 cc 17 7d 76 ef 8f dc .0.G..'....}v... 0180 58 75 65 13 53 7e 6c ff 91 9e 8a 75 05 19 66 98 Xue.S~l....u..f. 0190 d1 bd a1 b8 04 b0 7c 7c 76 7a d8 72 ef ef 57 6d ......||vz.r..Wm 01a0 c8 77 ba 3a bc b1 06 ec 9f a4 a4 71 02 2b 6a 55 .w.:.......q.+jU 01b0 44 c8 6a 1e 04 29 3d 8d af 41 0f 11 ce 58 da fa D.j..)=..A...X.. 01c0 cf b3 5b f6 76 4a 3e d4 9a 3c 56 b3 ab b5 dc dc ..[.vJ>...B...d$$.C..@. 05e0 35 3b 58 db 21 ca 82 8d 6d 7f 5;X.!...m. No. Time Source Destination Protocol Info 145 67.567127 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 145 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 10528, Ack: 3420, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFD9F16964BEFBE3100D727446BA8B09AF... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: D9F16964BEFBE310 krb5_sgn_cksum: 0D727446BA8B09AF krb5_confounder: E78D7B556DB7FD71 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2d fb 40 00 80 06 6d 9c ac 1f 01 65 ac 1f .U-.@...m....e.. 0020 01 68 01 85 07 f0 0b 68 7c 9d d3 1c 14 2c 50 18 .h.....h|....,P. 0030 f9 9d 6d de 00 00 65 78 a2 42 88 9e 6b d0 3b 91 ..m...ex.B..k.;. 0040 0d 87 f8 57 4f 75 96 5f f2 4a f0 98 81 7d c2 1a ...WOu._.J...}.. 0050 d6 cb 82 84 c5 b1 45 06 e0 98 5c 42 4b 96 15 a6 ......E...\BK... 0060 d9 97 b5 a8 37 b6 3c 0e 40 31 0f 1a a1 6b 4e 24 ....7.<.@1...kN$ 0070 74 db 01 4b ee d7 c2 79 ad f7 4a f0 97 c9 2a b1 t..K...y..J...*. 0080 68 5e 73 51 3d 7a 10 4e 19 cf 63 4e 0b 08 24 22 h^sQ=z.N..cN..$" 0090 19 95 af ce 3f 89 71 42 ae 79 68 4a c1 cb 5c 81 ....?.qB.yhJ..\. 00a0 36 d9 78 2b 7d 86 ac 70 fd c9 e3 67 65 dc 87 43 6.x+}..p...ge..C 00b0 06 ac 72 63 d6 2e 1b 03 94 ce ac e4 18 11 86 1e ..rc............ 00c0 ed fb 3d 2b 87 7a 1b 2e 90 90 22 a3 fe 5a 64 58 ..=+.z...."..ZdX 00d0 a9 9b 44 90 eb 81 10 21 ea 11 6e 63 80 31 26 26 ..D....!..nc.1&& 00e0 b9 be b4 e5 24 f3 5c 42 e6 fc 98 86 7f 4c 84 21 ....$.\B.....L.! 00f0 a1 f3 30 7d 0c c6 b1 da a8 c7 94 e3 73 fe 43 40 ..0}........s.C@ 0100 26 ee c0 78 87 f5 80 bf f8 16 ce 23 36 30 5a d3 &..x.......#60Z. 0110 c9 30 bc 48 e6 be e7 b8 5e 2d 88 a1 17 f1 98 2a .0.H....^-.....* 0120 0a d9 76 9f 20 65 bf b1 91 fc 52 c9 44 95 24 b6 ..v. e....R.D.$. 0130 b1 fa 00 e7 63 e5 a8 5c 73 68 4b 5e a1 b0 25 39 ....c..\shK^..%9 0140 aa b6 3a d6 55 68 20 f4 8d 34 06 90 75 31 ec c2 ..:.Uh ..4..u1.. 0150 72 b2 20 f0 32 67 31 06 6c ae 1a 2e 9f cb ad 7f r. .2g1.l....... 0160 25 06 d6 4e 65 c2 10 9b 1d 2c 34 94 fc 8f e2 cb %..Ne....,4..... 0170 73 41 09 62 56 be df 5d 15 4c fb 1e 38 13 b5 d0 sA.bV..].L..8... 0180 9c 53 16 5c 62 a3 4a 27 71 9a 4d 4c db c2 38 21 .S.\b.J'q.ML..8! 0190 01 ac bc 1e 6f 1a 68 dc c9 b9 8f 8d a8 62 1d 89 ....o.h......b.. 01a0 bc 50 2a 76 e5 b3 4e a8 2a aa 10 86 bf dc ba 5d .P*v..N.*......] 01b0 96 6d 33 ab 57 c0 a8 42 72 52 f9 63 0d c1 ea f7 .m3.W..BrR.c.... 01c0 29 db 49 f2 7a ee fe 65 e3 4f 58 03 00 62 f9 39 ).I.z..e.OX..b.9 01d0 1f 41 6b f8 8d 5a a7 84 11 58 66 94 04 ab 15 a6 .Ak..Z...Xf..... 01e0 95 61 4b 49 1a 46 b0 0d b2 68 c5 9d e8 7d b3 2c .aKI.F...h...}., 01f0 53 c2 5e 7e f6 60 b9 1a b3 73 f5 01 ab 27 61 25 S.^~.`...s...'a% 0200 3d 6b 4f 2c fb 25 a8 9a 70 0b 45 6f 62 23 81 87 =kO,.%..p.Eob#.. 0210 c1 f9 e2 3c 48 a8 a6 15 0d 8b d6 7c 75 a3 f6 1e ....:..x 02f0 85 4f 68 40 56 78 45 84 fa 4a bd 62 28 3a c5 fc .Oh@VxE..J.b(:.. 0300 5f 26 a2 63 a1 a1 34 c4 f5 95 dc 12 ca 12 fa 8d _&.c..4......... 0310 28 d8 c2 59 53 50 40 a7 a0 ab 5f ff 78 3b 7c 23 (..YSP@..._.x;|# 0320 cc 21 f5 fe bc b0 5a 0d 78 33 c8 7a 92 61 7b 4c .!....Z.x3.z.a{L 0330 aa ed 66 ed 61 17 81 b4 9c 64 22 cf ba db c3 38 ..f.a....d"....8 0340 55 fb fc 66 a7 40 be 15 c8 0a f4 01 a2 dc 2f ba U..f.@......../. 0350 9a 8c 91 02 6c 66 1d 95 4b d0 f7 67 39 23 50 13 ....lf..K..g9#P. 0360 e5 65 8b 0e aa 83 85 c5 eb 6c d4 c7 a6 65 c2 cc .e.......l...e.. 0370 7c 51 f4 da ef b8 66 51 37 07 10 fa 71 86 5c 5a |Q....fQ7...q.\Z 0380 b8 5b 72 c3 1a 43 86 03 2b 32 c1 b8 29 35 86 0c .[r..C..+2..)5.. 0390 b6 96 3b 1b fa 7c ff ee 78 28 a9 19 f7 ed a7 ca ..;..|..x(...... 03a0 a7 3e b4 d9 93 34 b6 38 77 df 6a bd 0f d4 25 c8 .>...4.8w.j...%. 03b0 82 bd bc ac 7e c5 24 b4 d3 3e f6 1e 0d 2c 7c f7 ....~.$..>...,|. 03c0 34 62 ce f8 4d f8 da ae a8 e1 da c7 3f 5d e3 98 4b..M.......?].. 03d0 d9 d9 3b 07 66 7a 00 c4 ca 47 0f 0e bb 02 ea 9f ..;.fz...G...... 03e0 d8 52 40 28 ba 98 ac 44 c9 fe c1 1a 1a 1d 21 d9 .R@(...D......!. 03f0 93 20 69 7d 90 10 25 ff 60 42 08 09 f4 4a c5 c5 . i}..%.`B...J.. 0400 5f 6d db 5d ec 9a 9e ff 33 10 5c 1e 71 36 ad 3b _m.]....3.\.q6.; 0410 7d f4 3d 57 22 79 86 b5 3a a4 bf e4 8c 52 d4 43 }.=W"y..:....R.C 0420 bd 6f e2 9a aa 80 6f 99 55 48 58 b5 db 9f d3 a2 .o....o.UHX..... 0430 fe bc fc e6 fc de a9 01 a9 58 50 9d 3c 10 57 e2 .........XP.<.W. 0440 d6 f5 a7 d1 39 1d bc bf 87 2e dc 3f bb 57 0e de ....9......?.W.. 0450 18 24 20 a7 b1 a7 d7 4b 3d 2d cb dc 52 51 18 1c .$ ....K=-..RQ.. 0460 53 1d 27 S.' Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff d9 f1 69 64 be .............id. 0020 fb e3 10 0d 72 74 46 ba 8b 09 af e7 8d 7b 55 6d ....rtF......{Um 0030 b7 fd 71 00 98 73 50 ff a1 8d 69 72 f1 70 b7 b8 ..q..sP...ir.p.. 0040 4e d8 8b 8c 57 b7 4d 3c b9 21 4f 87 54 07 07 72 N...W.M<.!O.T..r 0050 35 ba 51 aa f4 88 02 c8 62 11 40 7d 40 8d a5 0c 5.Q.....b.@}@... 0060 c3 32 35 d8 0b a8 e0 dc 9e 1c ef c1 28 10 46 db .25.........(.F. 0070 82 d1 ed 75 e6 4e eb 01 95 94 70 2a 74 56 e1 26 ...u.N....p*tV.& 0080 a3 0e 4f 30 e1 e3 a5 81 b7 b7 95 61 cc ee 67 55 ..O0.......a..gU 0090 ef ba d6 db 51 7b 5b 5d 01 07 1d c0 09 e1 c7 f2 ....Q{[]........ 00a0 49 26 3d 3d 56 d3 3f a5 53 ca 30 e3 47 3e 01 91 I&==V.?.S.0.G>.. 00b0 93 8b 8f 09 be a3 e0 cf 2e 04 f5 30 92 cc fb 3b ...........0...; 00c0 d4 0c 63 a7 ec 32 ef 95 b2 1a 51 97 0b 65 65 f2 ..c..2....Q..ee. 00d0 f3 35 00 f9 8e e1 46 9b b2 07 a6 5a 58 3f b0 28 .5....F....ZX?.( 00e0 b5 4f 4c 3b 60 7c 76 ec 12 17 f4 f4 db fb 80 1a .OL;`|v......... 00f0 cc 13 67 ef 31 e8 7d 56 89 49 e2 b6 a9 3d 35 d3 ..g.1.}V.I...=5. 0100 b4 57 2e b3 8c ac c1 9c 3e 47 0c 43 61 4e 78 4b .W......>G.CaNxK 0110 f9 22 0e a5 6f 5a fc a3 49 1f 81 00 32 84 38 9a ."..oZ..I...2.8. 0120 6e 5d fa 2f 1d 21 8d 4e 36 1e 22 9f b2 60 7b 95 n]./.!.N6."..`{. 0130 c3 ee 30 ca c4 35 b2 0a 28 b8 d8 30 dc 47 d8 de ..0..5..(..0.G.. 0140 27 ae b4 cc 17 7d 76 ef 8f dc 58 75 65 13 53 7e '....}v...Xue.S~ 0150 6c ff 91 9e 8a 75 05 19 66 98 d1 bd a1 b8 04 b0 l....u..f....... 0160 7c 7c 76 7a d8 72 ef ef 57 6d c8 77 ba 3a bc b1 ||vz.r..Wm.w.:.. 0170 06 ec 9f a4 a4 71 02 2b 6a 55 44 c8 6a 1e 04 29 .....q.+jUD.j..) 0180 3d 8d af 41 0f 11 ce 58 da fa cf b3 5b f6 76 4a =..A...X....[.vJ 0190 3e d4 9a 3c 56 b3 ab b5 dc dc de 1b ed 0c 1b ed >...B.. 05a0 09 64 24 24 8c 43 a2 94 40 f1 35 3b 58 db 21 ca .d$$.C..@.5;X.!. 05b0 82 8d 6d 7f 65 78 a2 42 88 9e 6b d0 3b 91 0d 87 ..m.ex.B..k.;... 05c0 f8 57 4f 75 96 5f f2 4a f0 98 81 7d c2 1a d6 cb .WOu._.J...}.... 05d0 82 84 c5 b1 45 06 e0 98 5c 42 4b 96 15 a6 d9 97 ....E...\BK..... 05e0 b5 a8 37 b6 3c 0e 40 31 0f 1a a1 6b 4e 24 74 db ..7.<.@1...kN$t. 05f0 01 4b ee d7 c2 79 ad f7 4a f0 97 c9 2a b1 68 5e .K...y..J...*.h^ 0600 73 51 3d 7a 10 4e 19 cf 63 4e 0b 08 24 22 19 95 sQ=z.N..cN..$".. 0610 af ce 3f 89 71 42 ae 79 68 4a c1 cb 5c 81 36 d9 ..?.qB.yhJ..\.6. 0620 78 2b 7d 86 ac 70 fd c9 e3 67 65 dc 87 43 06 ac x+}..p...ge..C.. 0630 72 63 d6 2e 1b 03 94 ce ac e4 18 11 86 1e ed fb rc.............. 0640 3d 2b 87 7a 1b 2e 90 90 22 a3 fe 5a 64 58 a9 9b =+.z...."..ZdX.. 0650 44 90 eb 81 10 21 ea 11 6e 63 80 31 26 26 b9 be D....!..nc.1&&.. 0660 b4 e5 24 f3 5c 42 e6 fc 98 86 7f 4c 84 21 a1 f3 ..$.\B.....L.!.. 0670 30 7d 0c c6 b1 da a8 c7 94 e3 73 fe 43 40 26 ee 0}........s.C@&. 0680 c0 78 87 f5 80 bf f8 16 ce 23 36 30 5a d3 c9 30 .x.......#60Z..0 0690 bc 48 e6 be e7 b8 5e 2d 88 a1 17 f1 98 2a 0a d9 .H....^-.....*.. 06a0 76 9f 20 65 bf b1 91 fc 52 c9 44 95 24 b6 b1 fa v. e....R.D.$... 06b0 00 e7 63 e5 a8 5c 73 68 4b 5e a1 b0 25 39 aa b6 ..c..\shK^..%9.. 06c0 3a d6 55 68 20 f4 8d 34 06 90 75 31 ec c2 72 b2 :.Uh ..4..u1..r. 06d0 20 f0 32 67 31 06 6c ae 1a 2e 9f cb ad 7f 25 06 .2g1.l.......%. 06e0 d6 4e 65 c2 10 9b 1d 2c 34 94 fc 8f e2 cb 73 41 .Ne....,4.....sA 06f0 09 62 56 be df 5d 15 4c fb 1e 38 13 b5 d0 9c 53 .bV..].L..8....S 0700 16 5c 62 a3 4a 27 71 9a 4d 4c db c2 38 21 01 ac .\b.J'q.ML..8!.. 0710 bc 1e 6f 1a 68 dc c9 b9 8f 8d a8 62 1d 89 bc 50 ..o.h......b...P 0720 2a 76 e5 b3 4e a8 2a aa 10 86 bf dc ba 5d 96 6d *v..N.*......].m 0730 33 ab 57 c0 a8 42 72 52 f9 63 0d c1 ea f7 29 db 3.W..BrR.c....). 0740 49 f2 7a ee fe 65 e3 4f 58 03 00 62 f9 39 1f 41 I.z..e.OX..b.9.A 0750 6b f8 8d 5a a7 84 11 58 66 94 04 ab 15 a6 95 61 k..Z...Xf......a 0760 4b 49 1a 46 b0 0d b2 68 c5 9d e8 7d b3 2c 53 c2 KI.F...h...}.,S. 0770 5e 7e f6 60 b9 1a b3 73 f5 01 ab 27 61 25 3d 6b ^~.`...s...'a%=k 0780 4f 2c fb 25 a8 9a 70 0b 45 6f 62 23 81 87 c1 f9 O,.%..p.Eob#.... 0790 e2 3c 48 a8 a6 15 0d 8b d6 7c 75 a3 f6 1e 60 fa ..:..x.O 0870 68 40 56 78 45 84 fa 4a bd 62 28 3a c5 fc 5f 26 h@VxE..J.b(:.._& 0880 a2 63 a1 a1 34 c4 f5 95 dc 12 ca 12 fa 8d 28 d8 .c..4.........(. 0890 c2 59 53 50 40 a7 a0 ab 5f ff 78 3b 7c 23 cc 21 .YSP@..._.x;|#.! 08a0 f5 fe bc b0 5a 0d 78 33 c8 7a 92 61 7b 4c aa ed ....Z.x3.z.a{L.. 08b0 66 ed 61 17 81 b4 9c 64 22 cf ba db c3 38 55 fb f.a....d"....8U. 08c0 fc 66 a7 40 be 15 c8 0a f4 01 a2 dc 2f ba 9a 8c .f.@......../... 08d0 91 02 6c 66 1d 95 4b d0 f7 67 39 23 50 13 e5 65 ..lf..K..g9#P..e 08e0 8b 0e aa 83 85 c5 eb 6c d4 c7 a6 65 c2 cc 7c 51 .......l...e..|Q 08f0 f4 da ef b8 66 51 37 07 10 fa 71 86 5c 5a b8 5b ....fQ7...q.\Z.[ 0900 72 c3 1a 43 86 03 2b 32 c1 b8 29 35 86 0c b6 96 r..C..+2..)5.... 0910 3b 1b fa 7c ff ee 78 28 a9 19 f7 ed a7 ca a7 3e ;..|..x(.......> 0920 b4 d9 93 34 b6 38 77 df 6a bd 0f d4 25 c8 82 bd ...4.8w.j...%... 0930 bc ac 7e c5 24 b4 d3 3e f6 1e 0d 2c 7c f7 34 62 ..~.$..>...,|.4b 0940 ce f8 4d f8 da ae a8 e1 da c7 3f 5d e3 98 d9 d9 ..M.......?].... 0950 3b 07 66 7a 00 c4 ca 47 0f 0e bb 02 ea 9f d8 52 ;.fz...G.......R 0960 40 28 ba 98 ac 44 c9 fe c1 1a 1a 1d 21 d9 93 20 @(...D......!.. 0970 69 7d 90 10 25 ff 60 42 08 09 f4 4a c5 c5 5f 6d i}..%.`B...J.._m 0980 db 5d ec 9a 9e ff 33 10 5c 1e 71 36 ad 3b 7d f4 .]....3.\.q6.;}. 0990 3d 57 22 79 86 b5 3a a4 bf e4 8c 52 d4 43 bd 6f =W"y..:....R.C.o 09a0 e2 9a aa 80 6f 99 55 48 58 b5 db 9f d3 a2 fe bc ....o.UHX....... 09b0 fc e6 fc de a9 01 a9 58 50 9d 3c 10 57 e2 d6 f5 .......XP.<.W... 09c0 a7 d1 39 1d bc bf 87 2e dc 3f bb 57 0e de 18 24 ..9......?.W...$ 09d0 20 a7 b1 a7 d7 4b 3d 2d cb dc 52 51 18 1c 53 1d ....K=-..RQ..S. 09e0 27 ' No. Time Source Destination Protocol Info 146 67.567453 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=3420 Ack=11597 Win=64240 Len=0 Frame 146 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3420, Ack: 11597, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 11 40 00 80 06 bf b2 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 14 2c 0b 68 80 ca 50 10 .e.......,.h..P. 0030 fa f0 dc e7 00 00 05 00 02 03 10 00 ............ No. Time Source Destination Protocol Info 147 67.569307 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (163 bytes) Frame 147 (267 bytes on wire, 267 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3420, Ack: 11597, Len: 213 Lightweight Directory Access Protocol SASL Buffer Length: 209 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF2F6B00BB769B45D0F90DA45748375035... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 2F6B00BB769B45D0 krb5_sgn_cksum: F90DA45748375035 krb5_confounder: CABC071F905B0492 GSS-API Encrypted payload (163 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fd e0 12 40 00 80 06 be dc ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 14 2c 0b 68 80 ca 50 18 .e.......,.h..P. 0030 fa f0 7f fc 00 00 00 00 00 d1 60 81 ce 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 2f 6b 00 bb 76 9b 45 d0 f9 0d a4 57 48 37 50 35 /k..v.E....WH7P5 0060 ca bc 07 1f 90 5b 04 92 de 21 a6 c8 33 96 01 ba .....[...!..3... 0070 dc 82 b1 7d 79 02 21 67 84 6a 09 29 46 22 f7 4a ...}y.!g.j.)F".J 0080 2c fc bc 96 1b e9 f7 b2 ee 01 d7 88 a2 c9 41 a7 ,.............A. 0090 b7 31 75 6e 6b 19 28 ae 7a 60 3f 15 df d3 0c 15 .1unk.(.z`?..... 00a0 a2 6d 54 04 70 8f de de db 57 f3 1a ac fe 6a 8f .mT.p....W....j. 00b0 1c ef 5b 80 ec b4 ee 73 46 e8 d7 7f dd 13 79 2f ..[....sF.....y/ 00c0 87 ff 9f 70 16 26 5d fd 35 d2 71 87 51 57 a5 97 ...p.&].5.q.QW.. 00d0 f9 1b 48 fa ae c0 c3 c9 28 ad 7c c8 02 8a 25 a9 ..H.....(.|...%. 00e0 17 f6 8f 32 24 85 d7 2a e5 c7 78 fd 3b 05 2f 5e ...2$..*..x.;./^ 00f0 72 51 b1 df 5e c9 23 ec de ab 4a 21 b5 2e dd d8 rQ..^.#...J!.... 0100 87 c3 28 9f 99 56 73 32 f6 8e 69 ..(..Vs2..i No. Time Source Destination Protocol Info 148 67.570346 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (193 bytes) Frame 148 (297 bytes on wire, 297 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 11597, Ack: 3633, Len: 243 Lightweight Directory Access Protocol SASL Buffer Length: 239 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF06D1B09E36067E6728A77C9E38E143E5... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 06D1B09E36067E67 krb5_sgn_cksum: 28A77C9E38E143E5 krb5_confounder: 1B6841997EF00394 GSS-API Encrypted payload (193 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 1b 2d fc 40 00 80 06 70 d5 ac 1f 01 65 ac 1f ..-.@...p....e.. 0020 01 68 01 85 07 f0 0b 68 80 ca d3 1c 15 01 50 18 .h.....h......P. 0030 f8 c8 96 d8 00 00 00 00 00 ef 60 81 ec 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 06 d1 b0 9e 36 06 7e 67 28 a7 7c 9e 38 e1 43 e5 ....6.~g(.|.8.C. 0060 1b 68 41 99 7e f0 03 94 8f 30 4b 39 d2 01 d9 78 .hA.~....0K9...x 0070 38 fa cf 0a c5 ec eb af 2e 88 7c 89 21 3d 39 b9 8.........|.!=9. 0080 5a 74 db 73 99 3a f7 8d e3 5c 51 a9 96 3d 3b 03 Zt.s.:...\Q..=;. 0090 8a 19 c1 aa 83 41 96 79 85 f8 ae 29 d9 f7 b1 0a .....A.y...).... 00a0 fb a0 1c d8 4c fd 82 f8 e7 d3 c9 5f 8f 7e 03 cd ....L......_.~.. 00b0 a0 cf 9f 8c 01 ed 40 1b 3e 26 e7 95 32 ba 48 43 ......@.>&..2.HC 00c0 6f ab b8 a7 13 dd 1d 6f 74 e1 9b 72 7f 36 f2 40 o......ot..r.6.@ 00d0 04 d6 ac e4 8a 30 3b a1 4b 7c 14 23 98 1d 6f b4 .....0;.K|.#..o. 00e0 a9 75 7d 3d 6b c2 84 f5 6c 92 48 29 6d 52 79 b5 .u}=k...l.H)mRy. 00f0 a5 c8 be 85 97 ec 5f b9 72 fa 33 97 e5 f2 35 1e ......_.r.3...5. 0100 45 ef 20 9b 2b 2a df 96 21 8b d4 99 02 07 48 30 E. .+*..!.....H0 0110 88 f0 b5 49 34 ed d3 e8 65 6a 9f c5 3b 7d 96 47 ...I4...ej..;}.G 0120 28 0a 27 0d 42 c8 ad 20 1d (.'.B.. . No. Time Source Destination Protocol Info 149 67.571241 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (197 bytes) Frame 149 (301 bytes on wire, 301 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3633, Ack: 11840, Len: 247 Lightweight Directory Access Protocol SASL Buffer Length: 243 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6B4EA5C3D697BD281A3C08E8074DA85B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6B4EA5C3D697BD28 krb5_sgn_cksum: 1A3C08E8074DA85B krb5_confounder: AE791B0F70058B26 GSS-API Encrypted payload (197 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 1f e0 13 40 00 80 06 be b9 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 15 01 0b 68 81 bd 50 18 .e.........h..P. 0030 f9 fd ce f0 00 00 00 00 00 f3 60 81 f0 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 6b 4e a5 c3 d6 97 bd 28 1a 3c 08 e8 07 4d a8 5b kN.....(.<...M.[ 0060 ae 79 1b 0f 70 05 8b 26 2e b3 04 4a 61 45 fa 03 .y..p..&...JaE.. 0070 1c 6f 18 98 53 4e 73 ef 74 4c 6c b4 d0 80 f1 3c .o..SNs.tLl....< 0080 8d 48 02 0c a2 c3 4e da ce a2 c0 1c 9a ef 95 35 .H....N........5 0090 3f 09 f6 c4 c1 b1 f9 23 30 c0 01 ab 17 cd 06 2a ?......#0......* 00a0 6d 6f dc a0 0b 60 02 56 91 ef e1 57 4a 00 78 75 mo...`.V...WJ.xu 00b0 76 94 b9 dc ac e2 1d 8b c3 57 a1 c2 26 b9 ea b7 v........W..&... 00c0 71 2e 6d 90 81 cf 97 e4 ce 03 ad bc ae 87 1e da q.m............. 00d0 f7 b8 53 f7 de 43 81 73 a9 46 2b 15 f1 2e 37 96 ..S..C.s.F+...7. 00e0 b3 e8 d9 05 67 98 8f 5b 8f 67 5d 04 a0 01 86 06 ....g..[.g]..... 00f0 9e 69 06 9d ee 96 df 5b 0a 87 7a c0 a6 e5 19 0c .i.....[..z..... 0100 42 ce 50 af 7e f4 91 27 e1 43 54 ed 06 ba bd 2a B.P.~..'.CT....* 0110 9d 1c e4 f1 4a 3b 69 70 fb b4 cc e8 58 08 7d ea ....J;ip....X.}. 0120 be e8 0d 0e 1c 8d ec d3 6a bc 9e 18 fb ........j.... No. Time Source Destination Protocol Info 150 67.572436 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 150 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 11840, Ack: 3880, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2d fd 40 00 80 06 6c 13 ac 1f 01 65 ac 1f ..-.@...l....e.. 0020 01 68 01 85 07 f0 0b 68 81 bd d3 1c 15 f8 50 10 .h.....h......P. 0030 f7 d1 b5 4c 00 00 00 00 06 59 60 82 06 55 06 09 ...L.....Y`..U.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff f1 48 88 c8 21 c0 f8 a5 59 01 0a cb 31 6c b2 ..H..!...Y...1l. 0060 4a 92 ea aa 12 2d 8a 8b cf eb ab 7d e1 11 d0 57 J....-.....}...W 0070 7f 47 d1 7b 0b 34 8b 3e ac 6b e7 3a 76 b3 0d e9 .G.{.4.>.k.:v... 0080 32 2d 71 6c 0a a1 5e 05 13 52 fd e3 e2 7b 5b ae 2-ql..^..R...{[. 0090 b2 7d fb 61 e8 dd 93 03 97 a9 17 c0 8f 1f 46 3b .}.a..........F; 00a0 1e ef 33 5b a6 28 ef fa 60 9c 7e 5c ac 3c e5 b1 ..3[.(..`.~\.<.. 00b0 b6 7d 43 6c a3 45 9e 9f 33 3e 32 eb d0 a2 b9 19 .}Cl.E..3>2..... 00c0 ba f9 ee 71 7c 60 ee e6 bf d5 ab 9b e1 4e 95 e9 ...q|`.......N.. 00d0 56 64 f7 a2 57 a9 75 a2 15 89 71 02 23 1a 2b 54 Vd..W.u...q.#.+T 00e0 58 9d 6f 30 7c 76 61 4b f4 05 91 fb 4f 65 39 98 X.o0|vaK....Oe9. 00f0 46 78 97 44 72 c2 ec 53 33 be 6a c2 6d 5d 60 8f Fx.Dr..S3.j.m]`. 0100 63 cc 60 4c 39 2d 98 58 31 85 44 9a 84 d0 05 71 c.`L9-.X1.D....q 0110 44 df 04 7e 6f 79 6d d4 f3 30 2d 99 dc 9f 56 b1 D..~oym..0-...V. 0120 22 88 49 62 47 17 3f 44 e5 ee 47 cc 16 9c 72 a0 ".IbG.?D..G...r. 0130 3b 06 d5 50 89 d4 fe a5 68 02 ad 6b c9 87 b8 ca ;..P....h..k.... 0140 84 d8 2d 77 ba 37 0e c2 53 b5 7b 96 df 48 5b b2 ..-w.7..S.{..H[. 0150 f5 0c 93 1e 0f f6 85 e6 81 c7 93 68 8e f4 f4 a9 ...........h.... 0160 02 60 28 11 d2 ba a6 b3 8b f4 12 d4 1e 60 99 ba .`(..........`.. 0170 e5 cb ed 04 55 43 ba 47 55 57 e4 1e 77 b6 11 ea ....UC.GUW..w... 0180 36 af bf 13 0c 09 a7 e8 23 50 89 2e 57 de 5c 84 6.......#P..W.\. 0190 5b d1 20 38 3e da 3c 56 47 49 fb f6 e8 a1 0b 70 [. 8>..P..C..k....r.. 0300 d4 72 14 91 b4 9f e0 da 83 23 86 81 a5 30 b7 03 .r.......#...0.. 0310 62 9d 8d 4a 1d c2 38 77 39 03 3e 14 f7 95 16 8c b..J..8w9.>..... 0320 f3 bb 4e 3a 35 20 8e a5 a5 43 31 46 a2 eb 5a d9 ..N:5 ...C1F..Z. 0330 1f d6 74 59 62 f4 cf 1d ba 68 69 30 28 2c 15 d3 ..tYb....hi0(,.. 0340 9b 23 dc cc 3b b6 eb 33 37 15 25 f4 3e 49 66 b0 .#..;..37.%.>If. 0350 e9 a6 e8 de f8 29 8a ea be 69 95 21 8e 5a f6 e5 .....)...i.!.Z.. 0360 16 13 f4 7a 0d 0f 83 6d 15 58 92 b2 5e f6 bf 1f ...z...m.X..^... 0370 2c 37 ac 93 1b 92 67 17 a1 6a b5 df 87 5f 11 a6 ,7....g..j..._.. 0380 91 4f 31 85 4e 46 23 16 82 55 b4 1f af e7 ba f9 .O1.NF#..U...... 0390 7a 72 b3 85 91 b2 2d 2f 72 4f d0 07 84 a1 d2 87 zr....-/rO...... 03a0 c2 c3 25 42 20 97 ef 69 92 22 d4 01 5b de a0 1f ..%B ..i."..[... 03b0 7e cc bf 51 4f 34 b4 05 f8 59 10 9a d0 26 95 5e ~..QO4...Y...&.^ 03c0 95 9c 89 3a 66 6c 3f 23 16 1a ac d0 64 d7 0d 7d ...:fl?#....d..} 03d0 5b 66 f1 74 80 62 ab 10 31 a3 14 c4 42 88 f9 9e [f.t.b..1...B... 03e0 cf 2d 1c 26 79 83 13 fe 26 83 97 94 d4 e3 e0 dd .-.&y...&....... 03f0 74 42 b0 20 14 b8 e7 9f 21 7d 95 22 5f e4 37 e4 tB. ....!}."_.7. 0400 e8 0e e0 98 ea 5c 3b c9 4d 21 4a bc 6e 92 04 a3 .....\;.M!J.n... 0410 67 61 2f ce ab f1 71 ad 13 28 90 9b 2f 76 4e a1 ga/...q..(../vN. 0420 1e a4 8b a6 57 06 18 f1 d7 8a 56 88 51 17 0d dd ....W.....V.Q... 0430 39 41 4b 14 2b 85 85 01 94 38 eb b9 88 16 70 cf 9AK.+....8....p. 0440 5f 04 d6 f7 db ca fb de 1a 70 ff 1b 21 13 c6 0f _........p..!... 0450 0b 00 29 ff 9e 89 91 7b 44 a7 7f 3a 43 ff 56 8c ..)....{D..:C.V. 0460 32 44 fe d7 a2 d3 72 e6 e2 63 d7 3d 1a 46 83 90 2D....r..c.=.F.. 0470 9f 83 dd ae f8 0f e9 7d 96 ac 54 c0 a5 b8 96 88 .......}..T..... 0480 eb fe 63 2f ba 7b 0a fe 88 05 68 e1 07 db 65 3e ..c/.{....h...e> 0490 7f 14 82 45 3f c9 7a eb b1 e4 76 d6 16 3c ac 29 ...E?.z...v..<.) 04a0 63 d8 16 90 2e 6c c2 3e a4 84 5c 87 49 ad 51 1b c....l.>..\.I.Q. 04b0 47 ad cd ff b2 3b 9e cc ab 2b 94 7f ff 55 5e f3 G....;...+...U^. 04c0 a5 b8 c7 4b 73 f6 55 f4 0f 3f 91 5a 0c 72 f9 a0 ...Ks.U..?.Z.r.. 04d0 cb f9 6f 37 9c f6 bf 24 27 eb a2 5c 2b 9e a7 68 ..o7...$'..\+..h 04e0 d0 f1 d7 c6 a5 d4 85 d7 88 28 1d e1 9b 1d 74 b5 .........(....t. 04f0 32 59 f1 70 91 dd a9 e6 1d 2d b6 97 2f 37 b1 c8 2Y.p.....-../7.. 0500 61 3b 40 41 af df 50 96 dd 2f a0 b1 26 32 11 fc a;@A..P../..&2.. 0510 46 db c0 d4 77 43 ac f9 45 5e 2d 6d 8d ee 0c 8e F...wC..E^-m.... 0520 36 21 a4 c2 22 d1 e8 10 e5 cc 97 13 91 c7 a7 d5 6!.."........... 0530 b9 aa 5e 99 0d 0d 48 f5 8e af 68 85 19 4a be bf ..^...H...h..J.. 0540 27 e6 34 06 13 0c c7 7d 96 5f 64 66 99 6f 78 35 '.4....}._df.ox5 0550 48 ea af 92 5b be 08 db 7d 10 f4 7e 05 73 e8 77 H...[...}..~.s.w 0560 51 1d 5f f2 95 a4 eb eb 9a 0b d1 bf 3c bf 6b 9c Q._.........<.k. 0570 6a 43 ae 6a c1 c2 ad a1 ad d0 bb 2b ec b2 dc e3 jC.j.......+.... 0580 9a e9 5d 0b 9d 8a 20 bc 9a e1 24 51 a1 26 e9 bf ..]... ...$Q.&.. 0590 39 f3 b8 af 95 71 7c 83 34 78 2b e4 d4 05 08 ad 9....q|.4x+..... 05a0 83 da 66 1b bf 65 25 fc a7 99 68 0d 88 2b c7 8b ..f..e%...h..+.. 05b0 ff 6b 03 59 65 24 2a 5d 07 e9 ac ae 43 15 47 8c .k.Ye$*]....C.G. 05c0 89 fd ee 8a 16 6c e2 3e b6 72 95 b8 17 c5 76 73 .....l.>.r....vs 05d0 e2 c5 0c 84 d2 38 16 62 e1 0d 1f f7 a9 77 85 78 .....8.b.....w.x 05e0 6e 9a 09 35 1b e2 2f 0b cb ac n..5../... No. Time Source Destination Protocol Info 151 67.572556 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1578 bytes) Frame 151 (223 bytes on wire, 223 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 13300, Ack: 3880, Len: 169 Lightweight Directory Access Protocol SASL Buffer Length: 1625 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF14888C821C0F8A559010ACB316CB24A... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F14888C821C0F8A5 krb5_sgn_cksum: 59010ACB316CB24A krb5_confounder: 92EAAA122D8A8BCF GSS-API Encrypted payload (1578 bytes) Frame (223 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 d1 2d fe 40 00 80 06 71 1d ac 1f 01 65 ac 1f ..-.@...q....e.. 0020 01 68 01 85 07 f0 0b 68 87 71 d3 1c 15 f8 50 18 .h.....h.q....P. 0030 f7 d1 52 4e 00 00 37 47 fd 02 e0 ae 23 9a 89 c7 ..RN..7G....#... 0040 39 ad c9 0c d0 3a 3e e0 b0 05 c4 88 93 97 ee 93 9....:>......... 0050 e0 6d 89 45 fd e8 be 8d 66 34 13 14 c4 5a 31 03 .m.E....f4...Z1. 0060 c3 4f d6 22 6a 76 5c 2b 3d 90 da 20 e3 6d a5 2f .O."jv\+=.. .m./ 0070 ba d6 e5 2f 7d e2 7c 3c f7 57 7c cc 93 be 71 df .../}.|<.W|...q. 0080 97 89 8c 3f a3 b2 82 99 a9 29 16 73 ab 42 b6 cb ...?.....).s.B.. 0090 44 07 9d 68 28 20 ef f2 17 dd 3c 7b f2 dd 84 0f D..h( ....<{.... 00a0 c4 9b c0 72 51 cb 3e c4 90 9d 2b f5 35 66 25 25 ...rQ.>...+.5f%% 00b0 1a d6 0e 28 af 06 82 41 ba ed 86 b9 7a 24 7d 30 ...(...A....z$}0 00c0 e0 73 ae e2 f4 10 4e 90 15 6b 36 6f 39 9a e9 7c .s....N..k6o9..| 00d0 27 ab 99 5c d5 fb 5d 14 c4 5c 9a 63 23 45 69 '..\..]..\.c#Ei Reassembled TCP (1629 bytes): 0000 00 00 06 59 60 82 06 55 06 09 2a 86 48 86 f7 12 ...Y`..U..*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff f1 48 88 c8 21 ............H..! 0020 c0 f8 a5 59 01 0a cb 31 6c b2 4a 92 ea aa 12 2d ...Y...1l.J....- 0030 8a 8b cf eb ab 7d e1 11 d0 57 7f 47 d1 7b 0b 34 .....}...W.G.{.4 0040 8b 3e ac 6b e7 3a 76 b3 0d e9 32 2d 71 6c 0a a1 .>.k.:v...2-ql.. 0050 5e 05 13 52 fd e3 e2 7b 5b ae b2 7d fb 61 e8 dd ^..R...{[..}.a.. 0060 93 03 97 a9 17 c0 8f 1f 46 3b 1e ef 33 5b a6 28 ........F;..3[.( 0070 ef fa 60 9c 7e 5c ac 3c e5 b1 b6 7d 43 6c a3 45 ..`.~\.<...}Cl.E 0080 9e 9f 33 3e 32 eb d0 a2 b9 19 ba f9 ee 71 7c 60 ..3>2........q|` 0090 ee e6 bf d5 ab 9b e1 4e 95 e9 56 64 f7 a2 57 a9 .......N..Vd..W. 00a0 75 a2 15 89 71 02 23 1a 2b 54 58 9d 6f 30 7c 76 u...q.#.+TX.o0|v 00b0 61 4b f4 05 91 fb 4f 65 39 98 46 78 97 44 72 c2 aK....Oe9.Fx.Dr. 00c0 ec 53 33 be 6a c2 6d 5d 60 8f 63 cc 60 4c 39 2d .S3.j.m]`.c.`L9- 00d0 98 58 31 85 44 9a 84 d0 05 71 44 df 04 7e 6f 79 .X1.D....qD..~oy 00e0 6d d4 f3 30 2d 99 dc 9f 56 b1 22 88 49 62 47 17 m..0-...V.".IbG. 00f0 3f 44 e5 ee 47 cc 16 9c 72 a0 3b 06 d5 50 89 d4 ?D..G...r.;..P.. 0100 fe a5 68 02 ad 6b c9 87 b8 ca 84 d8 2d 77 ba 37 ..h..k......-w.7 0110 0e c2 53 b5 7b 96 df 48 5b b2 f5 0c 93 1e 0f f6 ..S.{..H[....... 0120 85 e6 81 c7 93 68 8e f4 f4 a9 02 60 28 11 d2 ba .....h.....`(... 0130 a6 b3 8b f4 12 d4 1e 60 99 ba e5 cb ed 04 55 43 .......`......UC 0140 ba 47 55 57 e4 1e 77 b6 11 ea 36 af bf 13 0c 09 .GUW..w...6..... 0150 a7 e8 23 50 89 2e 57 de 5c 84 5b d1 20 38 3e da ..#P..W.\.[. 8>. 0160 3c 56 47 49 fb f6 e8 a1 0b 70 87 73 aa 39 b4 05 .P..C 02c0 7f f9 6b a0 dd 90 e7 72 a1 b3 d4 72 14 91 b4 9f ..k....r...r.... 02d0 e0 da 83 23 86 81 a5 30 b7 03 62 9d 8d 4a 1d c2 ...#...0..b..J.. 02e0 38 77 39 03 3e 14 f7 95 16 8c f3 bb 4e 3a 35 20 8w9.>.......N:5 02f0 8e a5 a5 43 31 46 a2 eb 5a d9 1f d6 74 59 62 f4 ...C1F..Z...tYb. 0300 cf 1d ba 68 69 30 28 2c 15 d3 9b 23 dc cc 3b b6 ...hi0(,...#..;. 0310 eb 33 37 15 25 f4 3e 49 66 b0 e9 a6 e8 de f8 29 .37.%.>If......) 0320 8a ea be 69 95 21 8e 5a f6 e5 16 13 f4 7a 0d 0f ...i.!.Z.....z.. 0330 83 6d 15 58 92 b2 5e f6 bf 1f 2c 37 ac 93 1b 92 .m.X..^...,7.... 0340 67 17 a1 6a b5 df 87 5f 11 a6 91 4f 31 85 4e 46 g..j..._...O1.NF 0350 23 16 82 55 b4 1f af e7 ba f9 7a 72 b3 85 91 b2 #..U......zr.... 0360 2d 2f 72 4f d0 07 84 a1 d2 87 c2 c3 25 42 20 97 -/rO........%B . 0370 ef 69 92 22 d4 01 5b de a0 1f 7e cc bf 51 4f 34 .i."..[...~..QO4 0380 b4 05 f8 59 10 9a d0 26 95 5e 95 9c 89 3a 66 6c ...Y...&.^...:fl 0390 3f 23 16 1a ac d0 64 d7 0d 7d 5b 66 f1 74 80 62 ?#....d..}[f.t.b 03a0 ab 10 31 a3 14 c4 42 88 f9 9e cf 2d 1c 26 79 83 ..1...B....-.&y. 03b0 13 fe 26 83 97 94 d4 e3 e0 dd 74 42 b0 20 14 b8 ..&.......tB. .. 03c0 e7 9f 21 7d 95 22 5f e4 37 e4 e8 0e e0 98 ea 5c ..!}."_.7......\ 03d0 3b c9 4d 21 4a bc 6e 92 04 a3 67 61 2f ce ab f1 ;.M!J.n...ga/... 03e0 71 ad 13 28 90 9b 2f 76 4e a1 1e a4 8b a6 57 06 q..(../vN.....W. 03f0 18 f1 d7 8a 56 88 51 17 0d dd 39 41 4b 14 2b 85 ....V.Q...9AK.+. 0400 85 01 94 38 eb b9 88 16 70 cf 5f 04 d6 f7 db ca ...8....p._..... 0410 fb de 1a 70 ff 1b 21 13 c6 0f 0b 00 29 ff 9e 89 ...p..!.....)... 0420 91 7b 44 a7 7f 3a 43 ff 56 8c 32 44 fe d7 a2 d3 .{D..:C.V.2D.... 0430 72 e6 e2 63 d7 3d 1a 46 83 90 9f 83 dd ae f8 0f r..c.=.F........ 0440 e9 7d 96 ac 54 c0 a5 b8 96 88 eb fe 63 2f ba 7b .}..T.......c/.{ 0450 0a fe 88 05 68 e1 07 db 65 3e 7f 14 82 45 3f c9 ....h...e>...E?. 0460 7a eb b1 e4 76 d6 16 3c ac 29 63 d8 16 90 2e 6c z...v..<.)c....l 0470 c2 3e a4 84 5c 87 49 ad 51 1b 47 ad cd ff b2 3b .>..\.I.Q.G....; 0480 9e cc ab 2b 94 7f ff 55 5e f3 a5 b8 c7 4b 73 f6 ...+...U^....Ks. 0490 55 f4 0f 3f 91 5a 0c 72 f9 a0 cb f9 6f 37 9c f6 U..?.Z.r....o7.. 04a0 bf 24 27 eb a2 5c 2b 9e a7 68 d0 f1 d7 c6 a5 d4 .$'..\+..h...... 04b0 85 d7 88 28 1d e1 9b 1d 74 b5 32 59 f1 70 91 dd ...(....t.2Y.p.. 04c0 a9 e6 1d 2d b6 97 2f 37 b1 c8 61 3b 40 41 af df ...-../7..a;@A.. 04d0 50 96 dd 2f a0 b1 26 32 11 fc 46 db c0 d4 77 43 P../..&2..F...wC 04e0 ac f9 45 5e 2d 6d 8d ee 0c 8e 36 21 a4 c2 22 d1 ..E^-m....6!..". 04f0 e8 10 e5 cc 97 13 91 c7 a7 d5 b9 aa 5e 99 0d 0d ............^... 0500 48 f5 8e af 68 85 19 4a be bf 27 e6 34 06 13 0c H...h..J..'.4... 0510 c7 7d 96 5f 64 66 99 6f 78 35 48 ea af 92 5b be .}._df.ox5H...[. 0520 08 db 7d 10 f4 7e 05 73 e8 77 51 1d 5f f2 95 a4 ..}..~.s.wQ._... 0530 eb eb 9a 0b d1 bf 3c bf 6b 9c 6a 43 ae 6a c1 c2 ......<.k.jC.j.. 0540 ad a1 ad d0 bb 2b ec b2 dc e3 9a e9 5d 0b 9d 8a .....+......]... 0550 20 bc 9a e1 24 51 a1 26 e9 bf 39 f3 b8 af 95 71 ...$Q.&..9....q 0560 7c 83 34 78 2b e4 d4 05 08 ad 83 da 66 1b bf 65 |.4x+.......f..e 0570 25 fc a7 99 68 0d 88 2b c7 8b ff 6b 03 59 65 24 %...h..+...k.Ye$ 0580 2a 5d 07 e9 ac ae 43 15 47 8c 89 fd ee 8a 16 6c *]....C.G......l 0590 e2 3e b6 72 95 b8 17 c5 76 73 e2 c5 0c 84 d2 38 .>.r....vs.....8 05a0 16 62 e1 0d 1f f7 a9 77 85 78 6e 9a 09 35 1b e2 .b.....w.xn..5.. 05b0 2f 0b cb ac 37 47 fd 02 e0 ae 23 9a 89 c7 39 ad /...7G....#...9. 05c0 c9 0c d0 3a 3e e0 b0 05 c4 88 93 97 ee 93 e0 6d ...:>..........m 05d0 89 45 fd e8 be 8d 66 34 13 14 c4 5a 31 03 c3 4f .E....f4...Z1..O 05e0 d6 22 6a 76 5c 2b 3d 90 da 20 e3 6d a5 2f ba d6 ."jv\+=.. .m./.. 05f0 e5 2f 7d e2 7c 3c f7 57 7c cc 93 be 71 df 97 89 ./}.|<.W|...q... 0600 8c 3f a3 b2 82 99 a9 29 16 73 ab 42 b6 cb 44 07 .?.....).s.B..D. 0610 9d 68 28 20 ef f2 17 dd 3c 7b f2 dd 84 0f c4 9b .h( ....<{...... 0620 c0 72 51 cb 3e c4 90 9d 2b f5 35 66 25 25 1a d6 .rQ.>...+.5f%%.. 0630 0e 28 af 06 82 41 ba ed 86 b9 7a 24 7d 30 e0 73 .(...A....z$}0.s 0640 ae e2 f4 10 4e 90 15 6b 36 6f 39 9a e9 7c 27 ab ....N..k6o9..|'. 0650 99 5c d5 fb 5d 14 c4 5c 9a 63 23 45 69 .\..]..\.c#Ei No. Time Source Destination Protocol Info 152 67.572931 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=3880 Ack=13469 Win=64240 Len=0 Frame 152 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3880, Ack: 13469, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 14 40 00 80 06 bf af ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 15 f8 0b 68 88 1a 50 10 .e.........h..P. 0030 fa f0 d3 cb 00 00 00 1f 01 65 c5 d5 .........e.. No. Time Source Destination Protocol Info 153 67.574395 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (163 bytes) Frame 153 (267 bytes on wire, 267 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 3880, Ack: 13469, Len: 213 Lightweight Directory Access Protocol SASL Buffer Length: 209 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF3044EC4D14F942734C602BC2EF5C9AD... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F3044EC4D14F9427 krb5_sgn_cksum: 34C602BC2EF5C9AD krb5_confounder: 7E92103FDCF8E48A GSS-API Encrypted payload (163 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fd e0 15 40 00 80 06 be d9 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 15 f8 0b 68 88 1a 50 18 .e.........h..P. 0030 fa f0 c4 9b 00 00 00 00 00 d1 60 81 ce 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 f3 04 4e c4 d1 4f 94 27 34 c6 02 bc 2e f5 c9 ad ..N..O.'4....... 0060 7e 92 10 3f dc f8 e4 8a 7f 47 84 3a 18 69 df f6 ~..?.....G.:.i.. 0070 6b 55 3d a2 22 b8 bc c4 8f 27 17 d8 b3 ec 3c 65 kU=."....'....W.. 0160 51 28 83 b5 aa fe 47 62 5d 19 b0 35 6f 6d ba c4 Q(....Gb]..5om.. 0170 d8 e2 d1 94 8d 39 0d 7b 6c a2 22 7f 1d cd 6f f9 .....9.{l."...o. 0180 e8 80 1a d3 a8 fa 81 d6 cc 66 f4 66 0b ca a8 a2 .........f.f.... 0190 8d 03 b5 55 7c 0f ee 29 f8 6b 23 0b 48 35 50 dc ...U|..).k#.H5P. 01a0 04 49 86 e8 3c ff 4c 37 12 23 09 04 89 5a 4e 68 .I..<.L7.#...ZNh 01b0 1b cb c0 9a 8f 4c 34 20 9c 75 77 9b 94 65 d1 52 .....L4 .uw..e.R 01c0 c4 d9 15 66 d3 93 3f 3d 6b 20 8d 49 7f 11 55 48 ...f..?=k .I..UH 01d0 93 a1 cc 65 8f 85 19 59 99 a7 ab 07 14 2f b3 5d ...e...Y...../.] 01e0 e3 c3 33 76 8d 2d 14 87 1c 40 0a 33 6a 28 19 c3 ..3v.-...@.3j(.. 01f0 83 3e 4c 96 20 60 53 7b a4 be 04 4e 4b 44 1a 9e .>L. `S{...NKD.. 0200 bc 66 eb c1 ce 1e 51 a9 d7 7e 59 56 2c cf e0 c1 .f....Q..~YV,... 0210 58 19 5c c2 a1 e1 5a 2c e2 89 df 3d 1e 4d d9 ae X.\...Z,...=.M.. 0220 9d fb 7c 8c 9e fa 44 20 21 82 83 07 ed 57 13 0a ..|...D !....W.. 0230 e9 52 04 7d 34 7d 2e 9c 96 b5 af ee ab 3d 23 5a .R.}4}.......=#Z 0240 66 12 54 af 50 e3 42 fd 55 85 76 b3 fe d6 2f dd f.T.P.B.U.v.../. 0250 72 61 72 21 45 aa 5f b9 4d e6 78 47 b5 65 f0 bd rar!E._.M.xG.e.. 0260 f1 7b 17 10 e4 bf c9 e7 f8 15 93 31 21 ab 2d a4 .{.........1!.-. 0270 12 2d 01 e6 52 8e e4 51 6d f0 5b e2 5f ca 4a cc .-..R..Qm.[._.J. 0280 a3 c2 c8 28 7b 2c ea 8f aa fd c2 1c 11 de 4c 08 ...({,........L. 0290 33 1f 1c 5f d6 ea 6d 0e 71 f1 c9 0d ff 90 be b3 3.._..m.q....... 02a0 a1 cc af 96 a8 50 07 00 6d 91 85 25 5c 1c ae 36 .....P..m..%\..6 02b0 33 43 00 d9 53 11 12 df c3 2e 74 a1 8d e1 97 15 3C..S.....t..... 02c0 a2 0d 6a 79 fc 4b ee a7 7c b4 33 7f 7b ad 6a 69 ..jy.K..|.3.{.ji 02d0 78 c4 7e dc df 7e 51 03 f6 89 92 b8 71 af 8f 21 x.~..~Q.....q..! 02e0 71 8a f5 f2 79 62 7d ab fa 93 c3 27 f8 d4 e1 13 q...yb}....'.... 02f0 69 fb 34 3c 79 c3 5a c9 78 49 27 19 2b 8d ad 67 i.4. 04b0 72 97 ca 23 a7 c8 70 22 da 40 e0 74 3a 7e 6b 4a r..#..p".@.t:~kJ 04c0 66 03 97 0e 43 ae 27 08 97 8b c7 4d 48 6f fe 33 f...C.'....MHo.3 04d0 da 25 30 0c e9 87 4b c1 8c 6b a7 f0 9a a5 0b 25 .%0...K..k.....% 04e0 04 ba de 60 c0 17 01 e7 1a c2 8f 04 d8 55 04 9d ...`.........U.. 04f0 2a b8 3d 35 de 7e 6e 6c 01 c5 ae 2b 0b 68 ef ed *.=5.~nl...+.h.. 0500 55 31 98 f2 65 8c 6d fb 10 e4 6e da 0d 51 7a da U1..e.m...n..Qz. 0510 f1 00 a0 57 87 51 c5 60 3e 69 56 9f b6 93 bb a0 ...W.Q.`>iV..... 0520 4d 3f ce f5 28 6c e4 c6 cb a0 14 4c ff ca 5d 72 M?..(l.....L..]r 0530 c2 cf de 22 b6 51 09 2c 12 50 40 1c 4e 3f 7c e2 ...".Q.,.P@.N?|. 0540 68 b9 69 4b 48 db 45 02 7b 54 0b f5 20 4f 63 47 h.iKH.E.{T.. OcG 0550 da 3e 0c 8f d7 ab 0f c2 e9 94 1b 7f 81 87 ae 99 .>.............. 0560 26 a4 cc b3 0c 7e d1 ac b6 7b 92 cd 0c 20 ea c7 &....~...{... .. 0570 05 a7 90 7b f7 89 2e 52 81 e1 5a bf 9e ab 07 7c ...{...R..Z....| 0580 41 8e 35 3c cc 3f d2 04 81 dd c5 71 c6 51 89 7c A.5<.?.....q.Q.| 0590 6e ef 3e e3 a7 01 5a bf 0d fc 5f ce ac d2 30 77 n.>...Z..._...0w 05a0 5d f3 a5 48 93 03 95 5c b3 28 e0 e2 f6 05 43 8c ]..H...\.(....C. 05b0 dd 4a e1 77 6b fd 6a 53 d7 55 34 2b 6a d9 a1 9c .J.wk.jS.U4+j... 05c0 f6 b9 a4 5d 67 41 b5 9a a8 77 87 59 f6 38 b3 9e ...]gA...w.Y.8.. 05d0 8b f3 a9 ef 63 34 64 02 86 f2 21 53 4f 91 c0 cb ....c4d...!SO... 05e0 33 a7 1c eb 90 6a 38 14 a9 56 3....j8..V No. Time Source Destination Protocol Info 157 67.577480 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1574 bytes) Frame 157 (219 bytes on wire, 219 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 15172, Ack: 4340, Len: 165 Lightweight Directory Access Protocol SASL Buffer Length: 1621 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF413877E5F8CD42F0B52395FC1D99FAF2... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 413877E5F8CD42F0 krb5_sgn_cksum: B52395FC1D99FAF2 krb5_confounder: AA85409C99B6EBE0 GSS-API Encrypted payload (1574 bytes) Frame (219 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 cd 2e 01 40 00 80 06 71 1e ac 1f 01 65 ac 1f ....@...q....e.. 0020 01 68 01 85 07 f0 0b 68 8e c1 d3 1c 17 c4 50 18 .h.....h......P. 0030 f6 05 c7 a3 00 00 ea 70 91 a0 7c 4f 21 dd 29 f0 .......p..|O!.). 0040 3c a0 44 ad 1c a8 56 34 cc 6a 94 be 0e bb 13 ea <.D...V4.j...... 0050 4a 04 b2 22 b8 23 ad e3 21 a0 d0 9b 92 52 8a 73 J..".#..!....R.s 0060 44 c8 72 d6 97 93 5d 0b 67 7a 5b 06 08 be 1a d8 D.r...].gz[..... 0070 95 ef a3 68 36 f4 61 a1 3a 7e 14 64 e6 58 c8 0c ...h6.a.:~.d.X.. 0080 f5 28 f5 58 2c 49 53 6c 7c e5 73 07 92 f5 7a f7 .(.X,ISl|.s...z. 0090 b6 70 1c 4f 2d dc 15 dc 7a 11 dd 8e d1 d2 7c c3 .p.O-...z.....|. 00a0 1b 4c 44 48 56 1a 16 3f be bd 3d 39 ce 6a f0 f5 .LDHV..?..=9.j.. 00b0 61 2e 77 0c 69 cc 94 b3 3f 6b 02 f8 62 b5 39 12 a.w.i...?k..b.9. 00c0 3f fb e9 00 fc 1b 6c 23 dc 88 7d 8d 95 f6 99 a2 ?.....l#..}..... 00d0 4d c9 48 0b 17 1b e2 25 c0 24 ae M.H....%.$. Reassembled TCP (1625 bytes): 0000 00 00 06 55 60 82 06 51 06 09 2a 86 48 86 f7 12 ...U`..Q..*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 41 38 77 e5 f8 ...........A8w.. 0020 cd 42 f0 b5 23 95 fc 1d 99 fa f2 aa 85 40 9c 99 .B..#........@.. 0030 b6 eb e0 14 f2 84 cb cd 4c ff e9 25 6e ea 4f 1b ........L..%n.O. 0040 d7 e5 d5 95 d6 ff 22 c7 af b1 f5 34 6f 78 da 77 ......"....4ox.w 0050 7f 48 2d c9 27 3b f6 11 34 b8 b0 65 27 fc 34 57 .H-.';..4..e'.4W 0060 10 bd 09 89 eb 53 70 78 90 76 35 d6 70 05 b8 92 .....Spx.v5.p... 0070 f3 da 40 a9 70 34 d0 9e 33 d9 3b eb 8e dd b3 62 ..@.p4..3.;....b 0080 d0 d7 f3 71 a3 cf 58 0d ac 8e fc 63 64 f9 7e 3f ...q..X....cd.~? 0090 1d 0f 52 c0 ad dc 82 51 01 8d c9 ac 95 8f ec 17 ..R....Q........ 00a0 bf 32 01 93 6b 5d f3 0f ad a4 88 af d9 a4 f7 53 .2..k].........S 00b0 d4 85 2a 55 e2 b8 aa 23 9c 41 36 de 7b fd f9 4a ..*U...#.A6.{..J 00c0 6e 90 68 56 19 35 99 4c 54 56 f8 aa 94 90 54 a0 n.hV.5.LTV....T. 00d0 44 90 0b 4e 18 e0 17 d3 f1 33 9f 44 67 66 5e 8d D..N.....3.Dgf^. 00e0 09 97 18 24 b2 21 63 d8 66 a7 86 f4 a2 aa 84 c7 ...$.!c.f....... 00f0 b9 c2 25 81 80 5e e2 cf 96 31 a6 d2 f6 52 95 d2 ..%..^...1...R.. 0100 2d 7f 99 76 cf b7 99 42 10 15 2e 80 f2 67 64 95 -..v...B.....gd. 0110 29 8b 51 76 2a ff 56 a6 61 5c d0 d2 3b ec 84 eb ).Qv*.V.a\..;... 0120 8b ef 3a f8 48 59 3e 57 ce 1f 51 28 83 b5 aa fe ..:.HY>W..Q(.... 0130 47 62 5d 19 b0 35 6f 6d ba c4 d8 e2 d1 94 8d 39 Gb]..5om.......9 0140 0d 7b 6c a2 22 7f 1d cd 6f f9 e8 80 1a d3 a8 fa .{l."...o....... 0150 81 d6 cc 66 f4 66 0b ca a8 a2 8d 03 b5 55 7c 0f ...f.f.......U|. 0160 ee 29 f8 6b 23 0b 48 35 50 dc 04 49 86 e8 3c ff .).k#.H5P..I..<. 0170 4c 37 12 23 09 04 89 5a 4e 68 1b cb c0 9a 8f 4c L7.#...ZNh.....L 0180 34 20 9c 75 77 9b 94 65 d1 52 c4 d9 15 66 d3 93 4 .uw..e.R...f.. 0190 3f 3d 6b 20 8d 49 7f 11 55 48 93 a1 cc 65 8f 85 ?=k .I..UH...e.. 01a0 19 59 99 a7 ab 07 14 2f b3 5d e3 c3 33 76 8d 2d .Y...../.]..3v.- 01b0 14 87 1c 40 0a 33 6a 28 19 c3 83 3e 4c 96 20 60 ...@.3j(...>L. ` 01c0 53 7b a4 be 04 4e 4b 44 1a 9e bc 66 eb c1 ce 1e S{...NKD...f.... 01d0 51 a9 d7 7e 59 56 2c cf e0 c1 58 19 5c c2 a1 e1 Q..~YV,...X.\... 01e0 5a 2c e2 89 df 3d 1e 4d d9 ae 9d fb 7c 8c 9e fa Z,...=.M....|... 01f0 44 20 21 82 83 07 ed 57 13 0a e9 52 04 7d 34 7d D !....W...R.}4} 0200 2e 9c 96 b5 af ee ab 3d 23 5a 66 12 54 af 50 e3 .......=#Zf.T.P. 0210 42 fd 55 85 76 b3 fe d6 2f dd 72 61 72 21 45 aa B.U.v.../.rar!E. 0220 5f b9 4d e6 78 47 b5 65 f0 bd f1 7b 17 10 e4 bf _.M.xG.e...{.... 0230 c9 e7 f8 15 93 31 21 ab 2d a4 12 2d 01 e6 52 8e .....1!.-..-..R. 0240 e4 51 6d f0 5b e2 5f ca 4a cc a3 c2 c8 28 7b 2c .Qm.[._.J....({, 0250 ea 8f aa fd c2 1c 11 de 4c 08 33 1f 1c 5f d6 ea ........L.3.._.. 0260 6d 0e 71 f1 c9 0d ff 90 be b3 a1 cc af 96 a8 50 m.q............P 0270 07 00 6d 91 85 25 5c 1c ae 36 33 43 00 d9 53 11 ..m..%\..63C..S. 0280 12 df c3 2e 74 a1 8d e1 97 15 a2 0d 6a 79 fc 4b ....t.......jy.K 0290 ee a7 7c b4 33 7f 7b ad 6a 69 78 c4 7e dc df 7e ..|.3.{.jix.~..~ 02a0 51 03 f6 89 92 b8 71 af 8f 21 71 8a f5 f2 79 62 Q.....q..!q...yb 02b0 7d ab fa 93 c3 27 f8 d4 e1 13 69 fb 34 3c 79 c3 }....'....i.4.r..#.. 0480 70 22 da 40 e0 74 3a 7e 6b 4a 66 03 97 0e 43 ae p".@.t:~kJf...C. 0490 27 08 97 8b c7 4d 48 6f fe 33 da 25 30 0c e9 87 '....MHo.3.%0... 04a0 4b c1 8c 6b a7 f0 9a a5 0b 25 04 ba de 60 c0 17 K..k.....%...`.. 04b0 01 e7 1a c2 8f 04 d8 55 04 9d 2a b8 3d 35 de 7e .......U..*.=5.~ 04c0 6e 6c 01 c5 ae 2b 0b 68 ef ed 55 31 98 f2 65 8c nl...+.h..U1..e. 04d0 6d fb 10 e4 6e da 0d 51 7a da f1 00 a0 57 87 51 m...n..Qz....W.Q 04e0 c5 60 3e 69 56 9f b6 93 bb a0 4d 3f ce f5 28 6c .`>iV.....M?..(l 04f0 e4 c6 cb a0 14 4c ff ca 5d 72 c2 cf de 22 b6 51 .....L..]r...".Q 0500 09 2c 12 50 40 1c 4e 3f 7c e2 68 b9 69 4b 48 db .,.P@.N?|.h.iKH. 0510 45 02 7b 54 0b f5 20 4f 63 47 da 3e 0c 8f d7 ab E.{T.. OcG.>.... 0520 0f c2 e9 94 1b 7f 81 87 ae 99 26 a4 cc b3 0c 7e ..........&....~ 0530 d1 ac b6 7b 92 cd 0c 20 ea c7 05 a7 90 7b f7 89 ...{... .....{.. 0540 2e 52 81 e1 5a bf 9e ab 07 7c 41 8e 35 3c cc 3f .R..Z....|A.5<.? 0550 d2 04 81 dd c5 71 c6 51 89 7c 6e ef 3e e3 a7 01 .....q.Q.|n.>... 0560 5a bf 0d fc 5f ce ac d2 30 77 5d f3 a5 48 93 03 Z..._...0w]..H.. 0570 95 5c b3 28 e0 e2 f6 05 43 8c dd 4a e1 77 6b fd .\.(....C..J.wk. 0580 6a 53 d7 55 34 2b 6a d9 a1 9c f6 b9 a4 5d 67 41 jS.U4+j......]gA 0590 b5 9a a8 77 87 59 f6 38 b3 9e 8b f3 a9 ef 63 34 ...w.Y.8......c4 05a0 64 02 86 f2 21 53 4f 91 c0 cb 33 a7 1c eb 90 6a d...!SO...3....j 05b0 38 14 a9 56 ea 70 91 a0 7c 4f 21 dd 29 f0 3c a0 8..V.p..|O!.).<. 05c0 44 ad 1c a8 56 34 cc 6a 94 be 0e bb 13 ea 4a 04 D...V4.j......J. 05d0 b2 22 b8 23 ad e3 21 a0 d0 9b 92 52 8a 73 44 c8 .".#..!....R.sD. 05e0 72 d6 97 93 5d 0b 67 7a 5b 06 08 be 1a d8 95 ef r...].gz[....... 05f0 a3 68 36 f4 61 a1 3a 7e 14 64 e6 58 c8 0c f5 28 .h6.a.:~.d.X...( 0600 f5 58 2c 49 53 6c 7c e5 73 07 92 f5 7a f7 b6 70 .X,ISl|.s...z..p 0610 1c 4f 2d dc 15 dc 7a 11 dd 8e d1 d2 7c c3 1b 4c .O-...z.....|..L 0620 44 48 56 1a 16 3f be bd 3d 39 ce 6a f0 f5 61 2e DHV..?..=9.j..a. 0630 77 0c 69 cc 94 b3 3f 6b 02 f8 62 b5 39 12 3f fb w.i...?k..b.9.?. 0640 e9 00 fc 1b 6c 23 dc 88 7d 8d 95 f6 99 a2 4d c9 ....l#..}.....M. 0650 48 0b 17 1b e2 25 c0 24 ae H....%.$. No. Time Source Destination Protocol Info 158 67.577920 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=4340 Ack=15337 Win=64240 Len=0 Frame 158 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 4340, Ack: 15337, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 17 40 00 80 06 bf ac ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 17 c4 0b 68 8f 66 50 10 .e.........h.fP. 0030 fa f0 ca b3 00 00 00 00 00 76 04 00 .........v.. No. Time Source Destination Protocol Info 159 67.588722 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 159 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 4340, Ack: 15337, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF354AACACD8D393C4BF9C25B6F9C37A32... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 354AACACD8D393C4 krb5_sgn_cksum: BF9C25B6F9C37A32 krb5_confounder: B3C06286209BCA3D GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 18 40 00 80 06 bf 18 ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 17 c4 0b 68 8f 66 50 18 .e.........h.fP. 0030 fa f0 2e 5d 00 00 00 00 00 8f 60 81 8c 06 09 2a ...]......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 35 4a ac ac d8 d3 93 c4 bf 9c 25 b6 f9 c3 7a 32 5J........%...z2 0060 b3 c0 62 86 20 9b ca 3d ad c7 e2 e0 e7 24 cf e2 ..b. ..=.....$.. 0070 28 ba d6 de d7 b9 43 31 cb c3 7f d7 13 d0 dc 0d (.....C1........ 0080 49 13 e2 05 57 e9 52 e5 ce c1 56 42 7e b5 a1 79 I...W.R...VB~..y 0090 e0 bd 30 e6 1f 13 eb c4 1a 98 5b 3a 30 30 9b 0b ..0.......[:00.. 00a0 62 f3 d0 3d 4d 9e 61 98 82 cb fe c5 2d f0 f8 56 b..=M.a.....-..V 00b0 7e 08 39 d3 25 12 ff df 01 13 b0 7c 08 f4 9d 18 ~.9.%......|.... 00c0 bf 9a f0 aa 17 8a ed 6f 2e .......o. No. Time Source Destination Protocol Info 160 67.589871 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 160 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 15337, Ack: 4487, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9EB43CA7F3D4C458693B2E01B5E6B353... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9EB43CA7F3D4C458 krb5_sgn_cksum: 693B2E01B5E6B353 krb5_confounder: 151B957921FE3DF9 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 02 40 00 80 06 71 10 ac 1f 01 65 ac 1f ....@...q....e.. 0020 01 68 01 85 07 f0 0b 68 8f 66 d3 1c 18 57 50 18 .h.....h.f...WP. 0030 f5 72 0d 2f 00 00 00 00 00 ae 60 81 ab 06 09 2a .r./......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 9e b4 3c a7 f3 d4 c4 58 69 3b 2e 01 b5 e6 b3 53 ..<....Xi;.....S 0060 15 1b 95 79 21 fe 3d f9 c9 77 c3 ac df 14 ad 6d ...y!.=..w.....m 0070 a6 e7 70 c1 39 30 10 04 38 ba 7b e9 c9 71 7e 36 ..p.90..8.{..q~6 0080 be e8 5a e5 91 80 44 21 92 52 33 74 d7 96 52 b5 ..Z...D!.R3t..R. 0090 e2 6d fd 5a b4 79 80 fe 86 9c b8 31 eb 12 ae cc .m.Z.y.....1.... 00a0 47 59 b9 61 80 70 6a 3a 09 1e 4e c8 f5 bd de d9 GY.a.pj:..N..... 00b0 cd 35 46 16 c9 5a 27 01 fd 18 4e 5f 9e 92 72 c4 .5F..Z'...N_..r. 00c0 d2 de c2 51 9d c2 14 aa 61 9a b2 87 fe f2 a7 33 ...Q....a......3 00d0 5b 78 41 9a b2 47 78 78 20 d8 2d 58 94 54 85 c0 [xA..Gxx .-X.T.. 00e0 4a 3a 9c ca 02 3f f1 a4 J:...?.. No. Time Source Destination Protocol Info 161 67.590791 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (309 bytes) Frame 161 (414 bytes on wire, 414 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 4487, Ack: 15515, Len: 360 Lightweight Directory Access Protocol SASL Buffer Length: 356 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF05463D3190EB0AA338D3D85760EA8629... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 05463D3190EB0AA3 krb5_sgn_cksum: 38D3D85760EA8629 krb5_confounder: E49BD3917076D733 GSS-API Encrypted payload (309 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 90 e0 19 40 00 80 06 be 42 ac 1f 01 68 ac 1f ....@....B...h.. 0020 01 65 07 f0 01 85 d3 1c 18 57 0b 68 90 18 50 18 .e.......W.h..P. 0030 fa 3e d2 a4 00 00 00 00 01 64 60 82 01 60 06 09 .>.......d`..`.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 05 46 3d 31 90 eb 0a a3 38 d3 d8 57 60 ea 86 ..F=1....8..W`.. 0060 29 e4 9b d3 91 70 76 d7 33 f1 26 58 42 d6 34 dc )....pv.3.&XB.4. 0070 3b c4 8a c4 d0 7e 6d 5a 94 7c c4 09 8a 95 71 fa ;....~mZ.|....q. 0080 63 06 c6 7e c4 ef ed 27 21 95 80 24 3c f8 34 4b c..~...'!..$<.4K 0090 4b 42 3a d0 30 48 1b ad 4d 5c 8d ee be 2e 88 84 KB:.0H..M\...... 00a0 a4 ad 4b 89 d8 49 d0 17 dd b0 3e 64 77 26 c4 1f ..K..I....>dw&.. 00b0 c6 78 1c c6 5c d9 92 98 a1 f3 12 31 c3 c9 f4 ed .x..\......1.... 00c0 07 e2 5a 80 bf 6d 39 ac b3 70 c8 c0 0f 43 16 b1 ..Z..m9..p...C.. 00d0 c5 c6 d0 c5 ca 1e 04 11 4c 84 95 7a 13 af bc be ........L..z.... 00e0 09 e9 9e 8d 1e 4e 87 c3 fe b3 f2 83 81 8a a3 d3 .....N.......... 00f0 49 f4 be 3f 96 9b 29 e2 f6 d9 4b 37 ec 66 2d ab I..?..)...K7.f-. 0100 99 fb 53 94 1d 4e 72 fc 67 11 f4 0c 8f 17 bc 71 ..S..Nr.g......q 0110 f9 1f 24 87 77 5f 20 63 41 6b f2 3e 53 2f ae e0 ..$.w_ cAk.>S/.. 0120 13 7a d8 d0 01 b7 b6 c2 3f 5f f0 27 33 52 cf 3a .z......?_.'3R.: 0130 80 fc 30 1d 94 72 1d 26 5c e1 96 a3 e4 6b de af ..0..r.&\....k.. 0140 5b 7b 18 ff d6 26 ad 3a 49 8b 87 30 97 21 aa 27 [{...&.:I..0.!.' 0150 4a 98 4b 8e 54 2f 92 f4 9f a9 bf 1c 7a 9d 85 e3 J.K.T/......z... 0160 79 ae 92 40 54 85 77 59 a0 7a 0a 2b 44 fb da 01 y..@T.wY.z.+D... 0170 91 9d 16 78 7b dc b8 dd bd 0b c8 55 ce b7 67 60 ...x{......U..g` 0180 ff ba cf a1 cc dc 87 68 45 34 05 b9 61 75 26 72 .......hE4..au&r 0190 55 24 f7 2b c8 db ba 9a b2 15 b9 de 06 1d U$.+.......... No. Time Source Destination Protocol Info 162 67.592593 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 162 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 15515, Ack: 4847, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 03 40 00 80 06 6c 0d ac 1f 01 65 ac 1f ....@...l....e.. 0020 01 68 01 85 07 f0 0b 68 90 18 d3 1c 19 bf 50 10 .h.....h......P. 0030 fa f0 5c b3 00 00 00 00 06 3d 60 82 06 39 06 09 ..\......=`..9.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff db 3b ea 8c cf 4f 9a a6 da f3 ed 6f 57 26 c9 ..;...O.....oW&. 0060 6a b6 9e 90 65 d4 7f 92 42 48 3c 2f 50 53 76 70 j...e...BH. 03e0 44 f2 aa 3f fe 94 08 3f d8 ce b8 e4 4a d0 ad 02 D..?...?....J... 03f0 b7 fc 87 48 43 1d b4 ed 9f 0a aa 1f 2d 4f 35 b3 ...HC.......-O5. 0400 66 27 2b dc e7 5b 76 ac 7b 45 4a 75 56 20 04 20 f'+..[v.{EJuV . 0410 d0 aa b9 a5 2f 16 a4 76 ce 31 2c 8b 53 bc 61 4e ..../..v.1,.S.aN 0420 26 35 39 ca c3 fc 52 b1 cf fc eb 65 78 2a 4a 84 &59...R....ex*J. 0430 32 bd dc 6d 7b 40 4e f6 2b cf ff 64 55 94 da 23 2..m{@N.+..dU..# 0440 c0 6d 93 39 11 3e fd 59 4a 7a 48 a9 c2 dd 7b 7f .m.9.>.YJzH...{. 0450 51 55 65 41 86 36 47 30 f0 7b f2 7f 5c 83 40 19 QUeA.6G0.{..\.@. 0460 6b fe 42 6d f0 7e 1b 48 79 56 96 e8 14 4a 39 b6 k.Bm.~.HyV...J9. 0470 42 e5 05 c9 0c 1b 30 07 4a c9 41 d5 a3 e6 91 42 B.....0.J.A....B 0480 c4 e5 9c 18 28 7c ba b6 15 35 4a 11 c4 d1 4b 58 ....(|...5J...KX 0490 7f 1b 56 79 0f b7 20 cc 14 df e7 76 a0 92 b2 0d ..Vy.. ....v.... 04a0 c1 10 23 40 34 8b 9c 64 81 3b 30 8d a0 47 ca 36 ..#@4..d.;0..G.6 04b0 c7 fb a9 e4 78 6f 49 28 2a ef 11 0f e0 58 e7 69 ....xoI(*....X.i 04c0 ea 70 e1 d7 95 e8 31 57 74 91 db ef 00 95 e3 af .p....1Wt....... 04d0 c6 86 1a db 95 f0 51 40 79 99 68 6f cb 05 be 55 ......Q@y.ho...U 04e0 0e 89 ba 1b 93 b4 76 e7 35 35 b8 f1 4f fc 9a 06 ......v.55..O... 04f0 4c 07 45 a3 46 9e 3d 33 df cf 66 05 d2 87 a6 e2 L.E.F.=3..f..... 0500 b5 09 fd d2 b8 ae a0 8d 91 72 a6 14 f4 41 1a f0 .........r...A.. 0510 d9 c3 24 00 38 e2 89 f2 d8 12 4f 20 90 0e 41 c0 ..$.8.....O ..A. 0520 bd 68 96 96 83 92 32 75 70 6d 4c 82 70 82 f4 e8 .h....2upmL.p... 0530 c4 c6 cb 71 63 31 39 e5 de d1 ce 4e ef e5 d6 e6 ...qc19....N.... 0540 e3 b6 24 34 7a 61 94 34 3f ed 54 47 79 53 17 67 ..$4za.4?.TGyS.g 0550 4c fd 93 9f da b5 4c a2 ad 04 87 66 5e bc b1 68 L.....L....f^..h 0560 f4 20 f2 21 87 21 a7 a0 2d 7e a7 1e 75 c9 3c 69 . .!.!..-~..u..D..?.. 03b0 08 3f d8 ce b8 e4 4a d0 ad 02 b7 fc 87 48 43 1d .?....J......HC. 03c0 b4 ed 9f 0a aa 1f 2d 4f 35 b3 66 27 2b dc e7 5b ......-O5.f'+..[ 03d0 76 ac 7b 45 4a 75 56 20 04 20 d0 aa b9 a5 2f 16 v.{EJuV . ..../. 03e0 a4 76 ce 31 2c 8b 53 bc 61 4e 26 35 39 ca c3 fc .v.1,.S.aN&59... 03f0 52 b1 cf fc eb 65 78 2a 4a 84 32 bd dc 6d 7b 40 R....ex*J.2..m{@ 0400 4e f6 2b cf ff 64 55 94 da 23 c0 6d 93 39 11 3e N.+..dU..#.m.9.> 0410 fd 59 4a 7a 48 a9 c2 dd 7b 7f 51 55 65 41 86 36 .YJzH...{.QUeA.6 0420 47 30 f0 7b f2 7f 5c 83 40 19 6b fe 42 6d f0 7e G0.{..\.@.k.Bm.~ 0430 1b 48 79 56 96 e8 14 4a 39 b6 42 e5 05 c9 0c 1b .HyV...J9.B..... 0440 30 07 4a c9 41 d5 a3 e6 91 42 c4 e5 9c 18 28 7c 0.J.A....B....(| 0450 ba b6 15 35 4a 11 c4 d1 4b 58 7f 1b 56 79 0f b7 ...5J...KX..Vy.. 0460 20 cc 14 df e7 76 a0 92 b2 0d c1 10 23 40 34 8b ....v......#@4. 0470 9c 64 81 3b 30 8d a0 47 ca 36 c7 fb a9 e4 78 6f .d.;0..G.6....xo 0480 49 28 2a ef 11 0f e0 58 e7 69 ea 70 e1 d7 95 e8 I(*....X.i.p.... 0490 31 57 74 91 db ef 00 95 e3 af c6 86 1a db 95 f0 1Wt............. 04a0 51 40 79 99 68 6f cb 05 be 55 0e 89 ba 1b 93 b4 Q@y.ho...U...... 04b0 76 e7 35 35 b8 f1 4f fc 9a 06 4c 07 45 a3 46 9e v.55..O...L.E.F. 04c0 3d 33 df cf 66 05 d2 87 a6 e2 b5 09 fd d2 b8 ae =3..f........... 04d0 a0 8d 91 72 a6 14 f4 41 1a f0 d9 c3 24 00 38 e2 ...r...A....$.8. 04e0 89 f2 d8 12 4f 20 90 0e 41 c0 bd 68 96 96 83 92 ....O ..A..h.... 04f0 32 75 70 6d 4c 82 70 82 f4 e8 c4 c6 cb 71 63 31 2upmL.p......qc1 0500 39 e5 de d1 ce 4e ef e5 d6 e6 e3 b6 24 34 7a 61 9....N......$4za 0510 94 34 3f ed 54 47 79 53 17 67 4c fd 93 9f da b5 .4?.TGyS.gL..... 0520 4c a2 ad 04 87 66 5e bc b1 68 f4 20 f2 21 87 21 L....f^..h. .!.! 0530 a7 a0 2d 7e a7 1e 75 c9 3c 69 33 0b 09 17 13 66 ..-~..u. ldap [ACK] Seq=4847 Ack=17116 Win=64240 Len=0 Frame 164 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 4847, Ack: 17116, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 1a 40 00 80 06 bf a9 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 19 bf 0b 68 96 59 50 10 .e.........h.YP. 0030 fa f0 c1 c5 00 00 02 04 05 b4 01 01 ............ No. Time Source Destination Protocol Info 165 67.594446 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (108 bytes) Frame 165 (212 bytes on wire, 212 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 4847, Ack: 17116, Len: 158 Lightweight Directory Access Protocol SASL Buffer Length: 154 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9FE61E8EA360F7DA02003E2497600A4C... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9FE61E8EA360F7DA krb5_sgn_cksum: 02003E2497600A4C krb5_confounder: A499FA03969B1A7F GSS-API Encrypted payload (108 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 c6 e0 1b 40 00 80 06 bf 0a ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 19 bf 0b 68 96 59 50 18 .e.........h.YP. 0030 fa f0 1d 2f 00 00 00 00 00 9a 60 81 97 06 09 2a .../......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 9f e6 1e 8e a3 60 f7 da 02 00 3e 24 97 60 0a 4c .....`....>$.`.L 0060 a4 99 fa 03 96 9b 1a 7f ab 99 bf 2e 08 ef 15 d6 ................ 0070 30 0b 90 35 48 dd 9c 71 e6 b2 b0 5a 4c 35 3c 4f 0..5H..q...ZL5...w......(.p.t 0080 f3 07 7b 15 cf 8e a7 c2 d8 ef 9f 69 c0 c2 d8 f9 ..{........i.... 0090 7c 35 41 0b 96 ee d5 2d de 25 dc 11 e0 49 0e 13 |5A....-.%...I.. 00a0 4c cd 90 d5 25 ff c2 77 f3 47 c8 b3 f6 ca 57 ef L...%..w.G....W. 00b0 7e 96 d1 62 42 f6 2d e9 6a 9a 07 a3 80 16 81 36 ~..bB.-.j......6 00c0 66 cf 5e df a1 1d e8 f4 ab 25 5a b7 86 e7 83 07 f.^......%Z..... 00d0 59 c8 23 53 42 21 08 52 31 c8 53 a6 b0 64 15 e3 Y.#SB!.R1.S..d.. 00e0 de 7c 54 e6 f3 3c 19 f0 d9 d1 af a1 70 9d e9 .|T..<......p.. No. Time Source Destination Protocol Info 167 67.596862 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (276 bytes) Frame 167 (381 bytes on wire, 381 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5005, Ack: 17301, Len: 327 Lightweight Directory Access Protocol SASL Buffer Length: 323 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6913A2E64CA41E05DBF9139DDB133DD2... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6913A2E64CA41E05 krb5_sgn_cksum: DBF9139DDB133DD2 krb5_confounder: 370F16D2CFA14D1A GSS-API Encrypted payload (276 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 6f e0 1c 40 00 80 06 be 60 ac 1f 01 68 ac 1f .o..@....`...h.. 0020 01 65 07 f0 01 85 d3 1c 1a 5d 0b 68 97 12 50 18 .e.......].h..P. 0030 fa 37 b9 6f 00 00 00 00 01 43 60 82 01 3f 06 09 .7.o.....C`..?.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 69 13 a2 e6 4c a4 1e 05 db f9 13 9d db 13 3d .i...L.........= 0060 d2 37 0f 16 d2 cf a1 4d 1a 5f 16 f4 c9 cb 95 e5 .7.....M._...... 0070 a5 64 8c 23 6e 1c 2a 7d 6f 39 fc 25 98 23 a9 8e .d.#n.*}o9.%.#.. 0080 45 14 1f 2a eb 80 d6 22 a6 3d 2e 72 a5 27 66 c9 E..*...".=.r.'f. 0090 10 07 0b 03 aa 0c 43 43 d8 e5 25 f3 d1 ed e3 9c ......CC..%..... 00a0 35 c8 56 05 63 df 95 bf 75 34 47 ac a0 3e 52 43 5.V.c...u4G..>RC 00b0 bd 97 e7 70 e7 bd 46 94 92 33 16 f1 65 0c 27 85 ...p..F..3..e.'. 00c0 7e 41 11 04 01 d0 bd 4e 31 10 80 05 47 4c 96 99 ~A.....N1...GL.. 00d0 9e 58 de f2 d0 74 91 3b 39 be 90 8f 7a 19 fd f8 .X...t.;9...z... 00e0 50 16 f2 14 18 73 eb e2 7e 91 9c 0b 78 b9 5e 64 P....s..~...x.^d 00f0 dc 8b 4e 78 45 3b cb b6 52 fc 18 fb 11 a2 5f a4 ..NxE;..R....._. 0100 b3 8f 91 f5 ef 95 db 85 f6 a0 3c 55 b8 e6 2e 1a ............)...a.'... No. Time Source Destination Protocol Info 168 67.612493 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (383 bytes) Frame 168 (488 bytes on wire, 488 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 17301, Ack: 5332, Len: 434 Lightweight Directory Access Protocol SASL Buffer Length: 430 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCA7E90A1E69FC27BD1599640F0C4D06E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CA7E90A1E69FC27B krb5_sgn_cksum: D1599640F0C4D06E krb5_confounder: 6AD4591E3032A992 GSS-API Encrypted payload (383 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 da 2e 06 40 00 80 06 70 0c ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 97 12 d3 1c 1b a4 50 18 .h.....h......P. 0030 f9 0b c2 55 00 00 00 00 01 ae 60 82 01 aa 06 09 ...U......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff ca 7e 90 a1 e6 9f c2 7b d1 59 96 40 f0 c4 d0 ..~.....{.Y.@... 0060 6e 6a d4 59 1e 30 32 a9 92 63 90 55 cb 0e d2 66 nj.Y.02..c.U...f 0070 f5 ba 3f 21 60 50 75 5d 02 3a 01 fd 9a b5 04 ad ..?!`Pu].:...... 0080 86 f7 c7 21 a2 9c b7 cc 03 4c d7 ea 7e 7c 30 33 ...!.....L..~|03 0090 4a e1 b7 ec f3 17 af be 22 92 3c fb ab a2 7c 2d J.......".<...|- 00a0 98 7a c0 eb 31 19 cb 36 f4 ea f5 7a 0e 7e 9a 72 .z..1..6...z.~.r 00b0 d1 fc 58 13 60 10 81 24 fe f0 a8 71 66 41 3e fa ..X.`..$...qfA>. 00c0 03 c4 74 b8 4a 42 a6 dd e7 81 63 e3 96 f9 09 44 ..t.JB....c....D 00d0 49 05 42 e9 2f 2c 33 3e c8 97 d8 df 30 47 f7 21 I.B./,3>....0G.! 00e0 15 f5 74 ff 51 c2 66 88 a5 04 91 01 03 c9 04 76 ..t.Q.f........v 00f0 b0 c9 f6 bf ae 35 fa c1 41 1d 1c c0 cd a1 5b 58 .....5..A.....[X 0100 7a 8c 0f 80 74 86 00 c0 f0 84 a2 66 ab 7f a5 2b z...t......f...+ 0110 ab 8f 8f 92 f9 f2 9c 46 0b 41 c8 e9 da a2 3d 65 .......F.A....=e 0120 fb 23 e9 55 0d db 81 77 31 da 3b 7a ed 8f 43 4f .#.U...w1.;z..CO 0130 3d 95 06 1c c8 bd 9b 10 cf c0 02 d6 16 59 52 b8 =............YR. 0140 8a ef 25 ba 8f 88 b1 21 2a ce ff 8d c1 22 1d 65 ..%....!*....".e 0150 76 b7 58 66 da 0f 7b 9b 33 19 e3 a0 d3 91 84 6d v.Xf..{.3......m 0160 94 20 5a 51 a7 ed 60 51 d5 59 c0 16 04 a7 f0 15 . ZQ..`Q.Y...... 0170 f7 1d b9 47 d8 aa f8 ef ac 61 3b ca 61 e9 4d 8f ...G.....a;.a.M. 0180 bb 68 3e e1 8d ac 0d fe 5c a6 11 c6 c9 31 76 32 .h>.....\....1v2 0190 da 0f a4 7e 38 1a a1 45 d7 a0 f2 24 42 85 6b ab ...~8..E...$B.k. 01a0 fe f9 29 8a 33 db 89 ba 5b 0e 05 e1 12 f9 c3 24 ..).3...[......$ 01b0 18 65 a4 02 eb 02 66 db 16 c8 26 1f 4a 40 a6 02 .e....f...&.J@.. 01c0 10 ab 0c f9 9a 8b 05 73 56 76 54 9b cb 8b af bb .......sVvT..... 01d0 02 1a c5 34 6a b5 4f 15 ed 0b 6e 2c cd 59 3d f9 ...4j.O...n,.Y=. 01e0 1e 4f ba cf bd eb f4 3a .O.....: No. Time Source Destination Protocol Info 169 67.614133 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 169 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5332, Ack: 17735, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF0947DC1F4092DB371E7B590B4D214B40... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 0947DC1F4092DB37 krb5_sgn_cksum: 1E7B590B4D214B40 krb5_confounder: 3329B59E191615AE GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 1d 40 00 80 06 bf 40 ac 1f 01 68 ac 1f ....@....@...h.. 0020 01 65 07 f0 01 85 d3 1c 1b a4 0b 68 98 c4 50 18 .e.........h..P. 0030 f8 85 2b 5f 00 00 00 00 00 62 60 60 06 09 2a 86 ..+_.....b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 09 H............... 0050 47 dc 1f 40 92 db 37 1e 7b 59 0b 4d 21 4b 40 33 G..@..7.{Y.M!K@3 0060 29 b5 9e 19 16 15 ae 8e 39 39 4e 5b a7 f4 41 aa ).......99N[..A. 0070 0a 48 d9 ff 16 a3 d1 51 f2 c6 cd db db ee 72 dc .H.....Q......r. 0080 47 ea ab ec 1e a9 73 a7 c9 14 d3 d0 b0 53 04 63 G.....s......S.c 0090 bc 1b 66 06 48 c5 54 cc 28 84 0c 73 ..f.H.T.(..s No. Time Source Destination Protocol Info 170 67.614984 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 170 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 17735, Ack: 5434, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 07 40 00 80 06 6c 09 ac 1f 01 65 ac 1f ....@...l....e.. 0020 01 68 01 85 07 f0 0b 68 98 c4 d3 1c 1c 0a 50 10 .h.....h......P. 0030 f8 a5 77 2d 00 00 00 00 09 dd 60 82 09 d9 06 09 ..w-......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff dd e9 51 71 66 f9 6b 85 32 a8 c2 11 e5 fc 88 ...Qqf.k.2...... 0060 fd f3 87 23 a3 8b 7b 8c ae a4 72 31 1b 9b ed 4c ...#..{...r1...L 0070 de c3 72 93 9d ce 70 5d ed 65 38 2e e3 d3 7f 62 ..r...p].e8....b 0080 65 2a cb b6 be 99 7c 95 bb c6 2a af ae 87 0a 9b e*....|...*..... 0090 fc 69 4f be 0f 5f d8 1c af ac bd 6f 94 bc 5e dc .iO.._.....o..^. 00a0 ad a6 15 4c 8e f1 81 60 56 f0 e9 41 51 bc 84 c6 ...L...`V..AQ... 00b0 e7 68 08 ec 02 8d 3f e6 36 a3 cb 8e ae 2f 18 55 .h....?.6..../.U 00c0 d3 17 73 5a f2 94 bf b5 3c 33 66 9b 65 bd 41 11 ..sZ....<3f.e.A. 00d0 46 5d e4 f2 15 f4 cf 84 1d a8 19 9a fc fd 79 9d F]............y. 00e0 6e 04 2f a1 25 43 f2 44 1b e2 7b b4 36 de 5f a2 n./.%C.D..{.6._. 00f0 7c 82 11 e5 f8 26 98 70 de ed 35 e3 fa 53 df 19 |....&.p..5..S.. 0100 32 a9 07 58 22 59 37 fb 68 c0 d1 9a 93 96 06 74 2..X"Y7.h......t 0110 2c b5 d0 08 5a 52 2e 9c f0 26 5d eb 12 2b 55 63 ,...ZR...&]..+Uc 0120 b7 57 41 33 30 4e db 1c 8c ba 92 54 47 ee bb 84 .WA30N.....TG... 0130 18 ad b8 b1 af 01 18 45 ba 4a fc 98 8a 7c af 3f .......E.J...|.? 0140 ee 27 f5 4e e6 93 84 52 9d 5d 53 f5 d6 45 d7 ad .'.N...R.]S..E.. 0150 fe 13 3c f7 48 df eb 7a b1 d2 9d 18 4d 3e 0a 68 ..<.H..z....M>.h 0160 b8 fa 54 65 a5 a3 0e 30 b6 9f b6 1e 3e c2 48 cb ..Te...0....>.H. 0170 12 2a 9d 41 0c 1b 70 d9 4e 19 9b 6a 2a 94 08 2b .*.A..p.N..j*..+ 0180 3d 09 dd a3 1d d6 1e 10 6a 46 ea 68 16 15 89 c3 =.......jF.h.... 0190 39 a4 54 11 e0 f9 63 bd e6 ca 61 2e fa 1e a1 05 9.T...c...a..... 01a0 74 61 a5 14 d7 12 f6 6b 1e 86 70 95 0d 88 74 10 ta.....k..p...t. 01b0 0d 94 d6 93 be f9 63 e0 46 6e 42 9c c7 50 15 62 ......c.FnB..P.b 01c0 64 bd 3f 94 27 e6 0e 14 3a c7 db 41 3f a0 10 bc d.?.'...:..A?... 01d0 b0 94 69 29 df 04 71 ae 18 a0 4b f0 8a bf a5 fb ..i)..q...K..... 01e0 24 17 a8 0d 5b 6b 1a d9 b2 11 23 ea 81 79 ca ee $...[k....#..y.. 01f0 be cd ca 20 a3 c1 df 88 a8 4e cf ef b1 34 f0 32 ... .....N...4.2 0200 37 9a 22 c7 f1 08 bc 31 30 3b cc 2d 55 71 c3 38 7."....10;.-Uq.8 0210 07 bf c4 ea 8e fc 98 69 c1 12 bb 19 f4 a6 1a f3 .......i........ 0220 5b 2d 7d 52 08 24 0e 82 d9 6a 1a 49 fd b1 bb 34 [-}R.$...j.I...4 0230 dc ec 9d 9e 51 9e 20 fe 4c b7 d2 71 5c de fb eb ....Q. .L..q\... 0240 fc c6 db 6d 39 b6 82 1f 6e 8e 20 32 3f 9e aa ea ...m9...n. 2?... 0250 a1 16 44 eb dd 22 9a a0 83 08 00 f5 2b c1 d6 e9 ..D.."......+... 0260 31 6e 25 cf 81 c0 4f 6a 1a 9e 5b 2a 75 1e 81 fd 1n%...Oj..[*u... 0270 b2 be 27 3a be f4 0e 7a 17 4f 86 73 a3 41 3f 59 ..':...z.O.s.A?Y 0280 43 24 24 7e b0 f2 c0 78 02 91 f4 31 df 04 a2 b3 C$$~...x...1.... 0290 84 5a c7 36 fb 3c ff fa b0 31 76 f7 64 ac ac eb .Z.6.<...1v.d... 02a0 ab 60 c1 fd 9b 27 55 b6 cf d7 35 4a fb 42 76 24 .`...'U...5J.Bv$ 02b0 4c c2 b8 b0 29 57 dc 3b fb 6a aa 6a d5 b7 d0 ea L...)W.;.j.j.... 02c0 16 e2 d9 40 ae d3 6f 19 d7 71 b5 cd 1c 84 b6 08 ...@..o..q...... 02d0 27 22 47 e1 58 3f c0 03 4a b7 79 a6 36 58 bb 14 '"G.X?..J.y.6X.. 02e0 b7 18 3a 18 28 83 d7 ae f2 5e 7c 78 2d 8f 64 5a ..:.(....^|x-.dZ 02f0 23 8a 4a d6 87 26 1a 7f 7e d3 d1 27 aa f7 36 8b #.J..&..~..'..6. 0300 f6 ed 44 fe c0 7d fc c5 bd b5 22 01 94 8c 56 b0 ..D..}...."...V. 0310 b5 ce f8 89 b6 eb 35 29 30 cd b1 59 d9 9b 3d d9 ......5)0..Y..=. 0320 0e d0 67 b5 6a 8a e4 51 d8 8b 7b 02 24 66 9b dd ..g.j..Q..{.$f.. 0330 be 81 07 6c 84 ac db ec 80 fd 2b 3e 4d 6e cf 22 ...l......+>Mn." 0340 2c 9d 02 7e 22 e2 8e 16 9c 03 07 69 78 aa b3 7d ,..~"......ix..} 0350 80 b0 e2 45 1a 01 f7 f2 9a fb 10 be 5a 76 1e e0 ...E........Zv.. 0360 a1 85 3c 5b 33 74 78 ad 95 14 a8 dc 4d c6 a2 37 ..<[3tx.....M..7 0370 5e a5 bd 5c 03 41 1f 46 5e da f5 f3 cf d8 b9 0f ^..\.A.F^....... 0380 5d 6a fb 87 54 8c 13 77 80 0f ab a8 33 51 2c c8 ]j..T..w....3Q,. 0390 3d 65 cf ce 1a 29 eb 23 55 6d 25 f4 b1 e3 4a e0 =e...).#Um%...J. 03a0 ae 16 d7 bf 1b fb e2 dc 8b f4 dd 14 2d a6 25 24 ............-.%$ 03b0 55 4b bc b2 57 85 12 f6 d2 80 df 01 6c d9 7e 60 UK..W.......l.~` 03c0 99 51 33 1f d3 1c 28 e3 60 37 ca 44 1e 47 b4 bb .Q3...(.`7.D.G.. 03d0 13 3c 8d 34 82 25 64 bc 39 86 a4 16 1b 18 4f ef .<.4.%d.9.....O. 03e0 f0 08 18 32 51 22 11 43 1f d1 37 94 c4 3f 65 f5 ...2Q".C..7..?e. 03f0 16 af 31 45 17 c6 da f7 8c 0a b1 b8 e1 73 10 04 ..1E.........s.. 0400 79 68 48 30 bc e6 06 9b ce 72 2a 3c 6f 49 68 e4 yhH0.....r*Bp. 00d0 1a ee 6c e7 81 92 d3 5b 4a d0 08 81 b3 c4 a0 e2 ..l....[J....... 00e0 4a e0 11 01 bd b7 c9 5c 3e 71 57 6e c5 d4 44 9e J......\>qWn..D. 00f0 77 0c 1a 43 ab 57 43 23 9b 15 08 d7 3c 0a 54 30 w..C.WC#....<.T0 0100 d3 c8 93 c5 30 14 6d 94 2a ef e5 0d 63 59 b1 ab ....0.m.*...cY.. 0110 38 8f 2d 0e d8 b8 3e fa d3 5b 0e 7b af 32 81 70 8.-...>..[.{.2.p 0120 4d 08 ae 89 8d e3 fe 1b 9a 47 22 75 07 45 0a ad M........G"u.E.. 0130 2a 21 6e 88 79 7c 4e fc d0 f1 6a 17 3d a4 bf 2c *!n.y|N...j.=.., 0140 e6 67 3e 0b 62 ef 07 40 c2 7b ad 22 fc c7 38 a9 .g>.b..@.{."..8. 0150 9f 1c ad b5 98 4a ff 1d ce bd 67 33 b7 ca 06 d2 .....J....g3.... 0160 b1 13 60 49 22 4f 3c 7b ff 0c b5 cc 99 b7 21 f5 ..`I"O<{......!. 0170 38 3c bf 9f 67 88 d9 e2 2e 54 bf c8 03 6c 82 20 8<..g....T...l. 0180 cb c8 18 6f ed 68 46 e5 51 d1 0c 66 6b 81 e7 3b ...o.hF.Q..fk..; 0190 27 b0 64 3f ca a7 2a b0 39 ad 79 0c 36 90 10 de '.d?..*.9.y.6... 01a0 5a 72 cc 2c e7 1a e7 9f 30 9d 4a 86 65 df 8f 2e Zr.,....0.J.e... 01b0 1b 55 bd fe 32 ea 2c f8 7e 17 6a 64 27 7e 2a 65 .U..2.,.~.jd'~*e 01c0 72 75 c8 f0 b7 57 e2 1d 7a cf ff d0 94 e6 ee 1c ru...W..z....... 01d0 00 0b 42 e2 86 f8 6b 8b 38 ca 6a 2b d2 7a 2f 2b ..B...k.8.j+.z/+ 01e0 6f 7b 72 64 49 97 20 ac 25 50 59 0c aa a6 90 56 o{rdI. .%PY....V 01f0 4c c5 20 99 e3 af ad a2 20 5d 23 d7 7f 2f 2d eb L. ..... ]#../-. 0200 a4 44 d2 32 5b 73 73 ab b0 35 a6 50 34 60 ad 46 .D.2[ss..5.P4`.F 0210 7c 22 60 81 2d 75 18 ed f8 76 ab 78 b0 99 f6 82 |"`.-u...v.x.... 0220 fb f4 3e af 7a cf bb 14 4c c6 71 b7 15 2d 99 d0 ..>.z...L.q..-.. 0230 bc 58 0e b7 8f b9 04 7d 27 d9 1a 0c de 2a a0 95 .X.....}'....*.. 0240 4f 86 ce 4c 00 fe cf 1e 23 6c 3a 31 bb 77 53 89 O..L....#l:1.wS. 0250 da 05 ba ac 86 5d 4c 30 2a 0d 03 53 f4 70 6a 81 .....]L0*..S.pj. 0260 e7 f6 41 cf 8a 14 07 49 02 a9 fe 49 d1 7d 1d f2 ..A....I...I.}.. 0270 60 c3 ba ee e8 a3 68 16 27 a0 a2 f3 a5 98 b8 ad `.....h.'....... 0280 52 f6 29 d3 a6 7a 05 f9 63 60 f0 8a c1 06 d7 58 R.)..z..c`.....X 0290 7b a1 a6 f7 6d 3e 5e ba 80 fa 9e 73 3f 6b 1c 70 {...m>^....s?k.p 02a0 74 e7 61 77 ab 51 25 f6 1b 2d 46 79 ed 16 cd a1 t.aw.Q%..-Fy.... 02b0 34 5a ef 0b e6 dc 79 93 05 a1 b8 51 0c 5c 36 a4 4Z....y....Q.\6. 02c0 e5 44 04 a1 0f 1f 6a c9 38 d4 3e 16 7d ee d4 7a .D....j.8.>.}..z 02d0 50 55 75 56 fe 97 bc 46 e5 50 50 52 0b 5f 46 a3 PUuV...F.PPR._F. 02e0 7b d0 02 c5 0e 77 fb a5 e7 e4 47 63 19 2b 3a 56 {....w....Gc.+:V 02f0 e5 d4 50 11 52 f6 ad bf 73 68 59 5e 30 b8 85 2d ..P.R...shY^0..- 0300 83 78 6f f0 a8 b8 1d 4f 7f e9 06 4b ae 28 52 12 .xo....O...K.(R. 0310 8e 94 21 c6 a8 fd 03 52 c9 b1 1c b3 5a 1d 21 27 ..!....R....Z.!' 0320 ed ca 6a 9f 2f e9 54 27 f6 e4 2b 85 35 10 cd 3a ..j./.T'..+.5..: 0330 e4 4c 00 f1 0a 4b 5a 96 78 07 30 d9 90 ad 67 e0 .L...KZ.x.0...g. 0340 8d 0c 5f db c9 ba 4a af 85 54 48 0c be c9 4e 40 .._...J..TH...N@ 0350 ce 16 70 85 c6 a8 78 19 b4 0f 49 3b 3f a7 10 df ..p...x...I;?... 0360 f5 d5 b2 27 46 97 6d 04 b3 e0 86 d2 e8 14 c5 2e ...'F.m......... 0370 79 19 9e 1e 20 70 5b 99 f5 50 a5 01 d7 e4 60 a2 y... p[..P....`. 0380 93 26 97 5d 94 26 18 47 7b 77 34 53 4a aa fa 47 .&.].&.G{w4SJ..G 0390 ea fa 15 76 06 d8 a6 86 1e c7 0a 50 63 3a 65 77 ...v.......Pc:ew 03a0 4f 00 76 27 14 4a 7c 94 ff 5a 10 9f 1f 51 b9 45 O.v'.J|..Z...Q.E 03b0 91 82 a3 4c d0 25 90 4e 4e 35 33 77 15 72 46 45 ...L.%.NN53w.rFE 03c0 0c 69 0f dc 98 3b de 19 3a 19 a3 4c 00 70 7c c2 .i...;..:..L.p|. 03d0 0c 57 34 08 3a 3c 5b 2d fe 4a 2f 0e 86 87 e3 2b .W4.:<[-.J/....+ 03e0 33 d3 8d bc 97 37 1c 8f 13 14 bd 8f 25 3b 5c d3 3....7......%;\. 03f0 a7 62 a0 c0 18 31 4b 0e 51 c2 25 f1 ec c1 a3 df .b...1K.Q.%..... 0400 5b 07 00 41 ef 8f aa e0 ee e6 fb 64 58 c4 ce 7c [..A.......dX..| 0410 5c 7a 66 8b 36 2e c3 61 df 70 6c fc 57 49 b0 6b \zf.6..a.pl.WI.k 0420 80 b1 8a 17 18 8b a4 01 df b9 ac 04 1c 65 50 28 .............eP( 0430 29 a6 ee 72 09 63 88 17 f7 ec eb 0a 16 28 83 b3 )..r.c.......(.. 0440 c4 b9 51 f5 45 34 30 a1 b8 1b 2c bf a1 3d c3 61 ..Q.E40...,..=.a 0450 c6 bb 89 bd d0 24 b3 6f 26 98 3a a5 9d 14 a8 59 .....$.o&.:....Y 0460 e6 7c 7c .|| Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff dd e9 51 71 66 .............Qqf 0020 f9 6b 85 32 a8 c2 11 e5 fc 88 fd f3 87 23 a3 8b .k.2.........#.. 0030 7b 8c ae a4 72 31 1b 9b ed 4c de c3 72 93 9d ce {...r1...L..r... 0040 70 5d ed 65 38 2e e3 d3 7f 62 65 2a cb b6 be 99 p].e8....be*.... 0050 7c 95 bb c6 2a af ae 87 0a 9b fc 69 4f be 0f 5f |...*......iO.._ 0060 d8 1c af ac bd 6f 94 bc 5e dc ad a6 15 4c 8e f1 .....o..^....L.. 0070 81 60 56 f0 e9 41 51 bc 84 c6 e7 68 08 ec 02 8d .`V..AQ....h.... 0080 3f e6 36 a3 cb 8e ae 2f 18 55 d3 17 73 5a f2 94 ?.6..../.U..sZ.. 0090 bf b5 3c 33 66 9b 65 bd 41 11 46 5d e4 f2 15 f4 ..<3f.e.A.F].... 00a0 cf 84 1d a8 19 9a fc fd 79 9d 6e 04 2f a1 25 43 ........y.n./.%C 00b0 f2 44 1b e2 7b b4 36 de 5f a2 7c 82 11 e5 f8 26 .D..{.6._.|....& 00c0 98 70 de ed 35 e3 fa 53 df 19 32 a9 07 58 22 59 .p..5..S..2..X"Y 00d0 37 fb 68 c0 d1 9a 93 96 06 74 2c b5 d0 08 5a 52 7.h......t,...ZR 00e0 2e 9c f0 26 5d eb 12 2b 55 63 b7 57 41 33 30 4e ...&]..+Uc.WA30N 00f0 db 1c 8c ba 92 54 47 ee bb 84 18 ad b8 b1 af 01 .....TG......... 0100 18 45 ba 4a fc 98 8a 7c af 3f ee 27 f5 4e e6 93 .E.J...|.?.'.N.. 0110 84 52 9d 5d 53 f5 d6 45 d7 ad fe 13 3c f7 48 df .R.]S..E....<.H. 0120 eb 7a b1 d2 9d 18 4d 3e 0a 68 b8 fa 54 65 a5 a3 .z....M>.h..Te.. 0130 0e 30 b6 9f b6 1e 3e c2 48 cb 12 2a 9d 41 0c 1b .0....>.H..*.A.. 0140 70 d9 4e 19 9b 6a 2a 94 08 2b 3d 09 dd a3 1d d6 p.N..j*..+=..... 0150 1e 10 6a 46 ea 68 16 15 89 c3 39 a4 54 11 e0 f9 ..jF.h....9.T... 0160 63 bd e6 ca 61 2e fa 1e a1 05 74 61 a5 14 d7 12 c...a.....ta.... 0170 f6 6b 1e 86 70 95 0d 88 74 10 0d 94 d6 93 be f9 .k..p...t....... 0180 63 e0 46 6e 42 9c c7 50 15 62 64 bd 3f 94 27 e6 c.FnB..P.bd.?.'. 0190 0e 14 3a c7 db 41 3f a0 10 bc b0 94 69 29 df 04 ..:..A?.....i).. 01a0 71 ae 18 a0 4b f0 8a bf a5 fb 24 17 a8 0d 5b 6b q...K.....$...[k 01b0 1a d9 b2 11 23 ea 81 79 ca ee be cd ca 20 a3 c1 ....#..y..... .. 01c0 df 88 a8 4e cf ef b1 34 f0 32 37 9a 22 c7 f1 08 ...N...4.27."... 01d0 bc 31 30 3b cc 2d 55 71 c3 38 07 bf c4 ea 8e fc .10;.-Uq.8...... 01e0 98 69 c1 12 bb 19 f4 a6 1a f3 5b 2d 7d 52 08 24 .i........[-}R.$ 01f0 0e 82 d9 6a 1a 49 fd b1 bb 34 dc ec 9d 9e 51 9e ...j.I...4....Q. 0200 20 fe 4c b7 d2 71 5c de fb eb fc c6 db 6d 39 b6 .L..q\......m9. 0210 82 1f 6e 8e 20 32 3f 9e aa ea a1 16 44 eb dd 22 ..n. 2?.....D.." 0220 9a a0 83 08 00 f5 2b c1 d6 e9 31 6e 25 cf 81 c0 ......+...1n%... 0230 4f 6a 1a 9e 5b 2a 75 1e 81 fd b2 be 27 3a be f4 Oj..[*u.....':.. 0240 0e 7a 17 4f 86 73 a3 41 3f 59 43 24 24 7e b0 f2 .z.O.s.A?YC$$~.. 0250 c0 78 02 91 f4 31 df 04 a2 b3 84 5a c7 36 fb 3c .x...1.....Z.6.< 0260 ff fa b0 31 76 f7 64 ac ac eb ab 60 c1 fd 9b 27 ...1v.d....`...' 0270 55 b6 cf d7 35 4a fb 42 76 24 4c c2 b8 b0 29 57 U...5J.Bv$L...)W 0280 dc 3b fb 6a aa 6a d5 b7 d0 ea 16 e2 d9 40 ae d3 .;.j.j.......@.. 0290 6f 19 d7 71 b5 cd 1c 84 b6 08 27 22 47 e1 58 3f o..q......'"G.X? 02a0 c0 03 4a b7 79 a6 36 58 bb 14 b7 18 3a 18 28 83 ..J.y.6X....:.(. 02b0 d7 ae f2 5e 7c 78 2d 8f 64 5a 23 8a 4a d6 87 26 ...^|x-.dZ#.J..& 02c0 1a 7f 7e d3 d1 27 aa f7 36 8b f6 ed 44 fe c0 7d ..~..'..6...D..} 02d0 fc c5 bd b5 22 01 94 8c 56 b0 b5 ce f8 89 b6 eb ...."...V....... 02e0 35 29 30 cd b1 59 d9 9b 3d d9 0e d0 67 b5 6a 8a 5)0..Y..=...g.j. 02f0 e4 51 d8 8b 7b 02 24 66 9b dd be 81 07 6c 84 ac .Q..{.$f.....l.. 0300 db ec 80 fd 2b 3e 4d 6e cf 22 2c 9d 02 7e 22 e2 ....+>Mn.",..~". 0310 8e 16 9c 03 07 69 78 aa b3 7d 80 b0 e2 45 1a 01 .....ix..}...E.. 0320 f7 f2 9a fb 10 be 5a 76 1e e0 a1 85 3c 5b 33 74 ......Zv....<[3t 0330 78 ad 95 14 a8 dc 4d c6 a2 37 5e a5 bd 5c 03 41 x.....M..7^..\.A 0340 1f 46 5e da f5 f3 cf d8 b9 0f 5d 6a fb 87 54 8c .F^.......]j..T. 0350 13 77 80 0f ab a8 33 51 2c c8 3d 65 cf ce 1a 29 .w....3Q,.=e...) 0360 eb 23 55 6d 25 f4 b1 e3 4a e0 ae 16 d7 bf 1b fb .#Um%...J....... 0370 e2 dc 8b f4 dd 14 2d a6 25 24 55 4b bc b2 57 85 ......-.%$UK..W. 0380 12 f6 d2 80 df 01 6c d9 7e 60 99 51 33 1f d3 1c ......l.~`.Q3... 0390 28 e3 60 37 ca 44 1e 47 b4 bb 13 3c 8d 34 82 25 (.`7.D.G...<.4.% 03a0 64 bc 39 86 a4 16 1b 18 4f ef f0 08 18 32 51 22 d.9.....O....2Q" 03b0 11 43 1f d1 37 94 c4 3f 65 f5 16 af 31 45 17 c6 .C..7..?e...1E.. 03c0 da f7 8c 0a b1 b8 e1 73 10 04 79 68 48 30 bc e6 .......s..yhH0.. 03d0 06 9b ce 72 2a 3c 6f 49 68 e4 be be 4b 1f ec d1 ...r*Bp... 0650 6c e7 81 92 d3 5b 4a d0 08 81 b3 c4 a0 e2 4a e0 l....[J.......J. 0660 11 01 bd b7 c9 5c 3e 71 57 6e c5 d4 44 9e 77 0c .....\>qWn..D.w. 0670 1a 43 ab 57 43 23 9b 15 08 d7 3c 0a 54 30 d3 c8 .C.WC#....<.T0.. 0680 93 c5 30 14 6d 94 2a ef e5 0d 63 59 b1 ab 38 8f ..0.m.*...cY..8. 0690 2d 0e d8 b8 3e fa d3 5b 0e 7b af 32 81 70 4d 08 -...>..[.{.2.pM. 06a0 ae 89 8d e3 fe 1b 9a 47 22 75 07 45 0a ad 2a 21 .......G"u.E..*! 06b0 6e 88 79 7c 4e fc d0 f1 6a 17 3d a4 bf 2c e6 67 n.y|N...j.=..,.g 06c0 3e 0b 62 ef 07 40 c2 7b ad 22 fc c7 38 a9 9f 1c >.b..@.{."..8... 06d0 ad b5 98 4a ff 1d ce bd 67 33 b7 ca 06 d2 b1 13 ...J....g3...... 06e0 60 49 22 4f 3c 7b ff 0c b5 cc 99 b7 21 f5 38 3c `I"O<{......!.8< 06f0 bf 9f 67 88 d9 e2 2e 54 bf c8 03 6c 82 20 cb c8 ..g....T...l. .. 0700 18 6f ed 68 46 e5 51 d1 0c 66 6b 81 e7 3b 27 b0 .o.hF.Q..fk..;'. 0710 64 3f ca a7 2a b0 39 ad 79 0c 36 90 10 de 5a 72 d?..*.9.y.6...Zr 0720 cc 2c e7 1a e7 9f 30 9d 4a 86 65 df 8f 2e 1b 55 .,....0.J.e....U 0730 bd fe 32 ea 2c f8 7e 17 6a 64 27 7e 2a 65 72 75 ..2.,.~.jd'~*eru 0740 c8 f0 b7 57 e2 1d 7a cf ff d0 94 e6 ee 1c 00 0b ...W..z......... 0750 42 e2 86 f8 6b 8b 38 ca 6a 2b d2 7a 2f 2b 6f 7b B...k.8.j+.z/+o{ 0760 72 64 49 97 20 ac 25 50 59 0c aa a6 90 56 4c c5 rdI. .%PY....VL. 0770 20 99 e3 af ad a2 20 5d 23 d7 7f 2f 2d eb a4 44 ..... ]#../-..D 0780 d2 32 5b 73 73 ab b0 35 a6 50 34 60 ad 46 7c 22 .2[ss..5.P4`.F|" 0790 60 81 2d 75 18 ed f8 76 ab 78 b0 99 f6 82 fb f4 `.-u...v.x...... 07a0 3e af 7a cf bb 14 4c c6 71 b7 15 2d 99 d0 bc 58 >.z...L.q..-...X 07b0 0e b7 8f b9 04 7d 27 d9 1a 0c de 2a a0 95 4f 86 .....}'....*..O. 07c0 ce 4c 00 fe cf 1e 23 6c 3a 31 bb 77 53 89 da 05 .L....#l:1.wS... 07d0 ba ac 86 5d 4c 30 2a 0d 03 53 f4 70 6a 81 e7 f6 ...]L0*..S.pj... 07e0 41 cf 8a 14 07 49 02 a9 fe 49 d1 7d 1d f2 60 c3 A....I...I.}..`. 07f0 ba ee e8 a3 68 16 27 a0 a2 f3 a5 98 b8 ad 52 f6 ....h.'.......R. 0800 29 d3 a6 7a 05 f9 63 60 f0 8a c1 06 d7 58 7b a1 )..z..c`.....X{. 0810 a6 f7 6d 3e 5e ba 80 fa 9e 73 3f 6b 1c 70 74 e7 ..m>^....s?k.pt. 0820 61 77 ab 51 25 f6 1b 2d 46 79 ed 16 cd a1 34 5a aw.Q%..-Fy....4Z 0830 ef 0b e6 dc 79 93 05 a1 b8 51 0c 5c 36 a4 e5 44 ....y....Q.\6..D 0840 04 a1 0f 1f 6a c9 38 d4 3e 16 7d ee d4 7a 50 55 ....j.8.>.}..zPU 0850 75 56 fe 97 bc 46 e5 50 50 52 0b 5f 46 a3 7b d0 uV...F.PPR._F.{. 0860 02 c5 0e 77 fb a5 e7 e4 47 63 19 2b 3a 56 e5 d4 ...w....Gc.+:V.. 0870 50 11 52 f6 ad bf 73 68 59 5e 30 b8 85 2d 83 78 P.R...shY^0..-.x 0880 6f f0 a8 b8 1d 4f 7f e9 06 4b ae 28 52 12 8e 94 o....O...K.(R... 0890 21 c6 a8 fd 03 52 c9 b1 1c b3 5a 1d 21 27 ed ca !....R....Z.!'.. 08a0 6a 9f 2f e9 54 27 f6 e4 2b 85 35 10 cd 3a e4 4c j./.T'..+.5..:.L 08b0 00 f1 0a 4b 5a 96 78 07 30 d9 90 ad 67 e0 8d 0c ...KZ.x.0...g... 08c0 5f db c9 ba 4a af 85 54 48 0c be c9 4e 40 ce 16 _...J..TH...N@.. 08d0 70 85 c6 a8 78 19 b4 0f 49 3b 3f a7 10 df f5 d5 p...x...I;?..... 08e0 b2 27 46 97 6d 04 b3 e0 86 d2 e8 14 c5 2e 79 19 .'F.m.........y. 08f0 9e 1e 20 70 5b 99 f5 50 a5 01 d7 e4 60 a2 93 26 .. p[..P....`..& 0900 97 5d 94 26 18 47 7b 77 34 53 4a aa fa 47 ea fa .].&.G{w4SJ..G.. 0910 15 76 06 d8 a6 86 1e c7 0a 50 63 3a 65 77 4f 00 .v.......Pc:ewO. 0920 76 27 14 4a 7c 94 ff 5a 10 9f 1f 51 b9 45 91 82 v'.J|..Z...Q.E.. 0930 a3 4c d0 25 90 4e 4e 35 33 77 15 72 46 45 0c 69 .L.%.NN53w.rFE.i 0940 0f dc 98 3b de 19 3a 19 a3 4c 00 70 7c c2 0c 57 ...;..:..L.p|..W 0950 34 08 3a 3c 5b 2d fe 4a 2f 0e 86 87 e3 2b 33 d3 4.:<[-.J/....+3. 0960 8d bc 97 37 1c 8f 13 14 bd 8f 25 3b 5c d3 a7 62 ...7......%;\..b 0970 a0 c0 18 31 4b 0e 51 c2 25 f1 ec c1 a3 df 5b 07 ...1K.Q.%.....[. 0980 00 41 ef 8f aa e0 ee e6 fb 64 58 c4 ce 7c 5c 7a .A.......dX..|\z 0990 66 8b 36 2e c3 61 df 70 6c fc 57 49 b0 6b 80 b1 f.6..a.pl.WI.k.. 09a0 8a 17 18 8b a4 01 df b9 ac 04 1c 65 50 28 29 a6 ...........eP(). 09b0 ee 72 09 63 88 17 f7 ec eb 0a 16 28 83 b3 c4 b9 .r.c.......(.... 09c0 51 f5 45 34 30 a1 b8 1b 2c bf a1 3d c3 61 c6 bb Q.E40...,..=.a.. 09d0 89 bd d0 24 b3 6f 26 98 3a a5 9d 14 a8 59 e6 7c ...$.o&.:....Y.| 09e0 7c | No. Time Source Destination Protocol Info 172 67.615465 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=5434 Ack=20264 Win=64240 Len=0 Frame 172 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5434, Ack: 20264, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 1e 40 00 80 06 bf a5 ac 1f 01 68 ac 1f .(..@........h.. 0020 01 65 07 f0 01 85 d3 1c 1c 0a 0b 68 a2 a5 50 10 .e.........h..P. 0030 fa f0 b3 2e 00 00 00 00 00 76 04 00 .........v.. No. Time Source Destination Protocol Info 173 67.617526 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (167 bytes) Frame 173 (271 bytes on wire, 271 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5434, Ack: 20264, Len: 217 Lightweight Directory Access Protocol SASL Buffer Length: 213 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF7365577E8BE88BFA881AE9ADA023F798... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 7365577E8BE88BFA krb5_sgn_cksum: 881AE9ADA023F798 krb5_confounder: 6924F6D0DBB46FB6 GSS-API Encrypted payload (167 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 01 e0 1f 40 00 80 06 be cb ac 1f 01 68 ac 1f ....@........h.. 0020 01 65 07 f0 01 85 d3 1c 1c 0a 0b 68 a2 a5 50 18 .e.........h..P. 0030 fa f0 a1 88 00 00 00 00 00 d5 60 81 d2 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 73 65 57 7e 8b e8 8b fa 88 1a e9 ad a0 23 f7 98 seW~.........#.. 0060 69 24 f6 d0 db b4 6f b6 be 6e c5 17 8d 4e 99 a4 i$....o..n...N.. 0070 c6 23 02 61 4a ed 9e 36 d1 fb 0e aa 64 00 fd 81 .#.aJ..6....d... 0080 72 42 22 98 fb 6d 0d 17 8e 65 63 4a 10 b4 76 b7 rB"..m...ecJ..v. 0090 1c 98 bf 93 ce 02 3e 7f 3c d4 88 de 6a 96 33 f6 ......>.<...j.3. 00a0 e7 51 7b 87 31 44 f1 23 d6 51 14 2f be 6f 7c 6d .Q{.1D.#.Q./.o|m 00b0 86 7d 2b 84 39 1a 8f e4 fd 80 04 a7 41 ad c2 74 .}+.9.......A..t 00c0 f1 95 d5 e6 4f c2 9f d7 2b 0c 11 20 ec 8e 44 88 ....O...+.. ..D. 00d0 01 8a 5d c7 08 1d f3 bb f3 c5 32 76 1e 2e 6d d1 ..].......2v..m. 00e0 43 a3 86 ce fb 04 83 d4 69 84 fa be 25 6a 0a d3 C.......i...%j.. 00f0 27 29 76 bb 8b a3 56 5d 00 dd e6 d6 50 db db d8 ')v...V]....P... 0100 03 3f b9 4a cd c3 43 95 80 bb a5 5f 4d d7 e5 .?.J..C...._M.. No. Time Source Destination Protocol Info 174 67.618740 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (268 bytes) Frame 174 (373 bytes on wire, 373 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 20264, Ack: 5651, Len: 319 Lightweight Directory Access Protocol SASL Buffer Length: 315 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF1A90C2D34F71B4C6208B2BF1DA5ECA47... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 1A90C2D34F71B4C6 krb5_sgn_cksum: 208B2BF1DA5ECA47 krb5_confounder: 5D2B4D63D50E1D0E GSS-API Encrypted payload (268 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 67 2e 09 40 00 80 06 70 7c ac 1f 01 65 ac 1f .g..@...p|...e.. 0020 01 68 01 85 07 f0 0b 68 a2 a5 d3 1c 1c e3 50 18 .h.....h......P. 0030 f7 cc af 09 00 00 00 00 01 3b 60 82 01 37 06 09 .........;`..7.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 1a 90 c2 d3 4f 71 b4 c6 20 8b 2b f1 da 5e ca .....Oq.. .+..^. 0060 47 5d 2b 4d 63 d5 0e 1d 0e 4a 7a 7f 27 ea c6 8e G]+Mc....Jz.'... 0070 ba a8 f8 2d b9 91 b3 b2 eb a4 78 d3 76 22 1a ca ...-......x.v".. 0080 49 05 71 39 ab a6 d7 c4 e8 8b 25 ff 1d 4f ec 6c I.q9......%..O.l 0090 b6 7b 63 e9 75 dc 81 d3 75 9c 52 e8 de bf e8 61 .{c.u...u.R....a 00a0 e5 7c 50 1e 45 b1 a2 17 4e e7 71 08 c4 3f f3 57 .|P.E...N.q..?.W 00b0 87 b0 48 bb 2d a2 8e 6f 6f 84 5c c5 ab 0b b9 33 ..H.-..oo.\....3 00c0 c2 17 64 8f 93 fd 9a 6a 8c 47 bb d5 5d 50 b2 72 ..d....j.G..]P.r 00d0 9d bd 04 10 f8 f4 6b 81 85 fd 01 71 f3 4d ed 8b ......k....q.M.. 00e0 43 95 65 fe d0 78 28 fa cd c4 5f a4 02 f1 f8 c7 C.e..x(..._..... 00f0 d5 45 46 80 70 55 8c 10 cd f7 c0 b3 a9 e8 f6 db .EF.pU.......... 0100 f4 b6 87 cf ac 91 43 f9 56 35 e1 d0 3d 0a 65 84 ......C.V5..=.e. 0110 fb 76 67 f3 2d b3 5e cc 05 79 8f b5 8d 43 bb bc .vg.-.^..y...C.. 0120 80 71 aa 96 75 5f 7c c3 9a bc 21 4e f8 c0 f8 4e .q..u_|...!N...N 0130 fa be 13 ce 1f 75 36 a1 24 b8 dc 6d fb c0 ff bd .....u6.$..m.... 0140 2d 9f 8b 8e fd 5f 0f a0 d8 5f b5 c6 20 da d9 72 -...._..._.. ..r 0150 c2 90 80 49 c5 c2 48 6a 8d d5 8e fe c0 83 b7 28 ...I..Hj.......( 0160 b4 14 30 b0 59 b3 10 b0 c8 f6 05 aa 0e 59 14 83 ..0.Y........Y.. 0170 c5 36 23 82 2d .6#.- No. Time Source Destination Protocol Info 175 67.622394 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (161 bytes) Frame 175 (265 bytes on wire, 265 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5651, Ack: 20583, Len: 211 Lightweight Directory Access Protocol SASL Buffer Length: 207 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF38EE63D885BA069D7C8E0BFE1038B768... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 38EE63D885BA069D krb5_sgn_cksum: 7C8E0BFE1038B768 krb5_confounder: 69395421AD448B17 GSS-API Encrypted payload (161 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fb e0 20 40 00 80 06 be d0 ac 1f 01 68 ac 1f ... @........h.. 0020 01 65 07 f0 01 85 d3 1c 1c e3 0b 68 a3 e4 50 18 .e.........h..P. 0030 f9 b1 a6 cc 00 00 00 00 00 cf 60 81 cc 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 38 ee 63 d8 85 ba 06 9d 7c 8e 0b fe 10 38 b7 68 8.c.....|....8.h 0060 69 39 54 21 ad 44 8b 17 fa 9b 74 b7 a1 52 d2 73 i9T!.D....t..R.s 0070 75 9a 44 4d cb bd 69 60 ca 3f ef 9b 28 21 17 6d u.DM..i`.?..(!.m 0080 78 2b ff 42 a7 59 8b 71 af 99 df eb 5f d3 90 1c x+.B.Y.q...._... 0090 24 4a 18 fa 7f fd eb 37 fc b7 0e d2 85 76 25 71 $J.....7.....v%q 00a0 9a 8c 52 eb 33 b8 a3 42 cf 15 1c 87 c4 9e 4f 2d ..R.3..B......O- 00b0 ee 69 1a ba f2 c7 24 a3 bd 84 51 84 ce e6 4d 3e .i....$...Q...M> 00c0 81 86 41 fa 29 5f 2c 49 7f 04 2e 18 fe 42 e0 c8 ..A.)_,I.....B.. 00d0 53 68 96 d5 0f cc c5 5e 23 28 61 21 69 3b 75 56 Sh.....^#(a!i;uV 00e0 a5 ba 05 d5 11 0e cd f0 40 81 55 d5 7a eb 05 cf ........@.U.z... 00f0 ba 1d 95 59 5a 04 43 b5 83 0a 01 f9 2c 34 a8 95 ...YZ.C.....,4.. 0100 fc b0 67 ae 40 18 74 7c f4 ..g.@.t|. No. Time Source Destination Protocol Info 176 67.626929 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (191 bytes) Frame 176 (295 bytes on wire, 295 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 20583, Ack: 5862, Len: 241 Lightweight Directory Access Protocol SASL Buffer Length: 237 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF15BFBDF534298AEE6B8D7D6E0BFB98B7... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 15BFBDF534298AEE krb5_sgn_cksum: 6B8D7D6E0BFB98B7 krb5_confounder: 0CA924E8A978AFE8 GSS-API Encrypted payload (191 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 19 2e 0a 40 00 80 06 70 c9 ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 a3 e4 d3 1c 1d b6 50 18 .h.....h......P. 0030 f6 f9 14 4a 00 00 00 00 00 ed 60 81 ea 06 09 2a ...J......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 15 bf bd f5 34 29 8a ee 6b 8d 7d 6e 0b fb 98 b7 ....4)..k.}n.... 0060 0c a9 24 e8 a9 78 af e8 65 5b 5a 35 92 ed 73 3a ..$..x..e[Z5..s: 0070 fe aa 69 7c 01 a4 45 55 91 c4 62 67 36 fe a1 a2 ..i|..EU..bg6... 0080 d7 af 77 f9 72 24 6e 56 23 28 f6 97 96 8a 9c 17 ..w.r$nV#(...... 0090 dc 8d 1f 39 60 1a 09 51 e2 c3 0a ca b8 76 af ca ...9`..Q.....v.. 00a0 37 40 99 89 58 0b bb 5f d1 18 9a 42 2b 3b bd 3f 7@..X.._...B+;.? 00b0 6f 5a 13 90 5c 8c 3f 1e 6d 89 ad 6d 58 3e cf 13 oZ..\.?.m..mX>.. 00c0 32 3e 41 4c e9 fc 68 8f c7 12 3e bb 7c 27 da 6c 2>AL..h...>.|'.l 00d0 4a f5 ed fa 36 a4 cd 3f c2 4c d1 18 57 16 ea dd J...6..?.L..W... 00e0 d7 e0 ef f8 2e 8a 32 a8 fe 4d cd 94 17 78 03 3a ......2..M...x.: 00f0 a6 4a a1 21 58 9c 7c bf 55 f9 a6 82 41 5b bf 57 .J.!X.|.U...A[.W 0100 f9 93 35 a4 b6 d9 36 c4 a9 72 a1 41 51 bb a7 3a ..5...6..r.AQ..: 0110 ea 95 ad a9 54 08 f5 ec 08 11 a3 da 3a d0 e0 2a ....T.......:..* 0120 94 aa 23 cd 58 3a d0 ..#.X:. No. Time Source Destination Protocol Info 177 67.630261 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (195 bytes) Frame 177 (299 bytes on wire, 299 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 5862, Ack: 20824, Len: 245 Lightweight Directory Access Protocol SASL Buffer Length: 241 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCA65FE9BE173048871470954538526A6... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CA65FE9BE1730488 krb5_sgn_cksum: 71470954538526A6 krb5_confounder: 9FB2F91EA038ACED GSS-API Encrypted payload (195 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 1d e0 21 40 00 80 06 be ad ac 1f 01 68 ac 1f ...!@........h.. 0020 01 65 07 f0 01 85 d3 1c 1d b6 0b 68 a4 d5 50 18 .e.........h..P. 0030 f8 c0 fb de 00 00 00 00 00 f1 60 81 ee 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 ca 65 fe 9b e1 73 04 88 71 47 09 54 53 85 26 a6 .e...s..qG.TS.&. 0060 9f b2 f9 1e a0 38 ac ed 7b 1f 78 4b 1d 53 d0 4c .....8..{.xK.S.L 0070 da ef 5e 2a 8e 80 a9 33 b2 93 b7 53 c4 6f 38 44 ..^*...3...S.o8D 0080 ee 99 b9 79 c7 b1 8c d3 48 85 46 04 fe ec 3a d7 ...y....H.F...:. 0090 af 8b 34 d5 a9 f7 12 e4 e9 93 c3 53 6b b2 28 ca ..4........Sk.(. 00a0 98 3f d4 bc c5 44 e1 57 a3 2e f8 8b a5 cf 3d d7 .?...D.W......=. 00b0 ed 63 9b 96 72 05 ee 01 cc 3f 4e 25 4b b7 93 cf .c..r....?N%K... 00c0 34 f8 86 f9 46 e2 aa b7 62 73 09 6c 77 c5 28 06 4...F...bs.lw.(. 00d0 60 cd 2c 8f e8 18 18 2f ec a2 a4 81 60 d4 ab fe `.,..../....`... 00e0 3c a4 ed ff 11 23 00 cc 65 a7 ce df e4 a2 4b b7 <....#..e.....K. 00f0 58 83 cb dd a9 9b c3 df 72 31 f7 ad 66 08 6d 8a X.......r1..f.m. 0100 1d 3c 3a 3c ed 18 d1 aa 82 b0 86 c4 d3 e9 f7 b2 .<:<............ 0110 94 45 33 9a 19 66 21 29 f3 7d 31 ca 03 61 ce 51 .E3..f!).}1..a.Q 0120 58 f4 b7 3d a5 65 8f 4e 24 e9 14 X..=.e.N$.. No. Time Source Destination Protocol Info 178 67.632147 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 178 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 20824, Ack: 6107, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 0b 40 00 80 06 6c 05 ac 1f 01 65 ac 1f ....@...l....e.. 0020 01 68 01 85 07 f0 0b 68 a4 d5 d3 1c 1e ab 50 10 .h.....h......P. 0030 f6 04 d5 64 00 00 00 00 09 21 60 82 09 1d 06 09 ...d.....!`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff cc ad 74 5a 61 bb 76 f5 88 c3 8a 31 0d 47 36 ...tZa.v....1.G6 0060 23 e0 79 cd d0 cd 2e 25 8b c6 6f 0a 68 2f f8 37 #.y....%..o.h/.7 0070 e7 84 45 01 3c 85 9d d1 2a da 37 9d 90 1a 67 0c ..E.<...*.7...g. 0080 fe 78 29 7d e9 a6 ee ed a2 7f 48 e4 c1 ec ea ad .x)}......H..... 0090 1d db c1 3b a2 fe b8 3b 1c 60 cd 84 47 4a 35 ec ...;...;.`..GJ5. 00a0 1c 66 d3 30 3b 6b c3 d8 b1 97 80 a0 a6 dd 6a ed .f.0;k........j. 00b0 91 7f 5d ea 2c fa dd 0b 02 03 de 22 08 19 32 82 ..].,......"..2. 00c0 5c ae 49 c3 f6 22 f6 0a 02 b8 6b d6 df f9 9a 1d \.I.."....k..... 00d0 47 a1 7f 98 2d 46 e6 12 f9 aa 00 0b af c6 a8 ff G...-F.......... 00e0 65 ee 8c 5c c0 ad 66 7a 72 47 5a d6 3e c7 e9 ad e..\..fzrGZ.>... 00f0 b0 40 be bd 71 c5 24 c1 33 5b 11 8c 8a 0b 76 6d .@..q.$.3[....vm 0100 38 ae 26 16 b1 82 ad fd f8 8e 19 6d 2d 20 32 72 8.&........m- 2r 0110 93 00 3f ae 73 ae b0 d1 27 f0 1a 40 f0 71 64 b9 ..?.s...'..@.qd. 0120 a8 27 cb 2c a5 a8 d4 69 ed 94 7c 19 eb 60 cf 8b .'.,...i..|..`.. 0130 e2 d5 90 5d 29 68 91 51 c7 19 88 cf d9 92 b7 4d ...])h.Q.......M 0140 ce f6 19 18 14 1a 43 d5 41 fa 0a a6 90 0d 2d 47 ......C.A.....-G 0150 dc 92 a5 2f 35 9a 1d 35 19 1a 21 6f de 7b ba fb .../5..5..!o.{.. 0160 75 83 2b 81 b2 87 21 c4 72 a5 7b 0a 51 c1 be 76 u.+...!.r.{.Q..v 0170 98 3b 0a bb 57 7c 20 4b cb e3 cf 1c 9d 39 58 36 .;..W| K.....9X6 0180 2f 14 94 c1 cd 6f 7a 9f 41 1a 40 88 59 b6 f5 45 /....oz.A.@.Y..E 0190 47 57 80 98 7e 41 ce 8c 00 50 5c 2e df ae 27 2c GW..~A...P\...', 01a0 d8 64 a2 44 09 f7 4a 97 f6 d3 e3 e9 33 22 9a ec .d.D..J.....3".. 01b0 82 f8 5c de c2 7d 02 cd 00 d1 13 61 ca ee a9 2b ..\..}.....a...+ 01c0 32 c0 2f 58 9d 7e a1 8d 24 fd 1c fc 42 b0 94 02 2./X.~..$...B... 01d0 5c 9c 11 a2 0b bc a4 c7 da c0 a5 4d 19 72 b2 d3 \..........M.r.. 01e0 86 51 39 9a 3d cf 77 cf 6f d8 89 da 32 93 48 6d .Q9.=.w.o...2.Hm 01f0 15 99 28 04 74 37 5e 95 71 a4 93 b2 f5 5b ec 6a ..(.t7^.q....[.j 0200 f1 23 6c ff b9 24 58 bb bc 2f e8 6c f5 e3 d3 58 .#l..$X../.l...X 0210 39 0a 18 0a 23 2c 61 43 a3 b7 24 c7 1e d2 54 be 9...#,aC..$...T. 0220 7b a1 e5 14 27 cc f9 d5 8c 0e be 1b d7 33 09 9a {...'........3.. 0230 2d dc e6 80 62 90 dc 8c fe 34 e4 96 9a 24 6a 6c -...b....4...$jl 0240 a3 86 e6 90 bd 16 42 a7 1f 40 b5 b6 32 b9 e9 2c ......B..@..2.., 0250 69 e1 ea 61 aa 81 67 3d ae 41 17 61 f0 87 3b 09 i..a..g=.A.a..;. 0260 9b 8f 9a 75 72 62 cd 3c bc bb e6 aa c9 c1 7a 8b ...urb.<......z. 0270 fa 10 73 7f 6d dd 1b 19 7e 7d 25 e1 47 e9 46 61 ..s.m...~}%.G.Fa 0280 ef 99 15 1e 05 c7 1c 7c 91 d1 3a ca 9f 88 1d 14 .......|..:..... 0290 96 7b cb d7 20 6c 47 23 fd 2e 31 b6 af 11 70 8f .{.. lG#..1...p. 02a0 8c f9 fb 74 76 d7 01 ef d9 ca 5b 9f c6 b5 74 2c ...tv.....[...t, 02b0 72 e9 8f 42 4e 51 8f 4c 1b 81 38 2b fa 3f f5 0c r..BNQ.L..8+.?.. 02c0 3d fc d6 fc 03 d4 c6 10 47 cc dc a8 7e 8b e7 d7 =.......G...~... 02d0 e7 e6 b0 d3 dc 4d e6 00 1a 54 bf c1 45 aa 87 ad .....M...T..E... 02e0 c7 c2 db 26 74 e6 04 b2 3b a4 5a 76 09 05 7c d5 ...&t...;.Zv..|. 02f0 d4 38 55 6a 51 b8 b9 9f 30 34 b5 49 f9 5a 4e 8b .8UjQ...04.I.ZN. 0300 90 c8 20 7a 75 60 5b eb c2 f9 31 ca 56 5e b3 a6 .. zu`[...1.V^.. 0310 d2 94 f6 d5 c5 9b 90 e5 f3 69 17 29 04 13 04 8d .........i.).... 0320 c5 b3 d7 b3 d2 7a b9 20 04 ff 15 90 7a 05 11 62 .....z. ....z..b 0330 ed 70 6a 6f 8c 74 06 14 70 ba 8b c4 75 5f 8b 2e .pjo.t..p...u_.. 0340 21 97 96 e9 4e bd d5 19 2d 1b 40 11 3a fd 93 b7 !...N...-.@.:... 0350 5f af 4e d8 6a d3 de c2 c1 ff eb 1f d1 08 bd 94 _.N.j........... 0360 06 b7 00 0d d2 8d b1 67 67 f7 09 cd 3b 04 04 db .......gg...;... 0370 b0 b1 0f bb a8 3a 9b c7 72 7f a2 13 72 d0 b2 fc .....:..r...r... 0380 04 c2 84 ce f7 ed 75 e3 f5 5e ff dc a9 b2 5d 75 ......u..^....]u 0390 7c 51 66 c2 61 34 08 5b da b9 9f fc c3 bf 0a 12 |Qf.a4.[........ 03a0 aa 0b d9 41 8d 12 89 ab 1c d9 f9 c9 b4 5a d0 3e ...A.........Z.> 03b0 22 15 3b 61 31 83 4c c0 98 af 4b 73 5d da c6 99 ".;a1.L...Ks]... 03c0 e2 f9 3b e1 80 32 fb 59 12 b1 50 c3 97 cb b7 f1 ..;..2.Y..P..... 03d0 86 3e e8 a5 3b 5d 2a 11 e2 6d 81 26 0d 3c e2 98 .>..;]*..m.&.<.. 03e0 30 41 54 7b 99 41 b8 b6 4b 68 52 4f c7 c6 b6 e4 0AT{.A..KhRO.... 03f0 56 05 49 4d 61 26 7a c1 28 d4 66 9b 78 00 a3 2b V.IMa&z.(.f.x..+ 0400 59 8b 2f b6 39 d9 73 52 f4 14 40 91 c4 96 2b 18 Y./.9.sR..@...+. 0410 82 a1 4e 0f f4 f5 1b 62 4b 8f aa 24 c9 de 81 cb ..N....bK..$.... 0420 4a 7c 42 3f 7c 7a 37 35 c0 87 71 21 4b 54 89 3d J|B?|z75..q!KT.= 0430 e9 5f e2 21 a6 c6 12 35 81 c0 84 42 65 6b 8d ba ._.!...5...Bek.. 0440 73 31 57 b5 6d 25 06 9e d2 4a f3 80 16 db 32 6a s1W.m%...J....2j 0450 50 5b b8 3c 92 cd 82 a1 68 95 45 3c 33 aa 06 af P[.<....h.E<3... 0460 9e 4a f6 6b 2e 13 f4 f3 bb d7 07 78 41 3b 45 8e .J.k.......xA;E. 0470 03 fc 09 6b ab e3 73 20 51 5e 03 ee 5a b5 62 20 ...k..s Q^..Z.b 0480 a6 2d 63 3f 0e 74 8b b0 4a 76 89 0b c0 3c 38 bd .-c?.t..Jv...<8. 0490 f8 b8 5b a5 b3 b4 7a 2b bc 80 96 20 09 4e 60 a0 ..[...z+... .N`. 04a0 fc 5e 6a e6 9f 2c 91 3e 70 58 4f 33 da 64 96 73 .^j..,.>pXO3.d.s 04b0 d4 69 17 44 aa 7d 6f f8 1e b0 24 32 9c a9 ed 3d .i.D.}o...$2...= 04c0 c5 e9 70 d0 93 1f 5b 20 0f 4a 2d 61 e5 36 40 65 ..p...[ .J-a.6@e 04d0 a0 83 36 1d 70 44 17 1a fb 54 8e 06 8d 34 03 10 ..6.pD...T...4.. 04e0 3e 4a 5e 94 96 ba 84 d9 f6 4f 73 1e d6 a2 0c 92 >J^......Os..... 04f0 06 54 be 50 76 1b 58 e5 db fc 10 52 42 04 77 aa .T.Pv.X....RB.w. 0500 55 71 71 77 89 21 35 fb af e5 9d ed d6 49 90 eb Uqqw.!5......I.. 0510 5a 84 54 ec 03 e7 8c af 98 90 7c 2f 00 12 42 cf Z.T.......|/..B. 0520 c6 60 56 1b 3c 01 f5 ed 82 88 0b d2 dc 88 0f 18 .`V.<........... 0530 b4 e2 86 ed a7 ae a2 42 70 3a 6d b6 f0 32 9d 2b .......Bp:m..2.+ 0540 30 af ae 15 cb 57 65 0c 08 f4 46 db ca 40 be cd 0....We...F..@.. 0550 98 41 6a 95 64 1d 45 19 0b ef 91 61 31 06 8d 2d .Aj.d.E....a1..- 0560 87 49 98 29 6b 42 90 a9 2a ab a1 57 79 ad c3 77 .I.)kB..*..Wy..w 0570 15 4a ef 6e 6b 63 71 8c d4 46 df a6 1e f6 cc c6 .J.nkcq..F...... 0580 2a 2a 7a c6 25 da 0d e1 d0 61 88 cb 96 e2 41 42 **z.%....a....AB 0590 aa d9 95 2b f2 84 f8 de f1 0c 19 f2 38 d3 74 15 ...+........8.t. 05a0 32 8e ba 6f fe 6c 00 2b 99 17 56 24 0b 72 13 56 2..o.l.+..V$.r.V 05b0 76 9b 94 be 45 82 d7 5d f6 4f 91 54 77 7c ff c5 v...E..].O.Tw|.. 05c0 f6 9b 41 79 e4 e6 6c 5f 22 85 0f e8 70 63 a3 bb ..Ay..l_"...pc.. 05d0 9d db 75 f6 c9 99 9c 79 d0 38 e5 f2 06 4d b0 85 ..u....y.8...M.. 05e0 5a 05 2e 65 1d 26 f8 4c 56 e0 Z..e.&.LV. No. Time Source Destination Protocol Info 179 67.632263 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2290 bytes) Frame 179 (935 bytes on wire, 935 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 22284, Ack: 6107, Len: 881 Lightweight Directory Access Protocol SASL Buffer Length: 2337 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCCAD745A61BB76F588C38A310D473623... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CCAD745A61BB76F5 krb5_sgn_cksum: 88C38A310D473623 krb5_confounder: E079CDD0CD2E258B GSS-API Encrypted payload (2290 bytes) Frame (935 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 99 2e 0c 40 00 80 06 6e 47 ac 1f 01 65 ac 1f ....@...nG...e.. 0020 01 68 01 85 07 f0 0b 68 aa 89 d3 1c 1e ab 50 18 .h.....h......P. 0030 f6 04 c7 3b 00 00 bb 4d 60 83 3e 39 c6 76 85 e3 ...;...M`.>9.v.. 0040 29 de 52 d6 9e c4 2e a4 2c 0e 57 c1 14 42 b8 cf ).R.....,.W..B.. 0050 f2 46 98 e4 30 27 69 7b 25 d7 bc d4 4a 56 e7 ff .F..0'i{%...JV.. 0060 75 c8 da 4e b4 ca b8 9e b7 f5 3b 94 5d a6 60 c2 u..N......;.].`. 0070 30 ba d5 e7 ae b5 5f 6b da 03 d1 92 6d 69 cb 1c 0....._k....mi.. 0080 8c ba 25 e7 6e 34 f1 aa 64 60 6a b1 74 40 6f 31 ..%.n4..d`j.t@o1 0090 8d b9 c6 22 28 53 67 86 7b a0 e4 c3 ca f8 d3 fc ..."(Sg.{....... 00a0 1a 46 09 a3 45 f8 6e 43 c3 bb 9b 18 ee f7 9f 04 .F..E.nC........ 00b0 b4 b8 06 ca 5a 32 41 09 35 f4 13 5c 7e 17 a4 73 ....Z2A.5..\~..s 00c0 d3 d3 94 ce cb f9 fb 5a 55 54 65 79 fd e6 38 47 .......ZUTey..8G 00d0 1f 65 12 df 81 30 9c 35 0d e2 ff 97 ce f7 d9 69 .e...0.5.......i 00e0 47 43 22 18 0a eb 94 3a 7d 54 a2 1c 38 e1 a7 f5 GC"....:}T..8... 00f0 0d 68 d7 72 48 a0 8f 8e c9 6a ab e2 08 4e d6 59 .h.rH....j...N.Y 0100 5b 63 c1 95 43 6d 99 de e2 ad ad 79 58 5c 6a 64 [c..Cm.....yX\jd 0110 85 37 03 85 40 5b e8 f5 70 d0 74 b9 37 1b a0 25 .7..@[..p.t.7..% 0120 7a d4 a9 7c 75 e1 18 1a d5 f2 dc c4 92 6f 0b f0 z..|u........o.. 0130 f9 c6 37 b3 89 c0 fa fc 92 b9 d2 12 e7 28 fe 63 ..7..........(.c 0140 13 4a 65 3c 86 f0 9e 79 16 8e 97 84 13 4b 7a 88 .Je<...y.....Kz. 0150 9a a4 4d 7b f0 08 c8 73 34 0c 4a f4 3b 89 d5 82 ..M{...s4.J.;... 0160 2e 39 b7 5a ff 48 35 7a ab 2a 72 14 ef a5 e8 bb .9.Z.H5z.*r..... 0170 3f 9f 74 0c cc da ba e8 b8 20 6c 5e dd 16 e8 ab ?.t...... l^.... 0180 dc 69 43 86 2d 4d 72 61 23 fa f8 3c 1b ef 9f 3f .iC.-Mra#..<...? 0190 03 99 bf 47 28 10 74 c5 3b f9 68 76 8f a2 92 a9 ...G(.t.;.hv.... 01a0 f2 ec f7 ff d0 3d 82 0d 73 1e 58 82 98 c3 3b ed .....=..s.X...;. 01b0 37 32 8e b1 87 de da 8a 7c 15 a0 52 c2 61 67 08 72......|..R.ag. 01c0 c6 bc 0f 42 c3 f8 35 2c cc 32 1b da 8d ea c9 de ...B..5,.2...... 01d0 c9 4a 70 3f 47 a2 8b 1c ce 89 f2 ff d3 c2 dc f5 .Jp?G........... 01e0 a8 d8 92 3c ee 6e 30 56 1b ab 6b 74 d7 c7 9a d7 ...<.n0V..kt.... 01f0 2f 76 bd 04 fc 75 e8 3f 8b 27 d2 39 fa aa 8b 5f /v...u.?.'.9..._ 0200 89 ee b0 6e c9 55 b7 2e 95 c7 7d 81 58 84 16 64 ...n.U....}.X..d 0210 72 ed c9 85 99 e3 02 d0 53 17 cc 19 46 71 10 4e r.......S...Fq.N 0220 6b aa 19 66 9d 95 16 4a b2 d5 e1 82 4b 09 89 f1 k..f...J....K... 0230 58 ae f0 76 d2 20 52 2b 33 12 25 b8 5c 44 cc 8f X..v. R+3.%.\D.. 0240 8a 98 3a d9 61 6d db 99 1f 21 f8 bd be d1 a8 cf ..:.am...!...... 0250 83 55 80 37 28 76 ca 4e 0d a9 d7 10 2e a6 1b 65 .U.7(v.N.......e 0260 05 a2 89 ad df d1 10 fa db ed 50 a1 2d 89 0c 3f ..........P.-..? 0270 a1 89 5b 25 dc 34 71 88 0e 7d 4e 09 99 94 c2 f5 ..[%.4q..}N..... 0280 a5 42 76 0f 61 15 4c 21 83 2e 0e 27 29 19 3a 7e .Bv.a.L!...').:~ 0290 bb 9c d9 a4 00 c8 53 d6 e8 ae b8 c7 35 59 a4 da ......S.....5Y.. 02a0 ce 6d 34 05 a8 68 22 0c 00 ad e1 75 55 64 3a 31 .m4..h"....uUd:1 02b0 bd 00 50 0e a2 4a 42 0b 5a 64 56 6f be 11 83 e2 ..P..JB.ZdVo.... 02c0 1f 89 b8 90 e3 b5 90 63 10 16 01 33 ff f3 6e f0 .......c...3..n. 02d0 39 96 2f c8 e4 83 5b 93 a4 10 70 fc ef 0c f7 d4 9./...[...p..... 02e0 12 9e c8 2e 9b 08 f9 bb d1 af 17 0c 80 c6 fe 6f ...............o 02f0 01 ba e4 17 24 36 8a 8d 6f 0d ba 09 b5 be f1 c1 ....$6..o....... 0300 ae 08 16 3f cd 21 f7 8c 3a 5c 0f 85 b6 1c bc b8 ...?.!..:\...... 0310 5f 58 c5 09 ea 9e 12 48 5f 00 3b 71 00 f4 59 51 _X.....H_.;q..YQ 0320 45 d5 3f 2e 8f 29 1d 1a a0 8d b5 d3 d0 c9 5b 67 E.?..)........[g 0330 c5 0f 9f 37 e6 ac d2 a7 de b0 56 84 14 5f a1 d1 ...7......V.._.. 0340 3f 1c 4a 21 0d f5 2c af db eb 93 6b 2c b3 c6 a0 ?.J!..,....k,... 0350 e0 c2 c7 4b 0e e2 39 f3 57 39 bd 45 ba 20 9e fb ...K..9.W9.E. .. 0360 04 10 f9 af 58 e5 c7 b6 16 fc a3 f0 26 d0 23 4e ....X.......&.#N 0370 df d6 11 8b 8c 57 04 73 25 42 d4 f1 30 64 7a 26 .....W.s%B..0dz& 0380 69 46 a2 07 8d dd e8 01 db 94 77 1c 34 fb d6 36 iF........w.4..6 0390 fa 60 23 1f c5 2a ed 84 83 6a 04 d2 f7 5c 9e 82 .`#..*...j...\.. 03a0 46 bc bd e4 05 cc 8e F...... Reassembled TCP (2341 bytes): 0000 00 00 09 21 60 82 09 1d 06 09 2a 86 48 86 f7 12 ...!`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff cc ad 74 5a 61 .............tZa 0020 bb 76 f5 88 c3 8a 31 0d 47 36 23 e0 79 cd d0 cd .v....1.G6#.y... 0030 2e 25 8b c6 6f 0a 68 2f f8 37 e7 84 45 01 3c 85 .%..o.h/.7..E.<. 0040 9d d1 2a da 37 9d 90 1a 67 0c fe 78 29 7d e9 a6 ..*.7...g..x)}.. 0050 ee ed a2 7f 48 e4 c1 ec ea ad 1d db c1 3b a2 fe ....H........;.. 0060 b8 3b 1c 60 cd 84 47 4a 35 ec 1c 66 d3 30 3b 6b .;.`..GJ5..f.0;k 0070 c3 d8 b1 97 80 a0 a6 dd 6a ed 91 7f 5d ea 2c fa ........j...].,. 0080 dd 0b 02 03 de 22 08 19 32 82 5c ae 49 c3 f6 22 ....."..2.\.I.." 0090 f6 0a 02 b8 6b d6 df f9 9a 1d 47 a1 7f 98 2d 46 ....k.....G...-F 00a0 e6 12 f9 aa 00 0b af c6 a8 ff 65 ee 8c 5c c0 ad ..........e..\.. 00b0 66 7a 72 47 5a d6 3e c7 e9 ad b0 40 be bd 71 c5 fzrGZ.>....@..q. 00c0 24 c1 33 5b 11 8c 8a 0b 76 6d 38 ae 26 16 b1 82 $.3[....vm8.&... 00d0 ad fd f8 8e 19 6d 2d 20 32 72 93 00 3f ae 73 ae .....m- 2r..?.s. 00e0 b0 d1 27 f0 1a 40 f0 71 64 b9 a8 27 cb 2c a5 a8 ..'..@.qd..'.,.. 00f0 d4 69 ed 94 7c 19 eb 60 cf 8b e2 d5 90 5d 29 68 .i..|..`.....])h 0100 91 51 c7 19 88 cf d9 92 b7 4d ce f6 19 18 14 1a .Q.......M...... 0110 43 d5 41 fa 0a a6 90 0d 2d 47 dc 92 a5 2f 35 9a C.A.....-G.../5. 0120 1d 35 19 1a 21 6f de 7b ba fb 75 83 2b 81 b2 87 .5..!o.{..u.+... 0130 21 c4 72 a5 7b 0a 51 c1 be 76 98 3b 0a bb 57 7c !.r.{.Q..v.;..W| 0140 20 4b cb e3 cf 1c 9d 39 58 36 2f 14 94 c1 cd 6f K.....9X6/....o 0150 7a 9f 41 1a 40 88 59 b6 f5 45 47 57 80 98 7e 41 z.A.@.Y..EGW..~A 0160 ce 8c 00 50 5c 2e df ae 27 2c d8 64 a2 44 09 f7 ...P\...',.d.D.. 0170 4a 97 f6 d3 e3 e9 33 22 9a ec 82 f8 5c de c2 7d J.....3"....\..} 0180 02 cd 00 d1 13 61 ca ee a9 2b 32 c0 2f 58 9d 7e .....a...+2./X.~ 0190 a1 8d 24 fd 1c fc 42 b0 94 02 5c 9c 11 a2 0b bc ..$...B...\..... 01a0 a4 c7 da c0 a5 4d 19 72 b2 d3 86 51 39 9a 3d cf .....M.r...Q9.=. 01b0 77 cf 6f d8 89 da 32 93 48 6d 15 99 28 04 74 37 w.o...2.Hm..(.t7 01c0 5e 95 71 a4 93 b2 f5 5b ec 6a f1 23 6c ff b9 24 ^.q....[.j.#l..$ 01d0 58 bb bc 2f e8 6c f5 e3 d3 58 39 0a 18 0a 23 2c X../.l...X9...#, 01e0 61 43 a3 b7 24 c7 1e d2 54 be 7b a1 e5 14 27 cc aC..$...T.{...'. 01f0 f9 d5 8c 0e be 1b d7 33 09 9a 2d dc e6 80 62 90 .......3..-...b. 0200 dc 8c fe 34 e4 96 9a 24 6a 6c a3 86 e6 90 bd 16 ...4...$jl...... 0210 42 a7 1f 40 b5 b6 32 b9 e9 2c 69 e1 ea 61 aa 81 B..@..2..,i..a.. 0220 67 3d ae 41 17 61 f0 87 3b 09 9b 8f 9a 75 72 62 g=.A.a..;....urb 0230 cd 3c bc bb e6 aa c9 c1 7a 8b fa 10 73 7f 6d dd .<......z...s.m. 0240 1b 19 7e 7d 25 e1 47 e9 46 61 ef 99 15 1e 05 c7 ..~}%.G.Fa...... 0250 1c 7c 91 d1 3a ca 9f 88 1d 14 96 7b cb d7 20 6c .|..:......{.. l 0260 47 23 fd 2e 31 b6 af 11 70 8f 8c f9 fb 74 76 d7 G#..1...p....tv. 0270 01 ef d9 ca 5b 9f c6 b5 74 2c 72 e9 8f 42 4e 51 ....[...t,r..BNQ 0280 8f 4c 1b 81 38 2b fa 3f f5 0c 3d fc d6 fc 03 d4 .L..8+.?..=..... 0290 c6 10 47 cc dc a8 7e 8b e7 d7 e7 e6 b0 d3 dc 4d ..G...~........M 02a0 e6 00 1a 54 bf c1 45 aa 87 ad c7 c2 db 26 74 e6 ...T..E......&t. 02b0 04 b2 3b a4 5a 76 09 05 7c d5 d4 38 55 6a 51 b8 ..;.Zv..|..8UjQ. 02c0 b9 9f 30 34 b5 49 f9 5a 4e 8b 90 c8 20 7a 75 60 ..04.I.ZN... zu` 02d0 5b eb c2 f9 31 ca 56 5e b3 a6 d2 94 f6 d5 c5 9b [...1.V^........ 02e0 90 e5 f3 69 17 29 04 13 04 8d c5 b3 d7 b3 d2 7a ...i.).........z 02f0 b9 20 04 ff 15 90 7a 05 11 62 ed 70 6a 6f 8c 74 . ....z..b.pjo.t 0300 06 14 70 ba 8b c4 75 5f 8b 2e 21 97 96 e9 4e bd ..p...u_..!...N. 0310 d5 19 2d 1b 40 11 3a fd 93 b7 5f af 4e d8 6a d3 ..-.@.:..._.N.j. 0320 de c2 c1 ff eb 1f d1 08 bd 94 06 b7 00 0d d2 8d ................ 0330 b1 67 67 f7 09 cd 3b 04 04 db b0 b1 0f bb a8 3a .gg...;........: 0340 9b c7 72 7f a2 13 72 d0 b2 fc 04 c2 84 ce f7 ed ..r...r......... 0350 75 e3 f5 5e ff dc a9 b2 5d 75 7c 51 66 c2 61 34 u..^....]u|Qf.a4 0360 08 5b da b9 9f fc c3 bf 0a 12 aa 0b d9 41 8d 12 .[...........A.. 0370 89 ab 1c d9 f9 c9 b4 5a d0 3e 22 15 3b 61 31 83 .......Z.>".;a1. 0380 4c c0 98 af 4b 73 5d da c6 99 e2 f9 3b e1 80 32 L...Ks].....;..2 0390 fb 59 12 b1 50 c3 97 cb b7 f1 86 3e e8 a5 3b 5d .Y..P......>..;] 03a0 2a 11 e2 6d 81 26 0d 3c e2 98 30 41 54 7b 99 41 *..m.&.<..0AT{.A 03b0 b8 b6 4b 68 52 4f c7 c6 b6 e4 56 05 49 4d 61 26 ..KhRO....V.IMa& 03c0 7a c1 28 d4 66 9b 78 00 a3 2b 59 8b 2f b6 39 d9 z.(.f.x..+Y./.9. 03d0 73 52 f4 14 40 91 c4 96 2b 18 82 a1 4e 0f f4 f5 sR..@...+...N... 03e0 1b 62 4b 8f aa 24 c9 de 81 cb 4a 7c 42 3f 7c 7a .bK..$....J|B?|z 03f0 37 35 c0 87 71 21 4b 54 89 3d e9 5f e2 21 a6 c6 75..q!KT.=._.!.. 0400 12 35 81 c0 84 42 65 6b 8d ba 73 31 57 b5 6d 25 .5...Bek..s1W.m% 0410 06 9e d2 4a f3 80 16 db 32 6a 50 5b b8 3c 92 cd ...J....2jP[.<.. 0420 82 a1 68 95 45 3c 33 aa 06 af 9e 4a f6 6b 2e 13 ..h.E<3....J.k.. 0430 f4 f3 bb d7 07 78 41 3b 45 8e 03 fc 09 6b ab e3 .....xA;E....k.. 0440 73 20 51 5e 03 ee 5a b5 62 20 a6 2d 63 3f 0e 74 s Q^..Z.b .-c?.t 0450 8b b0 4a 76 89 0b c0 3c 38 bd f8 b8 5b a5 b3 b4 ..Jv...<8...[... 0460 7a 2b bc 80 96 20 09 4e 60 a0 fc 5e 6a e6 9f 2c z+... .N`..^j.., 0470 91 3e 70 58 4f 33 da 64 96 73 d4 69 17 44 aa 7d .>pXO3.d.s.i.D.} 0480 6f f8 1e b0 24 32 9c a9 ed 3d c5 e9 70 d0 93 1f o...$2...=..p... 0490 5b 20 0f 4a 2d 61 e5 36 40 65 a0 83 36 1d 70 44 [ .J-a.6@e..6.pD 04a0 17 1a fb 54 8e 06 8d 34 03 10 3e 4a 5e 94 96 ba ...T...4..>J^... 04b0 84 d9 f6 4f 73 1e d6 a2 0c 92 06 54 be 50 76 1b ...Os......T.Pv. 04c0 58 e5 db fc 10 52 42 04 77 aa 55 71 71 77 89 21 X....RB.w.Uqqw.! 04d0 35 fb af e5 9d ed d6 49 90 eb 5a 84 54 ec 03 e7 5......I..Z.T... 04e0 8c af 98 90 7c 2f 00 12 42 cf c6 60 56 1b 3c 01 ....|/..B..`V.<. 04f0 f5 ed 82 88 0b d2 dc 88 0f 18 b4 e2 86 ed a7 ae ................ 0500 a2 42 70 3a 6d b6 f0 32 9d 2b 30 af ae 15 cb 57 .Bp:m..2.+0....W 0510 65 0c 08 f4 46 db ca 40 be cd 98 41 6a 95 64 1d e...F..@...Aj.d. 0520 45 19 0b ef 91 61 31 06 8d 2d 87 49 98 29 6b 42 E....a1..-.I.)kB 0530 90 a9 2a ab a1 57 79 ad c3 77 15 4a ef 6e 6b 63 ..*..Wy..w.J.nkc 0540 71 8c d4 46 df a6 1e f6 cc c6 2a 2a 7a c6 25 da q..F......**z.%. 0550 0d e1 d0 61 88 cb 96 e2 41 42 aa d9 95 2b f2 84 ...a....AB...+.. 0560 f8 de f1 0c 19 f2 38 d3 74 15 32 8e ba 6f fe 6c ......8.t.2..o.l 0570 00 2b 99 17 56 24 0b 72 13 56 76 9b 94 be 45 82 .+..V$.r.Vv...E. 0580 d7 5d f6 4f 91 54 77 7c ff c5 f6 9b 41 79 e4 e6 .].O.Tw|....Ay.. 0590 6c 5f 22 85 0f e8 70 63 a3 bb 9d db 75 f6 c9 99 l_"...pc....u... 05a0 9c 79 d0 38 e5 f2 06 4d b0 85 5a 05 2e 65 1d 26 .y.8...M..Z..e.& 05b0 f8 4c 56 e0 bb 4d 60 83 3e 39 c6 76 85 e3 29 de .LV..M`.>9.v..). 05c0 52 d6 9e c4 2e a4 2c 0e 57 c1 14 42 b8 cf f2 46 R.....,.W..B...F 05d0 98 e4 30 27 69 7b 25 d7 bc d4 4a 56 e7 ff 75 c8 ..0'i{%...JV..u. 05e0 da 4e b4 ca b8 9e b7 f5 3b 94 5d a6 60 c2 30 ba .N......;.].`.0. 05f0 d5 e7 ae b5 5f 6b da 03 d1 92 6d 69 cb 1c 8c ba ...._k....mi.... 0600 25 e7 6e 34 f1 aa 64 60 6a b1 74 40 6f 31 8d b9 %.n4..d`j.t@o1.. 0610 c6 22 28 53 67 86 7b a0 e4 c3 ca f8 d3 fc 1a 46 ."(Sg.{........F 0620 09 a3 45 f8 6e 43 c3 bb 9b 18 ee f7 9f 04 b4 b8 ..E.nC.......... 0630 06 ca 5a 32 41 09 35 f4 13 5c 7e 17 a4 73 d3 d3 ..Z2A.5..\~..s.. 0640 94 ce cb f9 fb 5a 55 54 65 79 fd e6 38 47 1f 65 .....ZUTey..8G.e 0650 12 df 81 30 9c 35 0d e2 ff 97 ce f7 d9 69 47 43 ...0.5.......iGC 0660 22 18 0a eb 94 3a 7d 54 a2 1c 38 e1 a7 f5 0d 68 "....:}T..8....h 0670 d7 72 48 a0 8f 8e c9 6a ab e2 08 4e d6 59 5b 63 .rH....j...N.Y[c 0680 c1 95 43 6d 99 de e2 ad ad 79 58 5c 6a 64 85 37 ..Cm.....yX\jd.7 0690 03 85 40 5b e8 f5 70 d0 74 b9 37 1b a0 25 7a d4 ..@[..p.t.7..%z. 06a0 a9 7c 75 e1 18 1a d5 f2 dc c4 92 6f 0b f0 f9 c6 .|u........o.... 06b0 37 b3 89 c0 fa fc 92 b9 d2 12 e7 28 fe 63 13 4a 7..........(.c.J 06c0 65 3c 86 f0 9e 79 16 8e 97 84 13 4b 7a 88 9a a4 e<...y.....Kz... 06d0 4d 7b f0 08 c8 73 34 0c 4a f4 3b 89 d5 82 2e 39 M{...s4.J.;....9 06e0 b7 5a ff 48 35 7a ab 2a 72 14 ef a5 e8 bb 3f 9f .Z.H5z.*r.....?. 06f0 74 0c cc da ba e8 b8 20 6c 5e dd 16 e8 ab dc 69 t...... l^.....i 0700 43 86 2d 4d 72 61 23 fa f8 3c 1b ef 9f 3f 03 99 C.-Mra#..<...?.. 0710 bf 47 28 10 74 c5 3b f9 68 76 8f a2 92 a9 f2 ec .G(.t.;.hv...... 0720 f7 ff d0 3d 82 0d 73 1e 58 82 98 c3 3b ed 37 32 ...=..s.X...;.72 0730 8e b1 87 de da 8a 7c 15 a0 52 c2 61 67 08 c6 bc ......|..R.ag... 0740 0f 42 c3 f8 35 2c cc 32 1b da 8d ea c9 de c9 4a .B..5,.2.......J 0750 70 3f 47 a2 8b 1c ce 89 f2 ff d3 c2 dc f5 a8 d8 p?G............. 0760 92 3c ee 6e 30 56 1b ab 6b 74 d7 c7 9a d7 2f 76 .<.n0V..kt..../v 0770 bd 04 fc 75 e8 3f 8b 27 d2 39 fa aa 8b 5f 89 ee ...u.?.'.9..._.. 0780 b0 6e c9 55 b7 2e 95 c7 7d 81 58 84 16 64 72 ed .n.U....}.X..dr. 0790 c9 85 99 e3 02 d0 53 17 cc 19 46 71 10 4e 6b aa ......S...Fq.Nk. 07a0 19 66 9d 95 16 4a b2 d5 e1 82 4b 09 89 f1 58 ae .f...J....K...X. 07b0 f0 76 d2 20 52 2b 33 12 25 b8 5c 44 cc 8f 8a 98 .v. R+3.%.\D.... 07c0 3a d9 61 6d db 99 1f 21 f8 bd be d1 a8 cf 83 55 :.am...!.......U 07d0 80 37 28 76 ca 4e 0d a9 d7 10 2e a6 1b 65 05 a2 .7(v.N.......e.. 07e0 89 ad df d1 10 fa db ed 50 a1 2d 89 0c 3f a1 89 ........P.-..?.. 07f0 5b 25 dc 34 71 88 0e 7d 4e 09 99 94 c2 f5 a5 42 [%.4q..}N......B 0800 76 0f 61 15 4c 21 83 2e 0e 27 29 19 3a 7e bb 9c v.a.L!...').:~.. 0810 d9 a4 00 c8 53 d6 e8 ae b8 c7 35 59 a4 da ce 6d ....S.....5Y...m 0820 34 05 a8 68 22 0c 00 ad e1 75 55 64 3a 31 bd 00 4..h"....uUd:1.. 0830 50 0e a2 4a 42 0b 5a 64 56 6f be 11 83 e2 1f 89 P..JB.ZdVo...... 0840 b8 90 e3 b5 90 63 10 16 01 33 ff f3 6e f0 39 96 .....c...3..n.9. 0850 2f c8 e4 83 5b 93 a4 10 70 fc ef 0c f7 d4 12 9e /...[...p....... 0860 c8 2e 9b 08 f9 bb d1 af 17 0c 80 c6 fe 6f 01 ba .............o.. 0870 e4 17 24 36 8a 8d 6f 0d ba 09 b5 be f1 c1 ae 08 ..$6..o......... 0880 16 3f cd 21 f7 8c 3a 5c 0f 85 b6 1c bc b8 5f 58 .?.!..:\......_X 0890 c5 09 ea 9e 12 48 5f 00 3b 71 00 f4 59 51 45 d5 .....H_.;q..YQE. 08a0 3f 2e 8f 29 1d 1a a0 8d b5 d3 d0 c9 5b 67 c5 0f ?..)........[g.. 08b0 9f 37 e6 ac d2 a7 de b0 56 84 14 5f a1 d1 3f 1c .7......V.._..?. 08c0 4a 21 0d f5 2c af db eb 93 6b 2c b3 c6 a0 e0 c2 J!..,....k,..... 08d0 c7 4b 0e e2 39 f3 57 39 bd 45 ba 20 9e fb 04 10 .K..9.W9.E. .... 08e0 f9 af 58 e5 c7 b6 16 fc a3 f0 26 d0 23 4e df d6 ..X.......&.#N.. 08f0 11 8b 8c 57 04 73 25 42 d4 f1 30 64 7a 26 69 46 ...W.s%B..0dz&iF 0900 a2 07 8d dd e8 01 db 94 77 1c 34 fb d6 36 fa 60 ........w.4..6.` 0910 23 1f c5 2a ed 84 83 6a 04 d2 f7 5c 9e 82 46 bc #..*...j...\..F. 0920 bd e4 05 cc 8e ..... No. Time Source Destination Protocol Info 180 67.632645 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=6107 Ack=23165 Win=64240 Len=0 Frame 180 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6107, Ack: 23165, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 22 40 00 80 06 bf a1 ac 1f 01 68 ac 1f .(."@........h.. 0020 01 65 07 f0 01 85 d3 1c 1e ab 0b 68 ad fa 50 10 .e.........h..P. 0030 fa f0 a5 38 00 00 ac 1f 01 65 c5 d5 ...8.....e.. No. Time Source Destination Protocol Info 181 67.634211 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 181 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6107, Ack: 23165, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9590210C05F190463982471C35B9177C... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9590210C05F19046 krb5_sgn_cksum: 3982471C35B9177C krb5_confounder: 63865EAE1E168FFC GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 23 40 00 80 06 bf 3a ac 1f 01 68 ac 1f ...#@....:...h.. 0020 01 65 07 f0 01 85 d3 1c 1e ab 0b 68 ad fa 50 18 .e.........h..P. 0030 fa f0 f2 f2 00 00 00 00 00 62 60 60 06 09 2a 86 .........b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 95 H............... 0050 90 21 0c 05 f1 90 46 39 82 47 1c 35 b9 17 7c 63 .!....F9.G.5..|c 0060 86 5e ae 1e 16 8f fc 31 62 0f 81 30 d8 cd f6 1f .^.....1b..0.... 0070 71 c2 3b 71 de 11 35 ea cb f3 c0 dc fe e3 e9 c3 q.;q..5......... 0080 74 4f 97 72 28 9c f2 63 54 c2 c6 77 8d f6 85 46 tO.r(..cT..w...F 0090 4a 7e 20 d4 8d 4c a6 fc 49 69 c5 f7 J~ ..L..Ii.. No. Time Source Destination Protocol Info 182 67.634967 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 182 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 23165, Ack: 6209, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 0d 40 00 80 06 6c 03 ac 1f 01 65 ac 1f ....@...l....e.. 0020 01 68 01 85 07 f0 0b 68 ad fa d3 1c 1f 11 50 10 .h.....h......P. 0030 f5 9e 7f f9 00 00 00 00 09 dd 60 82 09 d9 06 09 ..........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 68 03 37 2c ee f4 8a 0a 3c e8 74 22 e0 a9 0a .h.7,....<.t"... 0060 7b 24 4a 56 cd 39 07 c8 ad b9 7f e3 ee a0 07 cd {$JV.9.......... 0070 4f 8e f3 70 42 23 d4 56 ca 62 7b 47 19 05 e4 1b O..pB#.V.b{G.... 0080 02 59 19 0c 51 65 aa 78 80 e3 9c b7 6e 26 47 2e .Y..Qe.x....n&G. 0090 45 8f 43 f1 a4 43 da f2 28 6c 11 ab f8 34 58 e6 E.C..C..(l...4X. 00a0 1b 03 6d b6 90 fc dc 9f 9f ee 1d 69 74 6b 02 b7 ..m........itk.. 00b0 03 ec 9b 62 bb 65 ef 08 68 40 08 e0 35 c8 e0 44 ...b.e..h@..5..D 00c0 c0 ab 4b d2 3a 12 fa 5c 48 0a 6a 03 e3 e2 5a 1a ..K.:..\H.j...Z. 00d0 a1 5c a7 e9 d4 32 b1 23 e3 f1 4e 0d b1 20 fa 6d .\...2.#..N.. .m 00e0 ef e0 b4 c8 ca 34 54 1c 1b e4 7c 65 82 dd 15 5f .....4T...|e..._ 00f0 5c bc bb 2d dd 95 90 d6 ac c3 0a e0 79 ad b8 08 \..-........y... 0100 6f 60 7f 8b 39 a4 77 a1 22 fc cd 5e a3 88 7a f5 o`..9.w."..^..z. 0110 35 31 af 39 a7 30 11 5c ac 31 67 d7 47 86 82 30 51.9.0.\.1g.G..0 0120 77 b7 58 ff f7 a0 ef ac fb 59 23 59 3a 68 01 b1 w.X......Y#Y:h.. 0130 54 18 1b d2 7b e9 fc fa c5 6e 12 10 dd 38 e7 15 T...{....n...8.. 0140 4b a6 4a d3 ec 88 76 f6 7e ac f7 30 11 32 9f 04 K.J...v.~..0.2.. 0150 a1 a9 52 be 84 d5 0c 68 6e b7 da 71 af 05 f7 ab ..R....hn..q.... 0160 44 37 e6 95 7d 42 55 f0 f0 94 cb 8b 4b d6 21 52 D7..}BU.....K.!R 0170 b3 24 d8 d0 9c dc 6b e2 3f 3c 57 76 99 c1 19 79 .$....k.?t.8J+...-..l. 0200 e0 a2 2f 27 f5 71 04 7c 5f 94 26 74 14 59 38 c6 ../'.q.|_.&t.Y8. 0210 d8 f5 2e 20 a2 d3 ef ac 15 37 53 9a bb f3 53 51 ... .....7S...SQ 0220 91 44 62 91 68 6d 3a 58 59 68 7b 51 e1 96 0f 57 .Db.hm:XYh{Q...W 0230 2c c0 2d 93 bd 80 75 c8 9a 17 1c ba cd 62 f9 0c ,.-...u......b.. 0240 38 5f 1c 3d b7 dd 6f 5b cf 1f 9a 02 83 a8 c4 78 8_.=..o[.......x 0250 0f 64 12 1d ee 26 d2 37 82 31 4d 52 0b 17 53 88 .d...&.7.1MR..S. 0260 61 6b 7a f5 77 c3 61 aa c8 98 f4 65 b7 f6 89 34 akz.w.a....e...4 0270 e0 ca 51 eb d8 eb b1 ae b0 68 a2 f9 4d 12 61 19 ..Q......h..M.a. 0280 de 16 a8 5e 8f 7a b5 3d d7 0a f9 56 57 fb a8 85 ...^.z.=...VW... 0290 6e 63 4f 7f 25 51 e1 e2 da 1a ab 15 a3 8a 0c b7 ncO.%Q.......... 02a0 f0 0b fb 2d 2d 28 b6 7e e0 1b 9a b3 25 fc 03 93 ...--(.~....%... 02b0 95 e2 ed e6 26 31 b4 52 70 df 10 e2 3b cb d7 d9 ....&1.Rp...;... 02c0 af eb 63 d6 0f 0f 82 1b be 7b 51 d0 57 27 78 5b ..c......{Q.W'x[ 02d0 7b 03 b9 30 b0 02 ae 55 f6 67 a9 07 c4 d5 34 08 {..0...U.g....4. 02e0 cf 9b 1d fd eb a7 d9 73 76 60 47 3e 78 1a 9e fc .......sv`G>x... 02f0 04 fc 2e 12 6a ed b6 e6 0e c8 35 8a 44 2f d8 b3 ....j.....5.D/.. 0300 37 32 d7 fb a8 9c 73 44 16 3a c7 63 a5 e8 73 11 72....sD.:.c..s. 0310 26 15 36 2d b9 b4 ff 5b ad 32 8f 90 92 d7 e3 46 &.6-...[.2.....F 0320 c8 da 6e a3 7f 1a a5 23 28 9a b4 e1 d8 16 b1 e1 ..n....#(....... 0330 26 7f c6 ab 06 8d 67 fe ac 27 93 36 45 a5 c4 a2 &.....g..'.6E... 0340 8f 26 7d 68 c4 92 58 51 23 ba 48 a6 83 23 0e 73 .&}h..XQ#.H..#.s 0350 4e 41 bf 5b e4 2e 9e 77 19 66 80 35 1a 2e 2f c2 NA.[...w.f.5../. 0360 0b 95 7a ae 79 d8 70 0d 71 e7 9d 7d 22 88 39 9e ..z.y.p.q..}".9. 0370 d0 39 ec 7d ec c4 49 92 88 6d 0e c2 b7 a4 af b9 .9.}..I..m...... 0380 11 a4 ae 8c 6a c2 4e a6 7f d6 a6 6b f4 cc 22 0c ....j.N....k..". 0390 54 42 a6 3d 2a f5 90 06 50 61 48 fd e8 22 9f 5b TB.=*...PaH..".[ 03a0 1e 99 7f 2a c1 4a d3 36 c2 25 ec 3b 98 81 6b 1f ...*.J.6.%.;..k. 03b0 c4 ef bb ca 0e a8 5e 85 c0 47 42 81 90 8f f1 f6 ......^..GB..... 03c0 9b f3 cf 1d 4d e3 e2 ce 49 71 84 36 a6 e3 b8 03 ....M...Iq.6.... 03d0 c9 5c d5 04 a0 39 9c 87 f5 89 38 90 e0 74 fa cc .\...9....8..t.. 03e0 e9 6a 02 31 f3 c9 a3 6a 2d 28 9a af f6 18 50 f2 .j.1...j-(....P. 03f0 2c 9b c8 89 41 cb 27 de e5 40 87 c5 cc 75 b1 16 ,...A.'..@...u.. 0400 8b d5 dc 86 33 86 cb 5a 11 64 aa bd 47 17 cf 9d ....3..Z.d..G... 0410 de 17 51 fb 07 a2 ca 0c b0 12 5d 08 77 cd 92 09 ..Q.......].w... 0420 8a bd 05 d2 41 22 07 34 1d 59 9a 1c cb d2 dd 76 ....A".4.Y.....v 0430 eb 87 b2 31 14 54 47 21 05 3e 7d 26 1f 8f 96 57 ...1.TG!.>}&...W 0440 88 f6 7b d4 26 91 bb 2b df 2b 8f 8f ee e7 dc 26 ..{.&..+.+.....& 0450 ac 23 8b 1d 8b b6 99 5e 91 a7 8e e1 ce 16 8b 35 .#.....^.......5 0460 2c d3 50 e4 12 06 0b 61 bc 00 b1 06 6c d0 c5 a2 ,.P....a....l... 0470 86 c7 59 a0 04 f6 9d fe 09 6f 83 dc f7 28 43 c0 ..Y......o...(C. 0480 c7 68 83 f6 87 bf e7 e3 dd 46 14 f1 eb fe b4 da .h.......F...... 0490 60 f2 c6 ec 29 c9 ee 9e 89 2d ce 9c 0d 5b 96 b7 `...)....-...[.. 04a0 c7 90 e4 80 05 04 3b 81 82 87 76 c7 b5 76 d2 51 ......;...v..v.Q 04b0 89 52 6e d5 9a 39 0e 67 71 a6 23 f4 c4 a3 c1 fd .Rn..9.gq.#..... 04c0 79 c2 91 91 83 b0 79 4c 5d 13 d2 ea 85 48 28 e0 y.....yL]....H(. 04d0 b5 97 46 84 78 97 47 1c 6d 82 89 0b 45 54 1e 62 ..F.x.G.m...ET.b 04e0 5e 62 ca d3 76 ed 9a 99 58 5e eb b8 9c e8 e1 7c ^b..v...X^.....| 04f0 13 03 ae 38 00 1f 8b f0 a8 24 26 84 0f 85 c0 f2 ...8.....$&..... 0500 e7 a5 8b 21 d7 e0 73 a1 01 9d 50 ee 6d 1c ab e6 ...!..s...P.m... 0510 2e 69 c1 08 a2 b9 ad 7f 89 13 fd 92 ea 34 1c 24 .i...........4.$ 0520 66 06 06 ee 38 a9 59 1f 59 10 76 98 4d 75 bd 8f f...8.Y.Y.v.Mu.. 0530 e7 e1 1a 02 6f 7f 21 3d a2 ec 3e 6e b2 fd f4 44 ....o.!=..>n...D 0540 b7 ee 4b 4a 48 d0 9d 09 05 42 69 af a2 dd df 10 ..KJH....Bi..... 0550 83 6d a7 db ed 0d d7 c4 13 02 7e e6 1e b6 bc 4a .m........~....J 0560 09 3a 03 d8 ae b9 25 4c 85 0b 44 17 d4 6e 3d b1 .:....%L..D..n=. 0570 d2 5e e7 c4 37 cf 71 40 61 25 c3 ae e2 0b 7d 21 .^..7.q@a%....}! 0580 8d 6d 6b 48 2f cb 5d 28 aa 3d 52 3f a4 19 24 f6 .mkH/.](.=R?..$. 0590 3f 38 f3 b0 0d bc 8e ef 64 87 bf ec f5 81 38 cd ?8......d.....8. 05a0 6d 01 ab e1 01 b8 01 03 0f 56 02 41 fe c2 01 0e m........V.A.... 05b0 e8 e2 25 78 a0 54 5e a1 75 e2 1e 77 91 c9 f0 5d ..%x.T^.u..w...] 05c0 8a 55 79 11 7e f2 2e 3e 0f aa ae 3d 18 56 62 02 .Uy.~..>...=.Vb. 05d0 91 a8 1b 51 43 db fc 06 ba 9e 30 c1 06 62 22 a9 ...QC.....0..b". 05e0 71 cc 59 dc 0e 8d 78 d5 e3 db q.Y...x... No. Time Source Destination Protocol Info 183 67.635067 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 183 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 24625, Ack: 6209, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6803372CEEF48A0A3CE87422E0A90A7B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6803372CEEF48A0A krb5_sgn_cksum: 3CE87422E0A90A7B krb5_confounder: 244A56CD3907C8AD GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2e 0e 40 00 80 06 6d 89 ac 1f 01 65 ac 1f .U..@...m....e.. 0020 01 68 01 85 07 f0 0b 68 b3 ae d3 1c 1f 11 50 18 .h.....h......P. 0030 f5 9e 88 af 00 00 f4 8c 7a fa 2e 38 97 a4 a2 b4 ........z..8.... 0040 11 9d d0 c3 6b 5c aa 76 d8 ab d3 41 99 89 ed 46 ....k\.v...A...F 0050 f7 17 88 0b 51 4c 8b 17 85 cc 6e 39 21 84 b6 f7 ....QL....n9!... 0060 9e 8e 45 d1 c7 20 42 18 fe 86 a0 e4 b8 de e0 f1 ..E.. B......... 0070 5d 58 8d 31 94 0a da 4c f4 2e 31 7a 98 ad 52 b0 ]X.1...L..1z..R. 0080 02 c9 53 2f 55 b1 2a 0a a7 f6 ae f1 bc fd c6 76 ..S/U.*........v 0090 c4 cc 24 8a a2 c0 c5 9f 4b 9e 77 e5 76 52 04 99 ..$.....K.w.vR.. 00a0 f5 84 c4 cc ed 76 3a cb 33 8f 56 31 b2 d7 44 b9 .....v:.3.V1..D. 00b0 ef dd ba c0 1b fa 5d 02 c5 ad 67 1c 8c 7f a1 40 ......]...g....@ 00c0 bf f7 9f 98 cc dc 46 fc a6 e2 5b f7 74 b2 b4 0f ......F...[.t... 00d0 75 33 4f 29 c3 56 16 73 88 05 a5 65 8a a7 7d 7a u3O).V.s...e..}z 00e0 18 dc 52 be 6c 16 d9 05 fe ca ec 12 b3 ba 31 19 ..R.l.........1. 00f0 af f9 63 06 92 47 d0 23 28 4b e4 2d 75 0c 95 ff ..c..G.#(K.-u... 0100 d6 c2 26 90 3b 61 06 32 1f 3e 52 6e c0 80 ee ae ..&.;a.2.>Rn.... 0110 26 06 54 96 84 4b 71 98 78 d9 4c 72 ce 3d 44 7f &.T..Kq.x.Lr.=D. 0120 73 43 2b 0f 78 3c 46 a6 67 71 e5 18 59 03 41 df sC+.xK.... 0250 e6 27 1c 3d f0 ef 1e d0 65 d4 8e 67 2b 1e c7 27 .'.=....e..g+..' 0260 0a 44 4f db 24 38 44 f9 75 13 1d d3 aa 2f e0 35 .DO.$8D.u..../.5 0270 8a 1f e9 61 8a 00 69 c3 c8 ce eb e1 89 c1 51 64 ...a..i.......Qd 0280 28 93 b2 0b 64 9b cf 0d 9a 09 16 5c 24 7b 6b 63 (...d......\${kc 0290 7c 27 c5 47 02 13 a7 22 25 5a 20 a3 8c 89 63 e6 |'.G..."%Z ...c. 02a0 f0 b6 33 36 f6 59 72 0d 8c 73 dc 6d 2a 25 1e f5 ..36.Yr..s.m*%.. 02b0 c7 6f 72 4a 21 5d cf 90 77 05 71 4e e5 bd 27 80 .orJ!]..w.qN..'. 02c0 c6 b4 e3 11 ab 8f 9f 1e 69 8a af 2a 41 7b b7 04 ........i..*A{.. 02d0 6e a4 62 63 7a a6 49 2a 47 ff be 0b b1 a9 c8 7f n.bcz.I*G....... 02e0 e5 cf 01 6b 99 38 8f 0f ae d7 b2 7f 9e c9 4b 77 ...k.8........Kw 02f0 3e 34 96 02 f5 30 55 5d be 05 4e 01 76 70 b5 5c >4...0U]..N.vp.\ 0300 60 14 28 bc 5c 72 be db 59 13 68 61 71 de 8c 83 `.(.\r..Y.haq... 0310 8f a9 ac 5d 4c 94 6a e9 6b 5a 97 26 67 fc 61 68 ...]L.j.kZ.&g.ah 0320 04 90 cc f2 02 68 e3 28 fc 3a 28 43 36 5d 2f 36 .....h.(.:(C6]/6 0330 89 3f cb ed 96 2e d9 ed a1 ec e4 88 2c 7d 60 c7 .?..........,}`. 0340 37 5e 7a 41 95 6e da f8 05 18 7e 33 34 2e cf 4b 7^zA.n....~34..K 0350 90 f6 10 a9 61 e4 07 2a aa 3b 75 0f ec cc 25 cd ....a..*.;u...%. 0360 5d 6a 15 1a 01 c4 00 5f 18 8f 73 12 95 dc 9d ef ]j....._..s..... 0370 87 15 48 b0 9f 8d 6a f6 fb 32 bd 17 74 e8 0d 97 ..H...j..2..t... 0380 00 16 9c 0c 2e 03 c4 10 35 70 0a 0c 03 c8 ec 09 ........5p...... 0390 02 c5 27 96 2c e1 aa 04 3c 6c a0 81 45 6a 38 88 ..'.,...t.8 01c0 4a 2b c6 e1 01 2d e4 1e 6c 2e e0 a2 2f 27 f5 71 J+...-..l.../'.q 01d0 04 7c 5f 94 26 74 14 59 38 c6 d8 f5 2e 20 a2 d3 .|_.&t.Y8.... .. 01e0 ef ac 15 37 53 9a bb f3 53 51 91 44 62 91 68 6d ...7S...SQ.Db.hm 01f0 3a 58 59 68 7b 51 e1 96 0f 57 2c c0 2d 93 bd 80 :XYh{Q...W,.-... 0200 75 c8 9a 17 1c ba cd 62 f9 0c 38 5f 1c 3d b7 dd u......b..8_.=.. 0210 6f 5b cf 1f 9a 02 83 a8 c4 78 0f 64 12 1d ee 26 o[.......x.d...& 0220 d2 37 82 31 4d 52 0b 17 53 88 61 6b 7a f5 77 c3 .7.1MR..S.akz.w. 0230 61 aa c8 98 f4 65 b7 f6 89 34 e0 ca 51 eb d8 eb a....e...4..Q... 0240 b1 ae b0 68 a2 f9 4d 12 61 19 de 16 a8 5e 8f 7a ...h..M.a....^.z 0250 b5 3d d7 0a f9 56 57 fb a8 85 6e 63 4f 7f 25 51 .=...VW...ncO.%Q 0260 e1 e2 da 1a ab 15 a3 8a 0c b7 f0 0b fb 2d 2d 28 .............--( 0270 b6 7e e0 1b 9a b3 25 fc 03 93 95 e2 ed e6 26 31 .~....%.......&1 0280 b4 52 70 df 10 e2 3b cb d7 d9 af eb 63 d6 0f 0f .Rp...;.....c... 0290 82 1b be 7b 51 d0 57 27 78 5b 7b 03 b9 30 b0 02 ...{Q.W'x[{..0.. 02a0 ae 55 f6 67 a9 07 c4 d5 34 08 cf 9b 1d fd eb a7 .U.g....4....... 02b0 d9 73 76 60 47 3e 78 1a 9e fc 04 fc 2e 12 6a ed .sv`G>x.......j. 02c0 b6 e6 0e c8 35 8a 44 2f d8 b3 37 32 d7 fb a8 9c ....5.D/..72.... 02d0 73 44 16 3a c7 63 a5 e8 73 11 26 15 36 2d b9 b4 sD.:.c..s.&.6-.. 02e0 ff 5b ad 32 8f 90 92 d7 e3 46 c8 da 6e a3 7f 1a .[.2.....F..n... 02f0 a5 23 28 9a b4 e1 d8 16 b1 e1 26 7f c6 ab 06 8d .#(.......&..... 0300 67 fe ac 27 93 36 45 a5 c4 a2 8f 26 7d 68 c4 92 g..'.6E....&}h.. 0310 58 51 23 ba 48 a6 83 23 0e 73 4e 41 bf 5b e4 2e XQ#.H..#.sNA.[.. 0320 9e 77 19 66 80 35 1a 2e 2f c2 0b 95 7a ae 79 d8 .w.f.5../...z.y. 0330 70 0d 71 e7 9d 7d 22 88 39 9e d0 39 ec 7d ec c4 p.q..}".9..9.}.. 0340 49 92 88 6d 0e c2 b7 a4 af b9 11 a4 ae 8c 6a c2 I..m..........j. 0350 4e a6 7f d6 a6 6b f4 cc 22 0c 54 42 a6 3d 2a f5 N....k..".TB.=*. 0360 90 06 50 61 48 fd e8 22 9f 5b 1e 99 7f 2a c1 4a ..PaH..".[...*.J 0370 d3 36 c2 25 ec 3b 98 81 6b 1f c4 ef bb ca 0e a8 .6.%.;..k....... 0380 5e 85 c0 47 42 81 90 8f f1 f6 9b f3 cf 1d 4d e3 ^..GB.........M. 0390 e2 ce 49 71 84 36 a6 e3 b8 03 c9 5c d5 04 a0 39 ..Iq.6.....\...9 03a0 9c 87 f5 89 38 90 e0 74 fa cc e9 6a 02 31 f3 c9 ....8..t...j.1.. 03b0 a3 6a 2d 28 9a af f6 18 50 f2 2c 9b c8 89 41 cb .j-(....P.,...A. 03c0 27 de e5 40 87 c5 cc 75 b1 16 8b d5 dc 86 33 86 '..@...u......3. 03d0 cb 5a 11 64 aa bd 47 17 cf 9d de 17 51 fb 07 a2 .Z.d..G.....Q... 03e0 ca 0c b0 12 5d 08 77 cd 92 09 8a bd 05 d2 41 22 ....].w.......A" 03f0 07 34 1d 59 9a 1c cb d2 dd 76 eb 87 b2 31 14 54 .4.Y.....v...1.T 0400 47 21 05 3e 7d 26 1f 8f 96 57 88 f6 7b d4 26 91 G!.>}&...W..{.&. 0410 bb 2b df 2b 8f 8f ee e7 dc 26 ac 23 8b 1d 8b b6 .+.+.....&.#.... 0420 99 5e 91 a7 8e e1 ce 16 8b 35 2c d3 50 e4 12 06 .^.......5,.P... 0430 0b 61 bc 00 b1 06 6c d0 c5 a2 86 c7 59 a0 04 f6 .a....l.....Y... 0440 9d fe 09 6f 83 dc f7 28 43 c0 c7 68 83 f6 87 bf ...o...(C..h.... 0450 e7 e3 dd 46 14 f1 eb fe b4 da 60 f2 c6 ec 29 c9 ...F......`...). 0460 ee 9e 89 2d ce 9c 0d 5b 96 b7 c7 90 e4 80 05 04 ...-...[........ 0470 3b 81 82 87 76 c7 b5 76 d2 51 89 52 6e d5 9a 39 ;...v..v.Q.Rn..9 0480 0e 67 71 a6 23 f4 c4 a3 c1 fd 79 c2 91 91 83 b0 .gq.#.....y..... 0490 79 4c 5d 13 d2 ea 85 48 28 e0 b5 97 46 84 78 97 yL]....H(...F.x. 04a0 47 1c 6d 82 89 0b 45 54 1e 62 5e 62 ca d3 76 ed G.m...ET.b^b..v. 04b0 9a 99 58 5e eb b8 9c e8 e1 7c 13 03 ae 38 00 1f ..X^.....|...8.. 04c0 8b f0 a8 24 26 84 0f 85 c0 f2 e7 a5 8b 21 d7 e0 ...$&........!.. 04d0 73 a1 01 9d 50 ee 6d 1c ab e6 2e 69 c1 08 a2 b9 s...P.m....i.... 04e0 ad 7f 89 13 fd 92 ea 34 1c 24 66 06 06 ee 38 a9 .......4.$f...8. 04f0 59 1f 59 10 76 98 4d 75 bd 8f e7 e1 1a 02 6f 7f Y.Y.v.Mu......o. 0500 21 3d a2 ec 3e 6e b2 fd f4 44 b7 ee 4b 4a 48 d0 !=..>n...D..KJH. 0510 9d 09 05 42 69 af a2 dd df 10 83 6d a7 db ed 0d ...Bi......m.... 0520 d7 c4 13 02 7e e6 1e b6 bc 4a 09 3a 03 d8 ae b9 ....~....J.:.... 0530 25 4c 85 0b 44 17 d4 6e 3d b1 d2 5e e7 c4 37 cf %L..D..n=..^..7. 0540 71 40 61 25 c3 ae e2 0b 7d 21 8d 6d 6b 48 2f cb q@a%....}!.mkH/. 0550 5d 28 aa 3d 52 3f a4 19 24 f6 3f 38 f3 b0 0d bc ](.=R?..$.?8.... 0560 8e ef 64 87 bf ec f5 81 38 cd 6d 01 ab e1 01 b8 ..d.....8.m..... 0570 01 03 0f 56 02 41 fe c2 01 0e e8 e2 25 78 a0 54 ...V.A......%x.T 0580 5e a1 75 e2 1e 77 91 c9 f0 5d 8a 55 79 11 7e f2 ^.u..w...].Uy.~. 0590 2e 3e 0f aa ae 3d 18 56 62 02 91 a8 1b 51 43 db .>...=.Vb....QC. 05a0 fc 06 ba 9e 30 c1 06 62 22 a9 71 cc 59 dc 0e 8d ....0..b".q.Y... 05b0 78 d5 e3 db f4 8c 7a fa 2e 38 97 a4 a2 b4 11 9d x.....z..8...... 05c0 d0 c3 6b 5c aa 76 d8 ab d3 41 99 89 ed 46 f7 17 ..k\.v...A...F.. 05d0 88 0b 51 4c 8b 17 85 cc 6e 39 21 84 b6 f7 9e 8e ..QL....n9!..... 05e0 45 d1 c7 20 42 18 fe 86 a0 e4 b8 de e0 f1 5d 58 E.. B.........]X 05f0 8d 31 94 0a da 4c f4 2e 31 7a 98 ad 52 b0 02 c9 .1...L..1z..R... 0600 53 2f 55 b1 2a 0a a7 f6 ae f1 bc fd c6 76 c4 cc S/U.*........v.. 0610 24 8a a2 c0 c5 9f 4b 9e 77 e5 76 52 04 99 f5 84 $.....K.w.vR.... 0620 c4 cc ed 76 3a cb 33 8f 56 31 b2 d7 44 b9 ef dd ...v:.3.V1..D... 0630 ba c0 1b fa 5d 02 c5 ad 67 1c 8c 7f a1 40 bf f7 ....]...g....@.. 0640 9f 98 cc dc 46 fc a6 e2 5b f7 74 b2 b4 0f 75 33 ....F...[.t...u3 0650 4f 29 c3 56 16 73 88 05 a5 65 8a a7 7d 7a 18 dc O).V.s...e..}z.. 0660 52 be 6c 16 d9 05 fe ca ec 12 b3 ba 31 19 af f9 R.l.........1... 0670 63 06 92 47 d0 23 28 4b e4 2d 75 0c 95 ff d6 c2 c..G.#(K.-u..... 0680 26 90 3b 61 06 32 1f 3e 52 6e c0 80 ee ae 26 06 &.;a.2.>Rn....&. 0690 54 96 84 4b 71 98 78 d9 4c 72 ce 3d 44 7f 73 43 T..Kq.x.Lr.=D.sC 06a0 2b 0f 78 3c 46 a6 67 71 e5 18 59 03 41 df de cb +.xK.....' 07d0 1c 3d f0 ef 1e d0 65 d4 8e 67 2b 1e c7 27 0a 44 .=....e..g+..'.D 07e0 4f db 24 38 44 f9 75 13 1d d3 aa 2f e0 35 8a 1f O.$8D.u..../.5.. 07f0 e9 61 8a 00 69 c3 c8 ce eb e1 89 c1 51 64 28 93 .a..i.......Qd(. 0800 b2 0b 64 9b cf 0d 9a 09 16 5c 24 7b 6b 63 7c 27 ..d......\${kc|' 0810 c5 47 02 13 a7 22 25 5a 20 a3 8c 89 63 e6 f0 b6 .G..."%Z ...c... 0820 33 36 f6 59 72 0d 8c 73 dc 6d 2a 25 1e f5 c7 6f 36.Yr..s.m*%...o 0830 72 4a 21 5d cf 90 77 05 71 4e e5 bd 27 80 c6 b4 rJ!]..w.qN..'... 0840 e3 11 ab 8f 9f 1e 69 8a af 2a 41 7b b7 04 6e a4 ......i..*A{..n. 0850 62 63 7a a6 49 2a 47 ff be 0b b1 a9 c8 7f e5 cf bcz.I*G......... 0860 01 6b 99 38 8f 0f ae d7 b2 7f 9e c9 4b 77 3e 34 .k.8........Kw>4 0870 96 02 f5 30 55 5d be 05 4e 01 76 70 b5 5c 60 14 ...0U]..N.vp.\`. 0880 28 bc 5c 72 be db 59 13 68 61 71 de 8c 83 8f a9 (.\r..Y.haq..... 0890 ac 5d 4c 94 6a e9 6b 5a 97 26 67 fc 61 68 04 90 .]L.j.kZ.&g.ah.. 08a0 cc f2 02 68 e3 28 fc 3a 28 43 36 5d 2f 36 89 3f ...h.(.:(C6]/6.? 08b0 cb ed 96 2e d9 ed a1 ec e4 88 2c 7d 60 c7 37 5e ..........,}`.7^ 08c0 7a 41 95 6e da f8 05 18 7e 33 34 2e cf 4b 90 f6 zA.n....~34..K.. 08d0 10 a9 61 e4 07 2a aa 3b 75 0f ec cc 25 cd 5d 6a ..a..*.;u...%.]j 08e0 15 1a 01 c4 00 5f 18 8f 73 12 95 dc 9d ef 87 15 ....._..s....... 08f0 48 b0 9f 8d 6a f6 fb 32 bd 17 74 e8 0d 97 00 16 H...j..2..t..... 0900 9c 0c 2e 03 c4 10 35 70 0a 0c 03 c8 ec 09 02 c5 ......5p........ 0910 27 96 2c e1 aa 04 3c 6c a0 81 45 6a 38 88 8a 4b '.,... ldap [ACK] Seq=6209 Ack=25694 Win=64240 Len=0 Frame 184 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6209, Ack: 25694, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 24 40 00 80 06 bf 9f ac 1f 01 68 ac 1f .(.$@........h.. 0020 01 65 07 f0 01 85 d3 1c 1f 11 0b 68 b7 db 50 10 .e.........h..P. 0030 fa f0 9a f1 00 00 00 00 00 9f 60 81 ..........`. No. Time Source Destination Protocol Info 185 67.636365 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 185 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6209, Ack: 25694, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF107329A72B29B310D244EA875970094D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 107329A72B29B310 krb5_sgn_cksum: D244EA875970094D krb5_confounder: D3585A7519ECBC27 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 25 40 00 80 06 bf 0b ac 1f 01 68 ac 1f ...%@........h.. 0020 01 65 07 f0 01 85 d3 1c 1f 11 0b 68 b7 db 50 18 .e.........h..P. 0030 fa f0 81 ea 00 00 00 00 00 8f 60 81 8c 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 10 73 29 a7 2b 29 b3 10 d2 44 ea 87 59 70 09 4d .s).+)...D..Yp.M 0060 d3 58 5a 75 19 ec bc 27 a5 fc b5 f7 d1 9a 50 5e .XZu...'......P^ 0070 da a4 26 a0 6e 19 a1 38 68 9f af 62 40 0a f9 1b ..&.n..8h..b@... 0080 9a b3 97 cf 7d 89 28 2e a5 ac 94 43 2f 3a 38 fa ....}.(....C/:8. 0090 23 84 dc 1e 3d 6f ef a2 14 a0 d5 29 6c 52 3d 9c #...=o.....)lR=. 00a0 c3 a0 08 94 91 20 4e cc b3 7e 07 53 ab 35 6b 18 ..... N..~.S.5k. 00b0 14 6b dd da e0 ca 57 03 4d c5 45 2c aa 5c b5 f2 .k....W.M.E,.\.. 00c0 da e7 e1 88 19 95 f6 0f 21 ........! No. Time Source Destination Protocol Info 186 67.637066 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 186 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 25694, Ack: 6356, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCEB7C425FA66801BEEC7CFFDA5CB7717... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CEB7C425FA66801B krb5_sgn_cksum: EEC7CFFDA5CB7717 krb5_confounder: 73ED038676D534CE GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 0f 40 00 80 06 71 03 ac 1f 01 65 ac 1f ....@...q....e.. 0020 01 68 01 85 07 f0 0b 68 b7 db d3 1c 1f a4 50 18 .h.....h......P. 0030 fa f0 b9 39 00 00 00 00 00 ae 60 81 ab 06 09 2a ...9......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 ce b7 c4 25 fa 66 80 1b ee c7 cf fd a5 cb 77 17 ...%.f........w. 0060 73 ed 03 86 76 d5 34 ce 7c 06 ae 3a cd 63 48 52 s...v.4.|..:.cHR 0070 7a 8f 4a 69 d4 3f 6a 95 9e 4a 20 1b b1 19 2a 73 z.Ji.?j..J ...*s 0080 47 3d c7 7e e4 8f 7c 50 89 e7 ea 43 30 d5 f5 97 G=.~..|P...C0... 0090 7c 42 5c 4c 2f 8c c2 77 09 61 ff a4 8c 09 a0 dd |B\L/..w.a...... 00a0 e7 40 7a b3 13 52 94 c9 d2 9f 47 73 33 f8 ad e9 .@z..R....Gs3... 00b0 e0 22 35 e9 d5 bd 41 da e8 cd f5 6b c0 22 6b a9 ."5...A....k."k. 00c0 65 22 35 c7 93 70 9e ad e5 18 d9 2f d8 fe 5d 47 e"5..p...../..]G 00d0 23 ad 23 2b a1 92 96 01 b0 53 99 25 5e b6 76 e6 #.#+.....S.%^.v. 00e0 89 39 4f 47 2b 8d f1 62 .9OG+..b No. Time Source Destination Protocol Info 187 67.651832 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (110 bytes) Frame 187 (214 bytes on wire, 214 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6356, Ack: 25872, Len: 160 Lightweight Directory Access Protocol SASL Buffer Length: 156 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF41FCE71C46A958209F127C4A5DCAC816... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 41FCE71C46A95820 krb5_sgn_cksum: 9F127C4A5DCAC816 krb5_confounder: 58647CD6D0E39310 GSS-API Encrypted payload (110 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 c8 e0 26 40 00 80 06 be fd ac 1f 01 68 ac 1f ...&@........h.. 0020 01 65 07 f0 01 85 d3 1c 1f a4 0b 68 b8 8d 50 18 .e.........h..P. 0030 fa 3e 64 f4 00 00 00 00 00 9c 60 81 99 06 09 2a .>d.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 41 fc e7 1c 46 a9 58 20 9f 12 7c 4a 5d ca c8 16 A...F.X ..|J]... 0060 58 64 7c d6 d0 e3 93 10 66 49 bf 87 2d 8f 6e 55 Xd|.....fI..-.nU 0070 3c eb 3c f0 d6 19 f4 f7 2d 12 f4 b2 12 0b 40 cd <.<.....-.....@. 0080 a8 e9 d3 6d 7c bb ff e1 34 9d 49 a5 68 bd 3f d9 ...m|...4.I.h.?. 0090 fd 09 56 2f c9 b5 93 6a 0e e7 47 61 f2 dd 06 3e ..V/...j..Ga...> 00a0 79 fd 7e ed 2e dd 41 dc 07 43 23 d4 b8 75 5f 59 y.~...A..C#..u_Y 00b0 b8 34 87 42 be 03 0c fb ba 9a 97 fe 8a f5 99 82 .4.B............ 00c0 79 d3 4c 8d 9d ba ce 00 b0 4f 41 4b 61 73 e6 a6 y.L......OAKas.. 00d0 c3 1f a8 a3 0a 6c .....l No. Time Source Destination Protocol Info 188 67.652515 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (133 bytes) Frame 188 (237 bytes on wire, 237 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 25872, Ack: 6516, Len: 183 Lightweight Directory Access Protocol SASL Buffer Length: 179 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFACF2EBE1050F22D899A97C452595C8A1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: ACF2EBE1050F22D8 krb5_sgn_cksum: 99A97C452595C8A1 krb5_confounder: C8BD78A04B6F63F6 GSS-API Encrypted payload (133 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 df 2e 10 40 00 80 06 70 fd ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 b8 8d d3 1c 20 44 50 18 .h.....h.... DP. 0030 fa 50 40 5d 00 00 00 00 00 b3 60 81 b0 06 09 2a .P@]......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 ac f2 eb e1 05 0f 22 d8 99 a9 7c 45 25 95 c8 a1 ......"...|E%... 0060 c8 bd 78 a0 4b 6f 63 f6 fa 1d d8 3b c1 8b 2f e0 ..x.Koc....;../. 0070 be 1c d0 a6 d6 0b 49 a5 64 21 e9 4a ed 21 c0 2e ......I.d!.J.!.. 0080 a7 53 de e9 74 94 88 b0 65 81 9e 89 97 51 f6 3b .S..t...e....Q.; 0090 77 95 0d e7 1a 7a 76 af e4 9e ff ce 67 a9 2c 55 w....zv.....g.,U 00a0 66 be 89 47 b2 61 62 58 38 29 32 98 16 4f 9a 60 f..G.abX8)2..O.` 00b0 46 69 92 aa 0d ae af 07 72 77 92 6e 5d 16 18 b4 Fi......rw.n]... 00c0 08 f8 93 f1 e6 33 38 a7 cb ed 68 ea 75 2d bd ae .....38...h.u-.. 00d0 1a 01 7f 4e 95 84 52 88 63 94 04 58 e9 d3 08 50 ...N..R.c..X...P 00e0 69 db 1b 31 7d 8e bb 87 c3 3c f4 2a 8e i..1}....<.*. No. Time Source Destination Protocol Info 189 67.654357 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (272 bytes) Frame 189 (377 bytes on wire, 377 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6516, Ack: 26055, Len: 323 Lightweight Directory Access Protocol SASL Buffer Length: 319 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE6C9766D0866CA37F178A02EBEE9746B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E6C9766D0866CA37 krb5_sgn_cksum: F178A02EBEE9746B krb5_confounder: EE90C664DC5C8505 GSS-API Encrypted payload (272 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 6b e0 27 40 00 80 06 be 59 ac 1f 01 68 ac 1f .k.'@....Y...h.. 0020 01 65 07 f0 01 85 d3 1c 20 44 0b 68 b9 44 50 18 .e...... D.h.DP. 0030 f9 87 80 d7 00 00 00 00 01 3f 60 82 01 3b 06 09 .........?`..;.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff e6 c9 76 6d 08 66 ca 37 f1 78 a0 2e be e9 74 ...vm.f.7.x....t 0060 6b ee 90 c6 64 dc 5c 85 05 c9 b6 92 11 d7 5e 92 k...d.\.......^. 0070 38 b8 79 0a 5a fb 7d 1f 0e c6 ac 78 dc 6d 3c b6 8.y.Z.}....x.m<. 0080 be d0 64 f5 56 9d 1d 45 15 40 64 6a 14 3d fa de ..d.V..E.@dj.=.. 0090 cc c3 8b 19 67 05 03 20 10 f3 fb 4b bb 31 cd 87 ....g.. ...K.1.. 00a0 54 f5 d5 cb d5 e3 d8 83 77 2c 1e 9a 40 ea 4b 7d T.......w,..@.K} 00b0 4f 25 78 e2 75 89 81 14 b1 76 c0 24 af 3e 7e 8d O%x.u....v.$.>~. 00c0 e5 8e 68 f5 21 b9 93 fb 0b d8 b2 e1 a9 9b a8 19 ..h.!........... 00d0 a4 97 fd 33 3b 6d 82 03 5b 46 2d bb 81 30 65 4e ...3;m..[F-..0eN 00e0 86 72 ef a8 bf 06 e0 42 d4 90 fb 2f da 85 e4 fe .r.....B.../.... 00f0 0b 78 9b 76 5c 04 fa 93 3f 61 80 40 31 b6 c4 48 .x.v\...?a.@1..H 0100 af 10 f2 84 60 cd e2 65 f6 3b 3b cd 37 02 16 62 ....`..e.;;.7..b 0110 71 95 ac 59 d3 be b7 8a 6e 40 94 e7 15 c1 a0 75 q..Y....n@.....u 0120 be c7 a8 96 24 74 63 20 4c b4 6f 67 62 84 b8 74 ....$tc L.ogb..t 0130 dd 8b 38 68 65 51 30 6e 7b cf 4a 17 6a 43 7a 2a ..8heQ0n{.J.jCz* 0140 14 19 f1 f9 91 e4 e0 6d be 80 ce 52 5f 62 cc 5c .......m...R_b.\ 0150 fd 9f 50 37 bc e0 30 26 16 a9 a6 1e 3c 6f e3 f0 ..P7..0&.....\.`6L 0110 5b f9 70 63 73 96 2b 9d 40 a5 df 9c f8 a1 b0 8f [.pcs.+.@....... 0120 17 86 d7 8b 24 d0 e7 5c 5b ef 53 c8 aa 01 92 4a ....$..\[.S....J 0130 c1 24 a4 5d 1f 16 0c ab 00 39 df e4 93 bb dd 63 .$.].....9.....c 0140 a1 30 04 36 6b d6 da cf a8 66 f4 c5 f6 6f a3 ff .0.6k....f...o.. 0150 39 e2 14 db 36 6f d5 96 3b 0a 08 0c 99 a2 25 f3 9...6o..;.....%. 0160 7c c1 e2 22 61 4e f9 67 7f 38 45 7b 70 a4 9c b1 |.."aN.g.8E{p... 0170 d3 4e 3e 74 3a 09 3e be d9 17 4a e7 53 7c c1 12 .N>t:.>...J.S|.. 0180 ac cb 8e 95 b2 c2 8e 1a 02 a3 cc 4a 08 0f 3a 2b ...........J..:+ 0190 1a ed 80 18 50 0a 96 7e cd 84 37 53 0e 17 9e 8e ....P..~..7S.... 01a0 f4 a3 7f ea 8f f8 22 45 cb 36 ba 4e fb 64 62 bd ......"E.6.N.db. 01b0 85 16 56 3d 76 8b 7a 0b cb a3 df e0 07 25 e2 3f ..V=v.z......%.? 01c0 e8 2a 81 f3 a5 b9 54 04 76 eb 9b 24 4d a1 f8 d2 .*....T.v..$M... 01d0 bc 46 58 8d bc 87 ec 48 8f c7 ba c8 c7 52 2b f0 .FX....H.....R+. 01e0 96 b1 5e 08 a5 62 a9 c2 d5 a5 f6 a6 7c a4 e9 79 ..^..b......|..y 01f0 04 b5 4b f3 cd cc cf 73 ff cc 05 15 0a f6 34 52 ..K....s......4R 0200 de 68 e0 a3 35 6d 6b af 4d 2b a6 dc db ed 01 14 .h..5mk.M+...... 0210 ec 64 dd e7 92 db 95 de b0 6f 81 a3 90 2e 6e 3d .d.......o....n= 0220 67 97 0d b2 c6 0f 44 cd a0 8d b7 6f fb f1 99 72 g.....D....o...r 0230 d1 c6 3a a8 f9 ac c8 f1 b3 32 25 39 a5 2f e3 1f ..:......2%9./.. 0240 15 5e da 73 0a 29 c5 0c 12 16 fc 6c 25 7e 11 4e .^.s.).....l%~.N 0250 62 29 8b ff 84 21 5c a9 01 ba 13 fe ad 4e 7e e9 b)...!\......N~. 0260 3c f1 bd 71 78 8e f2 5b e6 e9 09 0e 9e 7c 30 0c <..qx..[.....|0. 0270 8a 7a bc a4 e5 a4 e9 97 fa 81 2d 4c eb c8 3a 6e .z........-L..:n 0280 d1 ec ef 4d 9e 4b fd 01 c2 af 25 ce 0e b2 16 fb ...M.K....%..... 0290 d1 78 52 61 ed 38 45 b6 59 06 b7 e4 87 b8 46 39 .xRa.8E.Y.....F9 02a0 56 36 4d ec 27 6b 34 db d8 2a c5 70 2c 30 9d 3c V6M.'k4..*.p,0.< 02b0 55 7d 78 ba 8b 4d a2 33 c0 a0 87 6e 85 65 0c cc U}x..M.3...n.e.. 02c0 1a a6 88 09 c5 05 30 a9 02 c1 0d c4 13 8e 46 5d ......0.......F] 02d0 80 85 76 21 59 85 1b cf 63 9f 42 45 67 06 af 76 ..v!Y...c.BEg..v 02e0 9f a1 85 fe bc e9 52 ee 42 bd f3 1c c1 42 9d 4b ......R.B....B.K 02f0 00 d0 34 17 72 0a fe 11 b8 d9 86 b8 15 09 71 1f ..4.r.........q. 0300 9f c8 33 f3 6c ba 58 08 c0 6b db 88 85 b3 73 a1 ..3.l.X..k....s. 0310 94 86 d6 f6 4e 38 af 5f 35 07 cb 28 85 69 be 9e ....N8._5..(.i.. 0320 2b 7d f6 2b 24 07 2f fc 30 cd 67 8d e1 e3 2c f8 +}.+$./.0.g...,. 0330 77 92 cf 2b 5a 2c 1e 24 6c ce 78 dd 14 5a 0a ba w..+Z,.$l.x..Z.. 0340 ed 66 33 70 6d 6a 5c aa 47 a7 ca 95 51 0d b3 24 .f3pmj\.G...Q..$ 0350 0c 67 19 1b eb 9c ca ca ad 8c 4c bc 49 9d af fe .g........L.I... 0360 de 0b 0d 85 35 ee 87 b8 14 09 fc 8f 24 a9 95 59 ....5.......$..Y 0370 37 68 aa 28 fe 5b 44 ce a2 31 d6 d9 b2 a7 57 a5 7h.(.[D..1....W. 0380 c3 af 02 38 6f 80 43 41 bf 26 c0 37 de cc 26 25 ...8o.CA.&.7..&% 0390 75 32 7b 76 9c 8b 9b 3c e7 9c ca eb f9 f6 eb 8c u2{v...<........ 03a0 44 16 34 6b 02 c0 66 4b 12 97 9d 38 6d e0 a5 79 D.4k..fK...8m..y 03b0 b1 3e 2c 5c b6 bf c6 0e d5 3a 7b af ee 58 55 7c .>,\.....:{..XU| 03c0 dd 47 80 92 99 77 22 9e a2 18 f6 72 49 e1 0e 66 .G...w"....rI..f 03d0 df 89 68 8b 81 c5 e5 0e db f7 a5 c4 77 3c cb 7e ..h.........w<.~ 03e0 20 43 8f d5 0f 5b eb 8a 2a 26 e7 58 80 5f 66 90 C...[..*&.X._f. 03f0 24 35 41 94 fd 20 47 98 be 4f de b4 d2 59 8e c7 $5A.. G..O...Y.. 0400 cc 8a db fa 22 e0 da 7e f5 e4 e9 7f ae db 15 27 ...."..~.......' 0410 6d b0 9f 73 15 e4 34 ae 75 1d fa 0c d2 e1 85 87 m..s..4.u....... 0420 7a 09 7e 1f 61 14 a8 02 05 6a c2 f6 4d e4 86 fa z.~.a....j..M... 0430 cb 61 7c 18 38 75 42 7c 16 d5 2d f6 9e 0a 20 6f .a|.8uB|..-... o 0440 8b cc 55 3e de 8b 92 8b 51 55 36 42 0a 3c d9 e9 ..U>....QU6B.<.. 0450 2b f2 8d 39 47 a5 3b 82 80 61 d5 29 77 47 b7 b7 +..9G.;..a.)wG.. 0460 9c ce b8 e6 9a ba d3 5c c0 35 3a ac 2a 9e 01 79 .......\.5:.*..y 0470 d4 6d 0d 0e 3c ac 5e 20 0c 88 e7 cf a8 d9 55 8c .m..<.^ ......U. 0480 06 ef d0 b5 57 7e 46 39 a4 26 b8 17 b0 14 93 a7 ....W~F9.&...... 0490 fb f5 70 76 a0 1c 9a 5e 6a c2 3b 8d f9 5f d9 ba ..pv...^j.;.._.. 04a0 00 31 39 78 89 5c 57 2e ba 08 78 79 99 5f c1 fe .19x.\W...xy._.. 04b0 1f a8 0e 47 f0 f5 43 57 e1 c6 57 61 27 5e 2e 99 ...G..CW..Wa'^.. 04c0 93 bd e7 df d2 7a e1 88 28 05 01 4f d6 4f 5b 53 .....z..(..O.O[S 04d0 1e 49 02 5e 8c 2e 9f b4 cb 1f c5 df 0f f2 d0 f3 .I.^............ 04e0 cc 72 17 67 b5 24 55 e5 ab 6a 6b c7 f9 b8 d0 33 .r.g.$U..jk....3 04f0 74 c9 52 31 2a cb ab 28 bc 64 6d 79 b7 2c ab c2 t.R1*..(.dmy.,.. 0500 15 cc 3c 00 db 23 e7 5c 67 f1 7b 8d b3 5d ab db ..<..#.\g.{..].. 0510 43 20 99 e1 ae bc 5c 10 24 f4 4d a9 87 e4 7d 9e C ....\.$.M...}. 0520 19 ea f6 90 f1 c5 d7 c2 ce ac 2e 58 bf 1b e7 a1 ...........X.... 0530 e5 a0 68 5f bc ce 6f ae 8f bf f4 d7 eb 30 47 aa ..h_..o......0G. 0540 dd 2e 8d ea 26 c5 d9 0d cb b1 f9 e7 a0 36 b3 1b ....&........6.. 0550 19 ed e1 dc 94 4b 6d 23 7a 87 c7 74 b1 25 b5 47 .....Km#z..t.%.G 0560 9f 2c a7 61 c2 20 50 da eb a3 bf 96 ec b4 45 09 .,.a. P.......E. 0570 6a 88 3d f0 96 6f b4 2a 4b a9 c2 1c 3d 00 0b 47 j.=..o.*K...=..G 0580 06 f7 53 b2 c5 a9 3a d1 3e 41 6d 81 7c d9 d3 e4 ..S...:.>Am.|... 0590 99 b0 f5 09 58 55 51 c6 66 38 13 bd d6 a8 86 04 ....XUQ.f8...... 05a0 a7 a6 62 40 ae 25 91 c0 52 90 dc 07 11 79 de ff ..b@.%..R....y.. 05b0 8a 63 c6 bc 56 59 be 6d 92 68 b2 0a b3 1b 70 de .c..VY.m.h....p. 05c0 1d b0 73 0b c7 92 38 17 7b 97 8a e8 f2 64 25 b6 ..s...8.{....d%. 05d0 0f 4c b0 72 f3 7c 56 56 83 61 45 ec 0d 7a f7 2d .L.r.|VV.aE..z.- 05e0 db 22 c3 b0 13 2e b6 93 d1 52 .".......R No. Time Source Destination Protocol Info 191 67.656482 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2143 bytes) Frame 191 (788 bytes on wire, 788 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 27515, Ack: 6839, Len: 734 Lightweight Directory Access Protocol SASL Buffer Length: 2190 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4C32BC0A30CC5ECE4D511200438D784B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4C32BC0A30CC5ECE krb5_sgn_cksum: 4D511200438D784B krb5_confounder: 2C4EB84D2346D08D GSS-API Encrypted payload (2143 bytes) Frame (788 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 06 2e 12 40 00 80 06 6e d4 ac 1f 01 65 ac 1f ....@...n....e.. 0020 01 68 01 85 07 f0 0b 68 be f8 d3 1c 21 87 50 18 .h.....h....!.P. 0030 f9 0d 37 e3 00 00 56 34 1c 8a a8 aa 60 c2 db b6 ..7...V4....`... 0040 24 62 73 4e 65 1e 67 40 a5 14 1e f3 01 ab 0c 0c $bsNe.g@........ 0050 d8 53 31 c5 0c 19 5b a1 a4 f8 43 a3 31 0c 38 a1 .S1...[...C.1.8. 0060 b6 47 24 b3 94 e8 14 03 52 f0 8f 20 83 7e 73 7e .G$.....R.. .~s~ 0070 1a 43 07 83 90 7f 60 5a 96 f5 7e 90 b4 4a 97 a3 .C....`Z..~..J.. 0080 20 01 ad d5 65 43 ee 75 a4 a4 bc bb 20 86 32 bc ...eC.u.... .2. 0090 4b 60 05 7c b3 bb 6c aa 76 e6 68 84 c0 97 ea 3f K`.|..l.v.h....? 00a0 d5 f2 33 02 83 94 31 89 c8 3c 77 ab 55 60 7b eb ..3...1...._H.. 00c0 eb f1 62 03 40 f4 0c ff 1b 5a 6b 05 2f 4c 02 6f ..b.@....Zk./L.o 00d0 cc d2 e1 41 45 23 b7 b4 28 f5 f9 0b f4 bf 33 3f ...AE#..(.....3? 00e0 18 96 50 8f ef 0a 42 96 9a c2 12 27 08 0e a6 c2 ..P...B....'.... 00f0 7b 6e f9 9f 1e 9f 75 3f 9a e0 79 64 82 83 cd a5 {n....u?..yd.... 0100 a1 f2 a7 86 05 ca 65 46 49 2e 02 f2 26 91 df e9 ......eFI...&... 0110 f2 d8 c1 40 91 1b 33 d0 e2 be 27 78 64 48 2d e9 ...@..3...'xdH-. 0120 1d cc 9d 32 09 a4 bd e0 4b 26 c5 01 9f 07 76 73 ...2....K&....vs 0130 24 49 8b e2 de fe 1c 31 81 77 1f ae e0 98 6a 42 $I.....1.w....jB 0140 5d af 54 93 a5 2c d1 2b 36 f0 60 12 ac cf 79 45 ].T..,.+6.`...yE 0150 99 de 00 f6 7b 02 04 5e b3 95 84 99 d6 4d 04 54 ....{..^.....M.T 0160 39 0b 4c d5 a7 75 7c 60 01 0b a8 14 b8 b8 bb 28 9.L..u|`.......( 0170 f2 bf e6 9a e3 68 9f 96 34 91 1d ca 22 f9 37 8c .....h..4...".7. 0180 20 60 9a 61 8a a7 1e 3c 4a 7a fc a8 0a 3f 5e 4d `.a......"...S 01b0 68 09 8f d2 62 d5 e0 1f 0e 9d 7e f1 16 15 42 26 h...b.....~...B& 01c0 ba 2f af 31 33 b2 cd 5e 51 7d d2 39 4a de d0 30 ./.13..^Q}.9J..0 01d0 70 8a 42 f3 a1 b2 39 37 b4 eb 83 28 d0 24 38 c0 p.B...97...(.$8. 01e0 dc 53 1a d2 94 51 33 0c 16 b3 ae 7d 12 e7 27 69 .S...Q3....}..'i 01f0 60 58 97 84 72 35 05 91 68 67 de 8b c0 c0 99 84 `X..r5..hg...... 0200 c5 1c 9b e9 81 15 db b8 6e af 39 12 bb 1f 02 3e ........n.9....> 0210 37 85 66 63 11 2f 6f c5 e1 df 70 3a eb 30 c8 b8 7.fc./o...p:.0.. 0220 71 eb 7a f1 43 19 31 8a 45 5f 07 68 22 7e 84 15 q.z.C.1.E_.h"~.. 0230 39 f7 17 e2 17 10 3a d5 76 0d a5 94 cf 47 d0 a8 9.....:.v....G.. 0240 c3 95 ec a4 c9 13 47 03 d2 e6 79 d6 80 fa 1f aa ......G...y..... 0250 32 92 e5 29 d5 bd 91 0e 27 b5 8a 51 ed 74 95 f4 2..)....'..Q.t.. 0260 28 95 b2 fd fd 95 72 5d 2f 04 55 d4 54 6d e0 d0 (.....r]/.U.Tm.. 0270 78 63 d8 03 3b 44 ee e0 df 4a f3 a6 78 e9 2d 10 xc..;D...J..x.-. 0280 98 2b 47 3a e4 bd a1 32 cf 5d b2 9b 86 db 46 5d .+G:...2.]....F] 0290 ec 76 72 87 66 29 36 c0 c9 ec d4 25 80 58 3e 88 .vr.f)6....%.X>. 02a0 b3 72 f3 ae 8d 1d d1 b6 46 a9 c1 9f 5b af 7e ec .r......F...[.~. 02b0 bc 7b e8 03 c5 9e 4f 5c e4 58 a5 c2 83 38 9e 18 .{....O\.X...8.. 02c0 ce e1 60 62 bd ab a6 72 6f 6e 0f 7c 73 69 06 50 ..`b...ron.|si.P 02d0 b2 87 5b 00 8a 9d 29 69 dd 05 7b bc d9 0a 2c b4 ..[...)i..{...,. 02e0 44 ef 36 e5 fd 3b 5c e5 fc 4c f8 e1 56 95 29 6b D.6..;\..L..V.)k 02f0 ef c0 57 74 16 c7 c9 e6 36 0c b4 50 3f 5e ea 24 ..Wt....6..P?^.$ 0300 53 59 f8 f8 6c 6e 0b ea ea 9f 14 49 6f ef 2a ff SY..ln.....Io.*. 0310 bc 41 78 4e .AxN Reassembled TCP (2194 bytes): 0000 00 00 08 8e 60 82 08 8a 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 4c 32 bc 0a 30 ...........L2..0 0020 cc 5e ce 4d 51 12 00 43 8d 78 4b 2c 4e b8 4d 23 .^.MQ..C.xK,N.M# 0030 46 d0 8d 73 ce 5b b2 cf 33 7e 2d c6 ff 28 52 09 F..s.[..3~-..(R. 0040 b8 c1 a6 76 dd 1a 8b 93 fc fe da d9 27 b1 f6 91 ...v........'... 0050 33 49 78 b9 64 82 70 6c 1c 4d 6c 92 30 45 7e 7a 3Ix.d.pl.Ml.0E~z 0060 de 9e 44 89 54 a9 da 02 59 6d 3d 47 9d db 8f db ..D.T...Ym=G.... 0070 84 62 de b0 1b 01 5d ee 15 7c 1a e2 fb f0 f7 9f .b....]..|...... 0080 03 d5 27 94 4b 59 04 b3 46 3a be 47 f2 4e 03 4b ..'.KY..F:.G.N.K 0090 ea d3 f8 8d 28 7f da 3f 04 78 7f 62 32 52 eb 0f ....(..?.x.b2R.. 00a0 7d 85 37 06 7e 45 cd f4 81 35 15 9a 74 f8 d6 3b }.7.~E...5..t..; 00b0 13 7f 54 53 09 9a a1 36 22 ad 67 1c 2f 04 c8 7b ..TS...6".g./..{ 00c0 b9 68 82 38 49 d9 a2 42 fa a5 fe 38 90 26 16 7e .h.8I..B...8.&.~ 00d0 60 ef 18 3e cc 5c f4 60 36 4c 5b f9 70 63 73 96 `..>.\.`6L[.pcs. 00e0 2b 9d 40 a5 df 9c f8 a1 b0 8f 17 86 d7 8b 24 d0 +.@...........$. 00f0 e7 5c 5b ef 53 c8 aa 01 92 4a c1 24 a4 5d 1f 16 .\[.S....J.$.].. 0100 0c ab 00 39 df e4 93 bb dd 63 a1 30 04 36 6b d6 ...9.....c.0.6k. 0110 da cf a8 66 f4 c5 f6 6f a3 ff 39 e2 14 db 36 6f ...f...o..9...6o 0120 d5 96 3b 0a 08 0c 99 a2 25 f3 7c c1 e2 22 61 4e ..;.....%.|.."aN 0130 f9 67 7f 38 45 7b 70 a4 9c b1 d3 4e 3e 74 3a 09 .g.8E{p....N>t:. 0140 3e be d9 17 4a e7 53 7c c1 12 ac cb 8e 95 b2 c2 >...J.S|........ 0150 8e 1a 02 a3 cc 4a 08 0f 3a 2b 1a ed 80 18 50 0a .....J..:+....P. 0160 96 7e cd 84 37 53 0e 17 9e 8e f4 a3 7f ea 8f f8 .~..7S.......... 0170 22 45 cb 36 ba 4e fb 64 62 bd 85 16 56 3d 76 8b "E.6.N.db...V=v. 0180 7a 0b cb a3 df e0 07 25 e2 3f e8 2a 81 f3 a5 b9 z......%.?.*.... 0190 54 04 76 eb 9b 24 4d a1 f8 d2 bc 46 58 8d bc 87 T.v..$M....FX... 01a0 ec 48 8f c7 ba c8 c7 52 2b f0 96 b1 5e 08 a5 62 .H.....R+...^..b 01b0 a9 c2 d5 a5 f6 a6 7c a4 e9 79 04 b5 4b f3 cd cc ......|..y..K... 01c0 cf 73 ff cc 05 15 0a f6 34 52 de 68 e0 a3 35 6d .s......4R.h..5m 01d0 6b af 4d 2b a6 dc db ed 01 14 ec 64 dd e7 92 db k.M+.......d.... 01e0 95 de b0 6f 81 a3 90 2e 6e 3d 67 97 0d b2 c6 0f ...o....n=g..... 01f0 44 cd a0 8d b7 6f fb f1 99 72 d1 c6 3a a8 f9 ac D....o...r..:... 0200 c8 f1 b3 32 25 39 a5 2f e3 1f 15 5e da 73 0a 29 ...2%9./...^.s.) 0210 c5 0c 12 16 fc 6c 25 7e 11 4e 62 29 8b ff 84 21 .....l%~.Nb)...! 0220 5c a9 01 ba 13 fe ad 4e 7e e9 3c f1 bd 71 78 8e \......N~.<..qx. 0230 f2 5b e6 e9 09 0e 9e 7c 30 0c 8a 7a bc a4 e5 a4 .[.....|0..z.... 0240 e9 97 fa 81 2d 4c eb c8 3a 6e d1 ec ef 4d 9e 4b ....-L..:n...M.K 0250 fd 01 c2 af 25 ce 0e b2 16 fb d1 78 52 61 ed 38 ....%......xRa.8 0260 45 b6 59 06 b7 e4 87 b8 46 39 56 36 4d ec 27 6b E.Y.....F9V6M.'k 0270 34 db d8 2a c5 70 2c 30 9d 3c 55 7d 78 ba 8b 4d 4..*.p,0.,\.. 0380 c6 0e d5 3a 7b af ee 58 55 7c dd 47 80 92 99 77 ...:{..XU|.G...w 0390 22 9e a2 18 f6 72 49 e1 0e 66 df 89 68 8b 81 c5 "....rI..f..h... 03a0 e5 0e db f7 a5 c4 77 3c cb 7e 20 43 8f d5 0f 5b ......w<.~ C...[ 03b0 eb 8a 2a 26 e7 58 80 5f 66 90 24 35 41 94 fd 20 ..*&.X._f.$5A.. 03c0 47 98 be 4f de b4 d2 59 8e c7 cc 8a db fa 22 e0 G..O...Y......". 03d0 da 7e f5 e4 e9 7f ae db 15 27 6d b0 9f 73 15 e4 .~.......'m..s.. 03e0 34 ae 75 1d fa 0c d2 e1 85 87 7a 09 7e 1f 61 14 4.u.......z.~.a. 03f0 a8 02 05 6a c2 f6 4d e4 86 fa cb 61 7c 18 38 75 ...j..M....a|.8u 0400 42 7c 16 d5 2d f6 9e 0a 20 6f 8b cc 55 3e de 8b B|..-... o..U>.. 0410 92 8b 51 55 36 42 0a 3c d9 e9 2b f2 8d 39 47 a5 ..QU6B.<..+..9G. 0420 3b 82 80 61 d5 29 77 47 b7 b7 9c ce b8 e6 9a ba ;..a.)wG........ 0430 d3 5c c0 35 3a ac 2a 9e 01 79 d4 6d 0d 0e 3c ac .\.5:.*..y.m..<. 0440 5e 20 0c 88 e7 cf a8 d9 55 8c 06 ef d0 b5 57 7e ^ ......U.....W~ 0450 46 39 a4 26 b8 17 b0 14 93 a7 fb f5 70 76 a0 1c F9.&........pv.. 0460 9a 5e 6a c2 3b 8d f9 5f d9 ba 00 31 39 78 89 5c .^j.;.._...19x.\ 0470 57 2e ba 08 78 79 99 5f c1 fe 1f a8 0e 47 f0 f5 W...xy._.....G.. 0480 43 57 e1 c6 57 61 27 5e 2e 99 93 bd e7 df d2 7a CW..Wa'^.......z 0490 e1 88 28 05 01 4f d6 4f 5b 53 1e 49 02 5e 8c 2e ..(..O.O[S.I.^.. 04a0 9f b4 cb 1f c5 df 0f f2 d0 f3 cc 72 17 67 b5 24 ...........r.g.$ 04b0 55 e5 ab 6a 6b c7 f9 b8 d0 33 74 c9 52 31 2a cb U..jk....3t.R1*. 04c0 ab 28 bc 64 6d 79 b7 2c ab c2 15 cc 3c 00 db 23 .(.dmy.,....<..# 04d0 e7 5c 67 f1 7b 8d b3 5d ab db 43 20 99 e1 ae bc .\g.{..]..C .... 04e0 5c 10 24 f4 4d a9 87 e4 7d 9e 19 ea f6 90 f1 c5 \.$.M...}....... 04f0 d7 c2 ce ac 2e 58 bf 1b e7 a1 e5 a0 68 5f bc ce .....X......h_.. 0500 6f ae 8f bf f4 d7 eb 30 47 aa dd 2e 8d ea 26 c5 o......0G.....&. 0510 d9 0d cb b1 f9 e7 a0 36 b3 1b 19 ed e1 dc 94 4b .......6.......K 0520 6d 23 7a 87 c7 74 b1 25 b5 47 9f 2c a7 61 c2 20 m#z..t.%.G.,.a. 0530 50 da eb a3 bf 96 ec b4 45 09 6a 88 3d f0 96 6f P.......E.j.=..o 0540 b4 2a 4b a9 c2 1c 3d 00 0b 47 06 f7 53 b2 c5 a9 .*K...=..G..S... 0550 3a d1 3e 41 6d 81 7c d9 d3 e4 99 b0 f5 09 58 55 :.>Am.|.......XU 0560 51 c6 66 38 13 bd d6 a8 86 04 a7 a6 62 40 ae 25 Q.f8........b@.% 0570 91 c0 52 90 dc 07 11 79 de ff 8a 63 c6 bc 56 59 ..R....y...c..VY 0580 be 6d 92 68 b2 0a b3 1b 70 de 1d b0 73 0b c7 92 .m.h....p...s... 0590 38 17 7b 97 8a e8 f2 64 25 b6 0f 4c b0 72 f3 7c 8.{....d%..L.r.| 05a0 56 56 83 61 45 ec 0d 7a f7 2d db 22 c3 b0 13 2e VV.aE..z.-.".... 05b0 b6 93 d1 52 56 34 1c 8a a8 aa 60 c2 db b6 24 62 ...RV4....`...$b 05c0 73 4e 65 1e 67 40 a5 14 1e f3 01 ab 0c 0c d8 53 sNe.g@.........S 05d0 31 c5 0c 19 5b a1 a4 f8 43 a3 31 0c 38 a1 b6 47 1...[...C.1.8..G 05e0 24 b3 94 e8 14 03 52 f0 8f 20 83 7e 73 7e 1a 43 $.....R.. .~s~.C 05f0 07 83 90 7f 60 5a 96 f5 7e 90 b4 4a 97 a3 20 01 ....`Z..~..J.. . 0600 ad d5 65 43 ee 75 a4 a4 bc bb 20 86 32 bc 4b 60 ..eC.u.... .2.K` 0610 05 7c b3 bb 6c aa 76 e6 68 84 c0 97 ea 3f d5 f2 .|..l.v.h....?.. 0620 33 02 83 94 31 89 c8 3c 77 ab 55 60 7b eb 85 77 3...1...._H.... 0640 62 03 40 f4 0c ff 1b 5a 6b 05 2f 4c 02 6f cc d2 b.@....Zk./L.o.. 0650 e1 41 45 23 b7 b4 28 f5 f9 0b f4 bf 33 3f 18 96 .AE#..(.....3?.. 0660 50 8f ef 0a 42 96 9a c2 12 27 08 0e a6 c2 7b 6e P...B....'....{n 0670 f9 9f 1e 9f 75 3f 9a e0 79 64 82 83 cd a5 a1 f2 ....u?..yd...... 0680 a7 86 05 ca 65 46 49 2e 02 f2 26 91 df e9 f2 d8 ....eFI...&..... 0690 c1 40 91 1b 33 d0 e2 be 27 78 64 48 2d e9 1d cc .@..3...'xdH-... 06a0 9d 32 09 a4 bd e0 4b 26 c5 01 9f 07 76 73 24 49 .2....K&....vs$I 06b0 8b e2 de fe 1c 31 81 77 1f ae e0 98 6a 42 5d af .....1.w....jB]. 06c0 54 93 a5 2c d1 2b 36 f0 60 12 ac cf 79 45 99 de T..,.+6.`...yE.. 06d0 00 f6 7b 02 04 5e b3 95 84 99 d6 4d 04 54 39 0b ..{..^.....M.T9. 06e0 4c d5 a7 75 7c 60 01 0b a8 14 b8 b8 bb 28 f2 bf L..u|`.......(.. 06f0 e6 9a e3 68 9f 96 34 91 1d ca 22 f9 37 8c 20 60 ...h..4...".7. ` 0700 9a 61 8a a7 1e 3c 4a 7a fc a8 0a 3f 5e 4d cd 25 .a......"...Sh. 0730 8f d2 62 d5 e0 1f 0e 9d 7e f1 16 15 42 26 ba 2f ..b.....~...B&./ 0740 af 31 33 b2 cd 5e 51 7d d2 39 4a de d0 30 70 8a .13..^Q}.9J..0p. 0750 42 f3 a1 b2 39 37 b4 eb 83 28 d0 24 38 c0 dc 53 B...97...(.$8..S 0760 1a d2 94 51 33 0c 16 b3 ae 7d 12 e7 27 69 60 58 ...Q3....}..'i`X 0770 97 84 72 35 05 91 68 67 de 8b c0 c0 99 84 c5 1c ..r5..hg........ 0780 9b e9 81 15 db b8 6e af 39 12 bb 1f 02 3e 37 85 ......n.9....>7. 0790 66 63 11 2f 6f c5 e1 df 70 3a eb 30 c8 b8 71 eb fc./o...p:.0..q. 07a0 7a f1 43 19 31 8a 45 5f 07 68 22 7e 84 15 39 f7 z.C.1.E_.h"~..9. 07b0 17 e2 17 10 3a d5 76 0d a5 94 cf 47 d0 a8 c3 95 ....:.v....G.... 07c0 ec a4 c9 13 47 03 d2 e6 79 d6 80 fa 1f aa 32 92 ....G...y.....2. 07d0 e5 29 d5 bd 91 0e 27 b5 8a 51 ed 74 95 f4 28 95 .)....'..Q.t..(. 07e0 b2 fd fd 95 72 5d 2f 04 55 d4 54 6d e0 d0 78 63 ....r]/.U.Tm..xc 07f0 d8 03 3b 44 ee e0 df 4a f3 a6 78 e9 2d 10 98 2b ..;D...J..x.-..+ 0800 47 3a e4 bd a1 32 cf 5d b2 9b 86 db 46 5d ec 76 G:...2.]....F].v 0810 72 87 66 29 36 c0 c9 ec d4 25 80 58 3e 88 b3 72 r.f)6....%.X>..r 0820 f3 ae 8d 1d d1 b6 46 a9 c1 9f 5b af 7e ec bc 7b ......F...[.~..{ 0830 e8 03 c5 9e 4f 5c e4 58 a5 c2 83 38 9e 18 ce e1 ....O\.X...8.... 0840 60 62 bd ab a6 72 6f 6e 0f 7c 73 69 06 50 b2 87 `b...ron.|si.P.. 0850 5b 00 8a 9d 29 69 dd 05 7b bc d9 0a 2c b4 44 ef [...)i..{...,.D. 0860 36 e5 fd 3b 5c e5 fc 4c f8 e1 56 95 29 6b ef c0 6..;\..L..V.)k.. 0870 57 74 16 c7 c9 e6 36 0c b4 50 3f 5e ea 24 53 59 Wt....6..P?^.$SY 0880 f8 f8 6c 6e 0b ea ea 9f 14 49 6f ef 2a ff bc 41 ..ln.....Io.*..A 0890 78 4e xN No. Time Source Destination Protocol Info 192 67.656866 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=6839 Ack=28249 Win=64240 Len=0 Frame 192 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6839, Ack: 28249, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 28 40 00 80 06 bf 9b ac 1f 01 68 ac 1f .(.(@........h.. 0020 01 65 07 f0 01 85 d3 1c 21 87 0b 68 c1 d6 50 10 .e......!..h..P. 0030 fa f0 8e 80 00 00 00 00 00 ae 60 81 ..........`. No. Time Source Destination Protocol Info 193 67.658440 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 193 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6839, Ack: 28249, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9D72FF027EBEC39C0C45883D91770685... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9D72FF027EBEC39C krb5_sgn_cksum: 0C45883D91770685 krb5_confounder: 659F541D5E6110BD GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 29 40 00 80 06 bf 34 ac 1f 01 68 ac 1f ...)@....4...h.. 0020 01 65 07 f0 01 85 d3 1c 21 87 0b 68 c1 d6 50 18 .e......!..h..P. 0030 fa f0 76 d4 00 00 00 00 00 62 60 60 06 09 2a 86 ..v......b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 9d H............... 0050 72 ff 02 7e be c3 9c 0c 45 88 3d 91 77 06 85 65 r..~....E.=.w..e 0060 9f 54 1d 5e 61 10 bd 70 05 1f 63 16 1f 34 94 69 .T.^a..p..c..4.i 0070 5c 97 e1 06 1f fd a1 7a 9e 81 69 bc 2f 90 72 18 \......z..i./.r. 0080 9a 1f 5c 2e 33 ff 7a 95 18 4a be b4 ff 54 df b8 ..\.3.z..J...T.. 0090 f4 9c 38 0c 16 15 c3 ea 54 71 9b b0 ..8.....Tq.. No. Time Source Destination Protocol Info 194 67.659386 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 194 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 28249, Ack: 6941, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 13 40 00 80 06 6b fd ac 1f 01 65 ac 1f ....@...k....e.. 0020 01 68 01 85 07 f0 0b 68 c1 d6 d3 1c 21 ed 50 10 .h.....h....!.P. 0030 f8 a7 54 34 00 00 00 00 09 dd 60 82 09 d9 06 09 ..T4......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 29 0f 5d 23 17 cb e2 4b 21 96 f4 03 87 08 7f .).]#...K!...... 0060 58 de 73 2e 5e f6 72 11 93 43 fa 82 2c 32 97 47 X.s.^.r..C..,2.G 0070 62 64 67 4a 0f 5a 23 82 28 df ff 0a 3b 62 47 38 bdgJ.Z#.(...;bG8 0080 19 89 26 cc 91 d9 3f 1b 17 7e 52 59 cf 8f 13 46 ..&...?..~RY...F 0090 87 cc 45 d9 49 03 a6 e5 bf ff fe 6e 1c ad 8d dd ..E.I......n.... 00a0 cd 53 20 28 35 ac 49 60 a0 cd d2 da ff e4 ca 4d .S (5.I`.......M 00b0 74 db 4c c0 2b 5f 76 26 1d bb 08 78 db 76 dc 0b t.L.+_v&...x.v.. 00c0 02 09 49 3b f1 4c 67 8e cf 64 44 51 5d 8c 06 a6 ..I;.Lg..dDQ]... 00d0 0d c0 29 6e 25 f1 29 f7 1b e2 73 58 f0 22 8b 3d ..)n%.)...sX.".= 00e0 a6 64 45 be bf 1c 03 bc 4b a1 28 06 6e 6f fc 8a .dE.....K.(.no.. 00f0 2f 64 7f 01 ad b6 04 63 ee 47 77 fa c7 77 b8 fc /d.....c.Gw..w.. 0100 6a c7 2c bc 8d 92 99 97 94 02 54 d1 47 d4 5a e0 j.,.......T.G.Z. 0110 68 9e dd d8 e3 bc c7 0e 0c 0e fd 87 9f ed 8d a8 h............... 0120 28 f9 25 2b 65 2b ea f1 ce d2 d9 e3 51 be 91 31 (.%+e+......Q..1 0130 af a1 5b 23 e7 05 28 14 c3 37 bf f1 17 7c 4e b1 ..[#..(..7...|N. 0140 b5 fc 0d 14 ee bf 79 a1 43 33 f2 c7 dd 2b 74 d3 ......y.C3...+t. 0150 48 cb 4c f5 23 dd 0f d3 f8 47 48 1a 23 9b 91 43 H.L.#....GH.#..C 0160 73 64 8b 52 0e c3 76 8c 20 b6 d6 fa 86 c3 39 2b sd.R..v. .....9+ 0170 48 f3 30 3a 8d 78 b2 34 bb f3 74 5e 06 11 1d c1 H.0:.x.4..t^.... 0180 59 2e aa cd 04 2f 72 60 f5 5c 76 ce 73 ca 33 4d Y..../r`.\v.s.3M 0190 74 ee b7 09 1b e9 26 04 e9 9b 50 30 a0 a8 75 ff t.....&...P0..u. 01a0 4b 21 a8 ff 21 a8 a6 39 58 32 db 22 61 61 10 9e K!..!..9X2."aa.. 01b0 62 e8 c0 7e cb 6d 76 22 e0 b7 a8 ff be 19 b5 7f b..~.mv"........ 01c0 41 03 a7 49 f2 ee 1a 8c 01 25 30 d5 8e a7 c9 4c A..I.....%0....L 01d0 01 75 30 fd 27 f1 aa 16 18 e9 2b cd 42 26 47 8f .u0.'.....+.B&G. 01e0 e7 be ee 0b b4 3a 04 c2 25 a0 d9 b8 e9 40 a0 10 .....:..%....@.. 01f0 b1 9d 96 07 11 74 cf 6f 03 c1 70 d4 e0 65 2b 18 .....t.o..p..e+. 0200 d1 59 f7 fa 1f 36 2b 4f e2 95 4e 49 04 ed 99 0a .Y...6+O..NI.... 0210 51 79 9d 47 46 5b 2c 4b ad 6e e5 10 ab cf c8 4b Qy.GF[,K.n.....K 0220 d1 2d 7c c3 f8 d5 c2 54 59 9a f8 23 02 0d 1a 5b .-|....TY..#...[ 0230 af b2 7e cb 41 83 ab a0 2e fa 6d be e0 b5 98 b3 ..~.A.....m..... 0240 a4 3a bb c1 ad c1 67 e2 d0 81 65 98 10 fe ce fe .:....g...e..... 0250 20 74 56 3e 13 27 a8 31 85 5e f9 86 e2 e7 1d be tV>.'.1.^...... 0260 91 2d a9 96 90 75 5d 46 60 d2 cd 2e ac 86 27 9c .-...u]F`.....'. 0270 c8 bc 95 e1 f3 33 ba a6 52 8c e9 91 01 24 38 06 .....3..R....$8. 0280 38 f9 43 3f 89 e5 e8 65 77 94 4c 1f a3 f2 c2 51 8.C?...ew.L....Q 0290 d1 6e da 5a 61 b1 39 27 5c 6e 67 e2 10 e8 bd 74 .n.Za.9'\ng....t 02a0 af ef 42 86 95 12 89 6a 1f 3c 9e 4b 16 0a cd 8d ..B....j.<.K.... 02b0 72 59 0e 17 78 d5 04 28 26 84 dd c1 d2 e9 61 10 rY..x..(&.....a. 02c0 e7 12 75 2c 1a d5 94 91 23 88 2c 4e 12 19 bf ec ..u,....#.,N.... 02d0 3a be 31 3f 5b 35 b7 d2 75 b2 8c 3f f4 ed d7 39 :.1?[5..u..?...9 02e0 32 e0 71 cb ad 5a 2f 2e 16 3e 6a a6 37 29 60 da 2.q..Z/..>j.7)`. 02f0 22 82 0d c1 44 79 dd f9 27 44 29 85 fd a2 0f ba "...Dy..'D)..... 0300 4c 8a 5f c0 cd 3a 5e 0b 88 de c1 f9 55 24 36 17 L._..:^.....U$6. 0310 b8 7b c3 1e 57 be 47 cd 5e d9 57 ba 3d 42 4f 32 .{..W.G.^.W.=BO2 0320 4b da c4 42 ff 2a 80 12 d3 3c 7e 36 41 67 30 a6 K..B.*...<~6Ag0. 0330 37 03 3b 3d ff 6f 77 11 95 93 6e d2 e7 3e 00 fd 7.;=.ow...n..>.. 0340 22 ce f5 3f 45 57 38 36 6d 27 09 be 13 a1 a7 88 "..?EW86m'...... 0350 42 17 ab 9d c1 18 9c 5f 92 a8 e6 1b 4d 2d a1 e8 B......_....M-.. 0360 04 4b 7a 4a 1c a7 cb 39 c5 c5 4c ff fa 09 0d 9c .KzJ...9..L..... 0370 37 be 92 1b 10 7e 35 43 f2 e0 8c 7c 67 cc 76 b2 7....~5C...|g.v. 0380 0d 62 d6 0c 07 41 a5 8b 9b 08 22 d0 49 2c a1 4b .b...A....".I,.K 0390 10 77 26 2e 3a 00 74 66 65 0d d2 27 09 4d b2 f4 .w&.:.tfe..'.M.. 03a0 88 a4 1f 05 6c 5e 17 cd b8 e7 f1 ee 03 44 e5 c0 ....l^.......D.. 03b0 a9 40 39 61 80 4e 10 d0 8e b2 79 52 d0 cc 66 4e .@9a.N....yR..fN 03c0 d0 d8 99 af e6 a2 75 23 ac 77 29 88 33 e1 d0 d7 ......u#.w).3... 03d0 fc 2f ce ec 18 53 1d 05 25 62 f2 f2 49 cb 99 b7 ./...S..%b..I... 03e0 5e 25 d4 6e b1 3f d1 34 73 06 7b 8c 90 c2 98 f3 ^%.n.?.4s.{..... 03f0 dc 0a 59 c0 f1 12 f8 5c 41 4d ae 15 3f 70 db 9f ..Y....\AM..?p.. 0400 9a 00 46 b1 9e b7 10 6c e9 68 a5 bd df 68 b1 e8 ..F....l.h...h.. 0410 21 26 57 89 7c 8b 9b 22 18 e0 14 7f d4 46 6f da !&W.|..".....Fo. 0420 b2 26 93 09 e7 54 5a 5d b8 5b 9e 48 d3 1c 5a 9a .&...TZ].[.H..Z. 0430 4e 04 58 92 c6 5a 3c 28 ba ba 4b e4 da c1 a3 6a N.X..Z<(..K....j 0440 16 98 82 97 be b7 23 e8 92 dc 24 4d 5d ec 53 c7 ......#...$M].S. 0450 1c d4 7b fb c2 25 7f ef fb e0 fb 33 e1 52 ef fa ..{..%.....3.R.. 0460 c3 69 92 4d 73 0f 8b bd b4 59 02 a6 27 c2 1d 63 .i.Ms....Y..'..c 0470 81 ea a9 93 20 34 1c 57 79 2b cc 15 93 d2 c5 2e .... 4.Wy+...... 0480 50 e1 23 68 11 e5 6d e7 3c 7c f5 fb 67 25 b5 e4 P.#h..m.<|..g%.. 0490 74 fa 0b 44 d2 f4 74 3d 60 f0 90 32 55 ea 0a 8e t..D..t=`..2U... 04a0 6b 61 74 44 88 7a 10 13 fa 3f ad 62 64 7d 3c 6e katD.z...?.bd}6}.$.s...B. 0510 67 8f 61 c2 8d f6 1b 22 e2 b2 0f d9 5a 7c 05 f0 g.a...."....Z|.. 0520 cb fa c8 de d5 06 cb a2 e9 e1 0c bf 93 8b e7 e6 ................ 0530 69 36 7e 48 fc f6 2c 4f a9 ee 68 9b 14 b6 15 69 i6~H..,O..h....i 0540 5d 8c a1 59 90 1a 56 da 18 c5 25 55 c1 03 b6 07 ]..Y..V...%U.... 0550 75 82 d7 21 cd d0 b2 e5 9e 9e 3b f9 43 de f2 02 u..!......;.C... 0560 a7 20 a1 38 56 9d 3d 63 11 44 d9 5d 67 79 19 65 . .8V.=c.D.]gy.e 0570 f4 92 24 43 b1 9b 64 ca 0e 39 5c 7e 4c a2 8e d2 ..$C..d..9\~L... 0580 42 7c 30 a3 5a fd bd 97 7a 8b 62 b6 5d 52 b5 75 B|0.Z...z.b.]R.u 0590 a7 5d 51 29 42 80 2b 80 ee 83 9e 70 02 a7 55 b6 .]Q)B.+....p..U. 05a0 2d 93 1b c0 61 33 4d 92 cc 49 18 ca 21 1e 14 36 -...a3M..I..!..6 05b0 e2 1b e5 ed 30 a7 b7 9f 58 49 1c 3a a5 9e 4c df ....0...XI.:..L. 05c0 cb 1a 9a f1 1a be e6 4d ff 18 3f 09 a2 f7 f0 78 .......M..?....x 05d0 65 16 99 26 ca a8 44 cc 1f f8 20 14 76 47 d8 5e e..&..D... .vG.^ 05e0 d8 8b 58 1d 4f 31 0f 38 c1 ab ..X.O1.8.. No. Time Source Destination Protocol Info 195 67.659491 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 195 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 29709, Ack: 6941, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF290F5D2317CBE24B2196F40387087F58... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 290F5D2317CBE24B krb5_sgn_cksum: 2196F40387087F58 krb5_confounder: DE732E5EF6721193 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2e 14 40 00 80 06 6d 83 ac 1f 01 65 ac 1f .U..@...m....e.. 0020 01 68 01 85 07 f0 0b 68 c7 8a d3 1c 21 ed 50 18 .h.....h....!.P. 0030 f8 a7 af 18 00 00 90 9b 95 3e 51 e1 3b 5f 83 5f .........>Q.;_._ 0040 18 1c c1 48 82 6d eb a3 6b 38 77 1b 09 cb f4 d9 ...H.m..k8w..... 0050 1e c2 0b fb eb c5 02 30 0c 81 fe 71 ef 99 3b 5b .......0...q..;[ 0060 28 df 76 a4 eb c7 88 38 e5 10 85 5d f8 ed 08 53 (.v....8...]...S 0070 13 4f 43 5a 55 97 14 ea 71 08 c1 9f 7e bd 3e 1f .OCZU...q...~.>. 0080 d5 12 e5 6e 79 95 e1 e4 c4 85 dd 05 a5 cd d1 be ...ny........... 0090 8a 3d d4 4e 05 f2 54 27 2f ea a4 bc 47 ae 74 6d .=.N..T'/...G.tm 00a0 e8 c1 33 60 b8 ab b2 ac 1c 24 88 b6 af 31 5e 4b ..3`.....$...1^K 00b0 1f 14 be a6 3e e1 83 71 8d 4d 41 b3 e5 ec 6a 13 ....>..q.MA...j. 00c0 d0 3d 8d e1 82 f7 e0 30 28 58 05 3d 4c c0 6f 3a .=.....0(X.=L.o: 00d0 4d e7 1c 0b ab 33 7b b4 05 ef bd 65 01 53 27 39 M....3{....e.S'9 00e0 11 a6 04 a0 2c 2e 34 b9 a1 b6 34 7c 2c 3e 03 ae ....,.4...4|,>.. 00f0 84 4e 50 de db 86 00 8d 44 86 4e 00 59 e9 0a da .NP.....D.N.Y... 0100 e5 ec 32 80 6f ff 0a 9b 43 97 f3 1d 52 7a 0d 13 ..2.o...C...Rz.. 0110 32 9c e6 e9 2a af af 16 91 cc 86 eb a0 49 96 a0 2...*........I.. 0120 27 22 43 27 70 7b 24 a6 87 77 4d b1 c6 9a 98 9c '"C'p{$..wM..... 0130 66 f3 b9 62 e7 35 cd d6 e6 e5 77 07 d2 2b b0 42 f..b.5....w..+.B 0140 4b ef f3 d6 1c 86 bb ba 80 06 48 4c 06 ac 7a 74 K.........HL..zt 0150 d7 1e 39 25 5a b4 82 8f fc b1 32 7a 27 f6 50 a0 ..9%Z.....2z'.P. 0160 ce ff 60 a2 e8 16 51 e0 1a f3 76 58 89 ca b2 86 ..`...Q...vX.... 0170 64 c7 44 c9 d9 8e 78 c7 69 42 57 53 f0 2f 95 31 d.D...x.iBWS./.1 0180 15 0d df d1 de 1e 3f 26 ee ad 7e 85 80 1e 91 7c ......?&..~....| 0190 bd ff ea ca 9e 91 ea d7 97 69 91 8c b0 b5 b1 b1 .........i...... 01a0 c5 ab b4 02 5d b5 a4 cb be f4 1a 6b b8 87 8f 68 ....]......k...h 01b0 86 0f a7 6d 99 2a 4a c8 d1 5f 5e 90 49 ba b3 5b ...m.*J.._^.I..[ 01c0 b3 84 47 4c 25 e1 ce 0b de 51 70 4b 88 8f 40 05 ..GL%....QpK..@. 01d0 6a b9 ed 50 cc 79 b3 5d f2 01 cf d4 94 c1 32 26 j..P.y.]......2& 01e0 91 19 56 fd da e7 48 fa e8 43 b0 8c 2b d1 bf ef ..V...H..C..+... 01f0 48 59 e8 3a 18 5e ca 12 0e 4a 2c aa 1a 3d f9 5c HY.:.^...J,..=.\ 0200 56 97 95 ab 7d bb bc a8 cf cd 32 2a b2 d7 29 3d V...}.....2*..)= 0210 e3 52 fa 31 07 8f c1 cc 8d f6 d4 58 b5 b9 6c f3 .R.1.......X..l. 0220 1e 6a 56 e3 e9 5b c9 69 0b 18 cc 1c 8e 3b 0d be .jV..[.i.....;.. 0230 5d f4 f3 ad 96 03 27 80 d5 32 ec 9b 99 c2 e3 cc ].....'..2...... 0240 37 36 8b 95 b4 40 00 86 af dc fd ad cf 2f e0 9e 76...@......./.. 0250 e5 a0 ca 1f 82 d2 31 b6 69 df 44 61 47 a4 93 0b ......1.i.DaG... 0260 92 09 e3 a3 92 0d 30 77 5a 0d 96 d7 cc 6c 02 83 ......0wZ....l.. 0270 c9 32 a2 ad 8a d8 c4 76 1f 27 12 3e 96 1f 49 83 .2.....v.'.>..I. 0280 71 29 d5 b6 65 b8 67 a1 d3 a5 a5 82 7b 5d 91 fe q)..e.g.....{].. 0290 66 22 d8 20 90 3a c7 90 e8 d2 5a 43 23 5f 30 9b f". .:....ZC#_0. 02a0 70 1d 60 57 7f 49 3a e4 78 cb c3 25 83 67 e0 08 p.`W.I:.x..%.g.. 02b0 c9 16 02 0b 3b 22 93 a7 e7 3e 47 d3 6c e1 6f 31 ....;"...>G.l.o1 02c0 47 a7 05 d7 72 c2 94 f3 fc 60 36 d7 d2 5d 6f 39 G...r....`6..]o9 02d0 c3 d3 63 30 16 c3 90 64 c0 74 ff 84 29 62 2e 88 ..c0...d.t..)b.. 02e0 f1 6a ac 67 5e 8f 61 8c eb 03 1a ea 4f 15 b1 4e .j.g^.a.....O..N 02f0 7c 25 c9 ba 88 e4 81 bd ba 3c 2c 88 06 cc 0e 35 |%.......<,....5 0300 30 46 8f e5 12 7e 53 22 9a 23 45 e1 39 7e 37 47 0F...~S".#E.9~7G 0310 b1 6b 5f 5f 30 60 83 10 03 0a 9b 0f d6 85 4c 62 .k__0`........Lb 0320 00 e3 2f f4 88 94 2f 91 aa ea 0d 73 ea bc c1 ac ../.../....s.... 0330 80 cb 29 57 39 02 2d 8d 5d 52 74 d7 5c ff d5 62 ..)W9.-.]Rt.\..b 0340 b5 a3 c2 4b 98 e6 ac 43 c5 2f b9 45 06 50 d8 3f ...K...C./.E.P.? 0350 b7 ed cd 98 01 5a d9 a6 1b 18 1f ed cd 55 8b b5 .....Z.......U.. 0360 90 df e0 7b 10 1f 86 d1 fb 4f 91 3f 5a 65 e3 f4 ...{.....O.?Ze.. 0370 33 e1 2b 35 17 53 df 9d 04 6e aa 89 ad b5 81 80 3.+5.S...n...... 0380 c3 b9 17 1f 48 a1 a8 72 49 5a 87 98 38 90 e8 4b ....H..rIZ..8..K 0390 76 f4 96 c3 7c 00 9c 4b a1 2f cc 2c ef 51 39 e4 v...|..K./.,.Q9. 03a0 f5 8a 0f 81 fb 12 d2 15 bb eb a1 09 3a 10 27 97 ............:.'. 03b0 17 d9 3b 76 3e f5 be fc 7f d7 46 a9 03 96 20 aa ..;v>.....F... . 03c0 5b 02 69 27 47 5a f9 78 fb 75 7b 50 84 ab 32 9f [.i'GZ.x.u{P..2. 03d0 6d b4 ef 81 a1 5d c9 fb bc b0 d1 5b e8 80 02 87 m....].....[.... 03e0 2e 17 f0 0b dc 89 64 87 e8 8a 06 44 c8 13 e8 21 ......d....D...! 03f0 83 94 75 20 20 5e 65 4d f4 0f e8 60 29 f2 d5 67 ..u ^eM...`)..g 0400 01 4d 47 bf 32 5f 47 a7 96 24 8a a5 16 2f 65 3b .MG.2_G..$.../e; 0410 7c cf 33 b5 50 ce 94 10 f7 33 1d 2e 70 e3 a7 3a |.3.P....3..p..: 0420 76 e2 a5 d9 86 a7 20 7e fe 10 89 12 e0 d7 b0 e7 v..... ~........ 0430 33 50 1a b9 e9 24 25 ca 32 19 6d eb 09 a0 67 cf 3P...$%.2.m...g. 0440 ef a1 77 8e 28 98 6d 19 37 62 2a 2b c9 98 51 36 ..w.(.m.7b*+..Q6 0450 d6 5b cc 6a c1 16 7f d1 a1 2c 8f 6c 73 61 14 fa .[.j.....,.lsa.. 0460 41 af 0d A.. Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 29 0f 5d 23 17 ...........).]#. 0020 cb e2 4b 21 96 f4 03 87 08 7f 58 de 73 2e 5e f6 ..K!......X.s.^. 0030 72 11 93 43 fa 82 2c 32 97 47 62 64 67 4a 0f 5a r..C..,2.GbdgJ.Z 0040 23 82 28 df ff 0a 3b 62 47 38 19 89 26 cc 91 d9 #.(...;bG8..&... 0050 3f 1b 17 7e 52 59 cf 8f 13 46 87 cc 45 d9 49 03 ?..~RY...F..E.I. 0060 a6 e5 bf ff fe 6e 1c ad 8d dd cd 53 20 28 35 ac .....n.....S (5. 0070 49 60 a0 cd d2 da ff e4 ca 4d 74 db 4c c0 2b 5f I`.......Mt.L.+_ 0080 76 26 1d bb 08 78 db 76 dc 0b 02 09 49 3b f1 4c v&...x.v....I;.L 0090 67 8e cf 64 44 51 5d 8c 06 a6 0d c0 29 6e 25 f1 g..dDQ].....)n%. 00a0 29 f7 1b e2 73 58 f0 22 8b 3d a6 64 45 be bf 1c )...sX.".=.dE... 00b0 03 bc 4b a1 28 06 6e 6f fc 8a 2f 64 7f 01 ad b6 ..K.(.no../d.... 00c0 04 63 ee 47 77 fa c7 77 b8 fc 6a c7 2c bc 8d 92 .c.Gw..w..j.,... 00d0 99 97 94 02 54 d1 47 d4 5a e0 68 9e dd d8 e3 bc ....T.G.Z.h..... 00e0 c7 0e 0c 0e fd 87 9f ed 8d a8 28 f9 25 2b 65 2b ..........(.%+e+ 00f0 ea f1 ce d2 d9 e3 51 be 91 31 af a1 5b 23 e7 05 ......Q..1..[#.. 0100 28 14 c3 37 bf f1 17 7c 4e b1 b5 fc 0d 14 ee bf (..7...|N....... 0110 79 a1 43 33 f2 c7 dd 2b 74 d3 48 cb 4c f5 23 dd y.C3...+t.H.L.#. 0120 0f d3 f8 47 48 1a 23 9b 91 43 73 64 8b 52 0e c3 ...GH.#..Csd.R.. 0130 76 8c 20 b6 d6 fa 86 c3 39 2b 48 f3 30 3a 8d 78 v. .....9+H.0:.x 0140 b2 34 bb f3 74 5e 06 11 1d c1 59 2e aa cd 04 2f .4..t^....Y..../ 0150 72 60 f5 5c 76 ce 73 ca 33 4d 74 ee b7 09 1b e9 r`.\v.s.3Mt..... 0160 26 04 e9 9b 50 30 a0 a8 75 ff 4b 21 a8 ff 21 a8 &...P0..u.K!..!. 0170 a6 39 58 32 db 22 61 61 10 9e 62 e8 c0 7e cb 6d .9X2."aa..b..~.m 0180 76 22 e0 b7 a8 ff be 19 b5 7f 41 03 a7 49 f2 ee v"........A..I.. 0190 1a 8c 01 25 30 d5 8e a7 c9 4c 01 75 30 fd 27 f1 ...%0....L.u0.'. 01a0 aa 16 18 e9 2b cd 42 26 47 8f e7 be ee 0b b4 3a ....+.B&G......: 01b0 04 c2 25 a0 d9 b8 e9 40 a0 10 b1 9d 96 07 11 74 ..%....@.......t 01c0 cf 6f 03 c1 70 d4 e0 65 2b 18 d1 59 f7 fa 1f 36 .o..p..e+..Y...6 01d0 2b 4f e2 95 4e 49 04 ed 99 0a 51 79 9d 47 46 5b +O..NI....Qy.GF[ 01e0 2c 4b ad 6e e5 10 ab cf c8 4b d1 2d 7c c3 f8 d5 ,K.n.....K.-|... 01f0 c2 54 59 9a f8 23 02 0d 1a 5b af b2 7e cb 41 83 .TY..#...[..~.A. 0200 ab a0 2e fa 6d be e0 b5 98 b3 a4 3a bb c1 ad c1 ....m......:.... 0210 67 e2 d0 81 65 98 10 fe ce fe 20 74 56 3e 13 27 g...e..... tV>.' 0220 a8 31 85 5e f9 86 e2 e7 1d be 91 2d a9 96 90 75 .1.^.......-...u 0230 5d 46 60 d2 cd 2e ac 86 27 9c c8 bc 95 e1 f3 33 ]F`.....'......3 0240 ba a6 52 8c e9 91 01 24 38 06 38 f9 43 3f 89 e5 ..R....$8.8.C?.. 0250 e8 65 77 94 4c 1f a3 f2 c2 51 d1 6e da 5a 61 b1 .ew.L....Q.n.Za. 0260 39 27 5c 6e 67 e2 10 e8 bd 74 af ef 42 86 95 12 9'\ng....t..B... 0270 89 6a 1f 3c 9e 4b 16 0a cd 8d 72 59 0e 17 78 d5 .j.<.K....rY..x. 0280 04 28 26 84 dd c1 d2 e9 61 10 e7 12 75 2c 1a d5 .(&.....a...u,.. 0290 94 91 23 88 2c 4e 12 19 bf ec 3a be 31 3f 5b 35 ..#.,N....:.1?[5 02a0 b7 d2 75 b2 8c 3f f4 ed d7 39 32 e0 71 cb ad 5a ..u..?...92.q..Z 02b0 2f 2e 16 3e 6a a6 37 29 60 da 22 82 0d c1 44 79 /..>j.7)`."...Dy 02c0 dd f9 27 44 29 85 fd a2 0f ba 4c 8a 5f c0 cd 3a ..'D).....L._..: 02d0 5e 0b 88 de c1 f9 55 24 36 17 b8 7b c3 1e 57 be ^.....U$6..{..W. 02e0 47 cd 5e d9 57 ba 3d 42 4f 32 4b da c4 42 ff 2a G.^.W.=BO2K..B.* 02f0 80 12 d3 3c 7e 36 41 67 30 a6 37 03 3b 3d ff 6f ...<~6Ag0.7.;=.o 0300 77 11 95 93 6e d2 e7 3e 00 fd 22 ce f5 3f 45 57 w...n..>.."..?EW 0310 38 36 6d 27 09 be 13 a1 a7 88 42 17 ab 9d c1 18 86m'......B..... 0320 9c 5f 92 a8 e6 1b 4d 2d a1 e8 04 4b 7a 4a 1c a7 ._....M-...KzJ.. 0330 cb 39 c5 c5 4c ff fa 09 0d 9c 37 be 92 1b 10 7e .9..L.....7....~ 0340 35 43 f2 e0 8c 7c 67 cc 76 b2 0d 62 d6 0c 07 41 5C...|g.v..b...A 0350 a5 8b 9b 08 22 d0 49 2c a1 4b 10 77 26 2e 3a 00 ....".I,.K.w&.:. 0360 74 66 65 0d d2 27 09 4d b2 f4 88 a4 1f 05 6c 5e tfe..'.M......l^ 0370 17 cd b8 e7 f1 ee 03 44 e5 c0 a9 40 39 61 80 4e .......D...@9a.N 0380 10 d0 8e b2 79 52 d0 cc 66 4e d0 d8 99 af e6 a2 ....yR..fN...... 0390 75 23 ac 77 29 88 33 e1 d0 d7 fc 2f ce ec 18 53 u#.w).3..../...S 03a0 1d 05 25 62 f2 f2 49 cb 99 b7 5e 25 d4 6e b1 3f ..%b..I...^%.n.? 03b0 d1 34 73 06 7b 8c 90 c2 98 f3 dc 0a 59 c0 f1 12 .4s.{.......Y... 03c0 f8 5c 41 4d ae 15 3f 70 db 9f 9a 00 46 b1 9e b7 .\AM..?p....F... 03d0 10 6c e9 68 a5 bd df 68 b1 e8 21 26 57 89 7c 8b .l.h...h..!&W.|. 03e0 9b 22 18 e0 14 7f d4 46 6f da b2 26 93 09 e7 54 .".....Fo..&...T 03f0 5a 5d b8 5b 9e 48 d3 1c 5a 9a 4e 04 58 92 c6 5a Z].[.H..Z.N.X..Z 0400 3c 28 ba ba 4b e4 da c1 a3 6a 16 98 82 97 be b7 <(..K....j...... 0410 23 e8 92 dc 24 4d 5d ec 53 c7 1c d4 7b fb c2 25 #...$M].S...{..% 0420 7f ef fb e0 fb 33 e1 52 ef fa c3 69 92 4d 73 0f .....3.R...i.Ms. 0430 8b bd b4 59 02 a6 27 c2 1d 63 81 ea a9 93 20 34 ...Y..'..c.... 4 0440 1c 57 79 2b cc 15 93 d2 c5 2e 50 e1 23 68 11 e5 .Wy+......P.#h.. 0450 6d e7 3c 7c f5 fb 67 25 b5 e4 74 fa 0b 44 d2 f4 m.<|..g%..t..D.. 0460 74 3d 60 f0 90 32 55 ea 0a 8e 6b 61 74 44 88 7a t=`..2U...katD.z 0470 10 13 fa 3f ad 62 64 7d 3c 6e 07 74 0e 9f e5 32 ...?.bd}6 04d0 7d 9d 24 14 73 cd ba 1f 42 07 67 8f 61 c2 8d f6 }.$.s...B.g.a... 04e0 1b 22 e2 b2 0f d9 5a 7c 05 f0 cb fa c8 de d5 06 ."....Z|........ 04f0 cb a2 e9 e1 0c bf 93 8b e7 e6 69 36 7e 48 fc f6 ..........i6~H.. 0500 2c 4f a9 ee 68 9b 14 b6 15 69 5d 8c a1 59 90 1a ,O..h....i]..Y.. 0510 56 da 18 c5 25 55 c1 03 b6 07 75 82 d7 21 cd d0 V...%U....u..!.. 0520 b2 e5 9e 9e 3b f9 43 de f2 02 a7 20 a1 38 56 9d ....;.C.... .8V. 0530 3d 63 11 44 d9 5d 67 79 19 65 f4 92 24 43 b1 9b =c.D.]gy.e..$C.. 0540 64 ca 0e 39 5c 7e 4c a2 8e d2 42 7c 30 a3 5a fd d..9\~L...B|0.Z. 0550 bd 97 7a 8b 62 b6 5d 52 b5 75 a7 5d 51 29 42 80 ..z.b.]R.u.]Q)B. 0560 2b 80 ee 83 9e 70 02 a7 55 b6 2d 93 1b c0 61 33 +....p..U.-...a3 0570 4d 92 cc 49 18 ca 21 1e 14 36 e2 1b e5 ed 30 a7 M..I..!..6....0. 0580 b7 9f 58 49 1c 3a a5 9e 4c df cb 1a 9a f1 1a be ..XI.:..L....... 0590 e6 4d ff 18 3f 09 a2 f7 f0 78 65 16 99 26 ca a8 .M..?....xe..&.. 05a0 44 cc 1f f8 20 14 76 47 d8 5e d8 8b 58 1d 4f 31 D... .vG.^..X.O1 05b0 0f 38 c1 ab 90 9b 95 3e 51 e1 3b 5f 83 5f 18 1c .8.....>Q.;_._.. 05c0 c1 48 82 6d eb a3 6b 38 77 1b 09 cb f4 d9 1e c2 .H.m..k8w....... 05d0 0b fb eb c5 02 30 0c 81 fe 71 ef 99 3b 5b 28 df .....0...q..;[(. 05e0 76 a4 eb c7 88 38 e5 10 85 5d f8 ed 08 53 13 4f v....8...]...S.O 05f0 43 5a 55 97 14 ea 71 08 c1 9f 7e bd 3e 1f d5 12 CZU...q...~.>... 0600 e5 6e 79 95 e1 e4 c4 85 dd 05 a5 cd d1 be 8a 3d .ny............= 0610 d4 4e 05 f2 54 27 2f ea a4 bc 47 ae 74 6d e8 c1 .N..T'/...G.tm.. 0620 33 60 b8 ab b2 ac 1c 24 88 b6 af 31 5e 4b 1f 14 3`.....$...1^K.. 0630 be a6 3e e1 83 71 8d 4d 41 b3 e5 ec 6a 13 d0 3d ..>..q.MA...j..= 0640 8d e1 82 f7 e0 30 28 58 05 3d 4c c0 6f 3a 4d e7 .....0(X.=L.o:M. 0650 1c 0b ab 33 7b b4 05 ef bd 65 01 53 27 39 11 a6 ...3{....e.S'9.. 0660 04 a0 2c 2e 34 b9 a1 b6 34 7c 2c 3e 03 ae 84 4e ..,.4...4|,>...N 0670 50 de db 86 00 8d 44 86 4e 00 59 e9 0a da e5 ec P.....D.N.Y..... 0680 32 80 6f ff 0a 9b 43 97 f3 1d 52 7a 0d 13 32 9c 2.o...C...Rz..2. 0690 e6 e9 2a af af 16 91 cc 86 eb a0 49 96 a0 27 22 ..*........I..'" 06a0 43 27 70 7b 24 a6 87 77 4d b1 c6 9a 98 9c 66 f3 C'p{$..wM.....f. 06b0 b9 62 e7 35 cd d6 e6 e5 77 07 d2 2b b0 42 4b ef .b.5....w..+.BK. 06c0 f3 d6 1c 86 bb ba 80 06 48 4c 06 ac 7a 74 d7 1e ........HL..zt.. 06d0 39 25 5a b4 82 8f fc b1 32 7a 27 f6 50 a0 ce ff 9%Z.....2z'.P... 06e0 60 a2 e8 16 51 e0 1a f3 76 58 89 ca b2 86 64 c7 `...Q...vX....d. 06f0 44 c9 d9 8e 78 c7 69 42 57 53 f0 2f 95 31 15 0d D...x.iBWS./.1.. 0700 df d1 de 1e 3f 26 ee ad 7e 85 80 1e 91 7c bd ff ....?&..~....|.. 0710 ea ca 9e 91 ea d7 97 69 91 8c b0 b5 b1 b1 c5 ab .......i........ 0720 b4 02 5d b5 a4 cb be f4 1a 6b b8 87 8f 68 86 0f ..]......k...h.. 0730 a7 6d 99 2a 4a c8 d1 5f 5e 90 49 ba b3 5b b3 84 .m.*J.._^.I..[.. 0740 47 4c 25 e1 ce 0b de 51 70 4b 88 8f 40 05 6a b9 GL%....QpK..@.j. 0750 ed 50 cc 79 b3 5d f2 01 cf d4 94 c1 32 26 91 19 .P.y.]......2&.. 0760 56 fd da e7 48 fa e8 43 b0 8c 2b d1 bf ef 48 59 V...H..C..+...HY 0770 e8 3a 18 5e ca 12 0e 4a 2c aa 1a 3d f9 5c 56 97 .:.^...J,..=.\V. 0780 95 ab 7d bb bc a8 cf cd 32 2a b2 d7 29 3d e3 52 ..}.....2*..)=.R 0790 fa 31 07 8f c1 cc 8d f6 d4 58 b5 b9 6c f3 1e 6a .1.......X..l..j 07a0 56 e3 e9 5b c9 69 0b 18 cc 1c 8e 3b 0d be 5d f4 V..[.i.....;..]. 07b0 f3 ad 96 03 27 80 d5 32 ec 9b 99 c2 e3 cc 37 36 ....'..2......76 07c0 8b 95 b4 40 00 86 af dc fd ad cf 2f e0 9e e5 a0 ...@......./.... 07d0 ca 1f 82 d2 31 b6 69 df 44 61 47 a4 93 0b 92 09 ....1.i.DaG..... 07e0 e3 a3 92 0d 30 77 5a 0d 96 d7 cc 6c 02 83 c9 32 ....0wZ....l...2 07f0 a2 ad 8a d8 c4 76 1f 27 12 3e 96 1f 49 83 71 29 .....v.'.>..I.q) 0800 d5 b6 65 b8 67 a1 d3 a5 a5 82 7b 5d 91 fe 66 22 ..e.g.....{]..f" 0810 d8 20 90 3a c7 90 e8 d2 5a 43 23 5f 30 9b 70 1d . .:....ZC#_0.p. 0820 60 57 7f 49 3a e4 78 cb c3 25 83 67 e0 08 c9 16 `W.I:.x..%.g.... 0830 02 0b 3b 22 93 a7 e7 3e 47 d3 6c e1 6f 31 47 a7 ..;"...>G.l.o1G. 0840 05 d7 72 c2 94 f3 fc 60 36 d7 d2 5d 6f 39 c3 d3 ..r....`6..]o9.. 0850 63 30 16 c3 90 64 c0 74 ff 84 29 62 2e 88 f1 6a c0...d.t..)b...j 0860 ac 67 5e 8f 61 8c eb 03 1a ea 4f 15 b1 4e 7c 25 .g^.a.....O..N|% 0870 c9 ba 88 e4 81 bd ba 3c 2c 88 06 cc 0e 35 30 46 .......<,....50F 0880 8f e5 12 7e 53 22 9a 23 45 e1 39 7e 37 47 b1 6b ...~S".#E.9~7G.k 0890 5f 5f 30 60 83 10 03 0a 9b 0f d6 85 4c 62 00 e3 __0`........Lb.. 08a0 2f f4 88 94 2f 91 aa ea 0d 73 ea bc c1 ac 80 cb /.../....s...... 08b0 29 57 39 02 2d 8d 5d 52 74 d7 5c ff d5 62 b5 a3 )W9.-.]Rt.\..b.. 08c0 c2 4b 98 e6 ac 43 c5 2f b9 45 06 50 d8 3f b7 ed .K...C./.E.P.?.. 08d0 cd 98 01 5a d9 a6 1b 18 1f ed cd 55 8b b5 90 df ...Z.......U.... 08e0 e0 7b 10 1f 86 d1 fb 4f 91 3f 5a 65 e3 f4 33 e1 .{.....O.?Ze..3. 08f0 2b 35 17 53 df 9d 04 6e aa 89 ad b5 81 80 c3 b9 +5.S...n........ 0900 17 1f 48 a1 a8 72 49 5a 87 98 38 90 e8 4b 76 f4 ..H..rIZ..8..Kv. 0910 96 c3 7c 00 9c 4b a1 2f cc 2c ef 51 39 e4 f5 8a ..|..K./.,.Q9... 0920 0f 81 fb 12 d2 15 bb eb a1 09 3a 10 27 97 17 d9 ..........:.'... 0930 3b 76 3e f5 be fc 7f d7 46 a9 03 96 20 aa 5b 02 ;v>.....F... .[. 0940 69 27 47 5a f9 78 fb 75 7b 50 84 ab 32 9f 6d b4 i'GZ.x.u{P..2.m. 0950 ef 81 a1 5d c9 fb bc b0 d1 5b e8 80 02 87 2e 17 ...].....[...... 0960 f0 0b dc 89 64 87 e8 8a 06 44 c8 13 e8 21 83 94 ....d....D...!.. 0970 75 20 20 5e 65 4d f4 0f e8 60 29 f2 d5 67 01 4d u ^eM...`)..g.M 0980 47 bf 32 5f 47 a7 96 24 8a a5 16 2f 65 3b 7c cf G.2_G..$.../e;|. 0990 33 b5 50 ce 94 10 f7 33 1d 2e 70 e3 a7 3a 76 e2 3.P....3..p..:v. 09a0 a5 d9 86 a7 20 7e fe 10 89 12 e0 d7 b0 e7 33 50 .... ~........3P 09b0 1a b9 e9 24 25 ca 32 19 6d eb 09 a0 67 cf ef a1 ...$%.2.m...g... 09c0 77 8e 28 98 6d 19 37 62 2a 2b c9 98 51 36 d6 5b w.(.m.7b*+..Q6.[ 09d0 cc 6a c1 16 7f d1 a1 2c 8f 6c 73 61 14 fa 41 af .j.....,.lsa..A. 09e0 0d . No. Time Source Destination Protocol Info 196 67.659879 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=6941 Ack=30778 Win=64240 Len=0 Frame 196 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6941, Ack: 30778, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 2a 40 00 80 06 bf 99 ac 1f 01 68 ac 1f .(.*@........h.. 0020 01 65 07 f0 01 85 d3 1c 21 ed 0b 68 cb b7 50 10 .e......!..h..P. 0030 fa f0 84 39 00 00 00 00 00 aa 60 81 ...9......`. No. Time Source Destination Protocol Info 197 67.661461 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (163 bytes) Frame 197 (267 bytes on wire, 267 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 6941, Ack: 30778, Len: 213 Lightweight Directory Access Protocol SASL Buffer Length: 209 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF12198455948D37A0A93A14B79E1900F1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 12198455948D37A0 krb5_sgn_cksum: A93A14B79E1900F1 krb5_confounder: 5A3C918F133FFBA9 GSS-API Encrypted payload (163 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fd e0 2b 40 00 80 06 be c3 ac 1f 01 68 ac 1f ...+@........h.. 0020 01 65 07 f0 01 85 d3 1c 21 ed 0b 68 cb b7 50 18 .e......!..h..P. 0030 fa f0 2b a3 00 00 00 00 00 d1 60 81 ce 06 09 2a ..+.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 12 19 84 55 94 8d 37 a0 a9 3a 14 b7 9e 19 00 f1 ...U..7..:...... 0060 5a 3c 91 8f 13 3f fb a9 20 70 ad 71 04 09 fa 45 Z<...?.. p.q...E 0070 c1 b7 4f 4b 6a d0 80 32 8d 0a cb e7 68 f2 89 f9 ..OKj..2....h... 0080 68 eb 0f 2d 7a a3 d3 1c 55 8d 77 46 9d 55 33 93 h..-z...U.wF.U3. 0090 e5 ec 73 d5 13 ea fd 88 b1 69 e6 b2 d6 d0 3f 8b ..s......i....?. 00a0 47 3f 12 92 4d 79 e3 4e a2 1e 79 d6 6a 96 17 8d G?..My.N..y.j... 00b0 a3 90 ae a4 40 4d c8 63 6a 49 27 76 44 52 3f e5 ....@M.cjI'vDR?. 00c0 05 09 33 75 ff 15 6d df 14 79 b2 13 15 81 5d 9a ..3u..m..y....]. 00d0 e5 75 ec 7e 20 2c 41 c3 c4 42 e2 90 10 c7 6f 9d .u.~ ,A..B....o. 00e0 31 31 97 6a a9 cd 73 c9 bd af 0d 03 b5 27 a2 41 11.j..s......'.A 00f0 e0 b2 89 7b 22 c3 e5 50 b8 60 0e aa 5b 7b 00 eb ...{"..P.`..[{.. 0100 9d 4d 67 8c 18 ec 81 02 70 b8 0e .Mg.....p.. No. Time Source Destination Protocol Info 198 67.663221 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (193 bytes) Frame 198 (297 bytes on wire, 297 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 30778, Ack: 7154, Len: 243 Lightweight Directory Access Protocol SASL Buffer Length: 239 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF411DEA8FDA9E55EAE6627E8FC275238... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F411DEA8FDA9E55E krb5_sgn_cksum: AE6627E8FC275238 krb5_confounder: 7B252C224FC1E36A GSS-API Encrypted payload (193 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 1b 2e 15 40 00 80 06 70 bc ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 cb b7 d3 1c 22 c2 50 18 .h.....h....".P. 0030 f7 d2 36 02 00 00 00 00 00 ef 60 81 ec 06 09 2a ..6.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 f4 11 de a8 fd a9 e5 5e ae 66 27 e8 fc 27 52 38 .......^.f'..'R8 0060 7b 25 2c 22 4f c1 e3 6a 24 a5 e4 a5 05 44 0c fa {%,"O..j$....D.. 0070 a5 ee 4b a4 7d 76 e5 5e f4 d6 bc 97 6e 62 cf 74 ..K.}v.^....nb.t 0080 c1 3e 96 bb 6d 75 86 60 14 14 1b 99 69 b5 06 13 .>..mu.`....i... 0090 f7 80 6d 93 50 f4 8c 2c f7 dd e4 16 68 66 4b 99 ..m.P..,....hfK. 00a0 e2 6b 56 f9 c3 0b 78 ee 7d 27 2c 90 77 96 51 a9 .kV...x.}',.w.Q. 00b0 45 b3 5c 08 af 6e 9b ef fa 5c b7 9f 3c d0 c7 0a E.\..n...\..<... 00c0 0c cc 47 2a 3e 84 bd 90 71 77 ee 86 8e b5 07 4a ..G*>...qw.....J 00d0 fb 70 d8 1c ab 8a 8f f2 f3 1d c4 c6 ac a6 e9 8a .p.............. 00e0 24 e7 00 f2 60 3f 7a 00 52 5f 13 d7 16 b1 7a b8 $...`?z.R_....z. 00f0 cc f7 82 1b e4 21 91 79 00 2c ac 51 43 d4 8d 7b .....!.y.,.QC..{ 0100 46 57 b0 7d 06 ff 8f 0d 10 48 f3 e0 82 30 d7 b9 FW.}.....H...0.. 0110 44 a3 6a b2 cb 55 0e 83 3b c3 4c 4b 04 4f 1f bb D.j..U..;.LK.O.. 0120 01 ac 0f 96 13 fe 6e ec c6 ......n.. No. Time Source Destination Protocol Info 199 67.664404 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (197 bytes) Frame 199 (301 bytes on wire, 301 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7154, Ack: 31021, Len: 247 Lightweight Directory Access Protocol SASL Buffer Length: 243 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF8F4F4F14A118FADFFDEFE24C0E3DC40E... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 8F4F4F14A118FADF krb5_sgn_cksum: FDEFE24C0E3DC40E krb5_confounder: C946FA97F2C371DB GSS-API Encrypted payload (197 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 1f e0 2c 40 00 80 06 be a0 ac 1f 01 68 ac 1f ...,@........h.. 0020 01 65 07 f0 01 85 d3 1c 22 c2 0b 68 cc aa 50 18 .e......"..h..P. 0030 f9 fd f8 ea 00 00 00 00 00 f3 60 81 f0 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 8f 4f 4f 14 a1 18 fa df fd ef e2 4c 0e 3d c4 0e .OO........L.=.. 0060 c9 46 fa 97 f2 c3 71 db e8 ac 26 e5 f8 3a c0 cc .F....q...&..:.. 0070 39 e7 8f 4c 5d 1d a9 86 18 c7 f8 01 89 ca 8b e4 9..L]........... 0080 52 4d 5f 62 b3 72 e7 10 39 50 24 bf 68 6f b9 ee RM_b.r..9P$.ho.. 0090 71 17 aa 7f 13 36 50 16 18 d6 21 f9 50 7d 63 ef q....6P...!.P}c. 00a0 27 65 ec 22 59 03 82 78 11 21 93 04 cb fa 64 b0 'e."Y..x.!....d. 00b0 54 82 71 ac 26 38 ed 4b d0 79 0e 15 dd 53 55 d9 T.q.&8.K.y...SU. 00c0 0e c6 7f f7 57 d2 8b 8a 79 23 ae 34 b0 fc 48 95 ....W...y#.4..H. 00d0 14 1a 1b 55 6e 6f d0 8a c4 27 07 f6 b3 64 30 25 ...Uno...'...d0% 00e0 cc 24 2d 85 20 8f 97 f1 1a bd 66 89 9d 29 ef eb .$-. .....f..).. 00f0 0e c2 b6 12 fd 2a 21 ed 7c 93 6d 5e 8c 80 51 95 .....*!.|.m^..Q. 0100 96 ee 6f c9 c0 96 23 9c a2 05 18 01 0d 3c 8d 17 ..o...#......<.. 0110 98 10 36 31 24 b2 85 e5 64 89 03 0e e6 12 fe 67 ..61$...d......g 0120 4e 61 eb d2 f0 21 45 ea 45 7c 70 c0 a4 Na...!E.E|p.. No. Time Source Destination Protocol Info 200 67.665555 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 200 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 31021, Ack: 7401, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 16 40 00 80 06 6b fa ac 1f 01 65 ac 1f ....@...k....e.. 0020 01 68 01 85 07 f0 0b 68 cc aa d3 1c 23 b9 50 10 .h.....h....#.P. 0030 f6 db ff b1 00 00 00 00 06 9e 60 82 06 9a 06 09 ..........`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff f4 2f 27 21 82 46 39 09 9f a4 04 05 ed 47 e9 ../'!.F9......G. 0060 c8 84 71 9e 4b f3 d2 b8 c2 9a a6 5e 43 fb c0 08 ..q.K......^C... 0070 40 92 41 fc d6 06 fa 33 60 49 59 f4 ba bf c2 01 @.A....3`IY..... 0080 d5 fd 1c 48 8f f2 af 46 e2 7a 51 ed 24 a9 c9 48 ...H...F.zQ.$..H 0090 af 45 da 6b 50 e5 9b a6 d4 c6 6a b8 78 79 55 25 .E.kP.....j.xyU% 00a0 6a e6 d1 05 fa 92 9b f7 ea 4d 4d 20 29 4e 9c c2 j........MM )N.. 00b0 65 db 77 32 1e a1 80 66 2f 02 27 d4 4e bb 03 92 e.w2...f/.'.N... 00c0 53 42 2b c4 63 e5 ad 7f 67 c0 58 01 5f fe 06 4a SB+.c...g.X._..J 00d0 52 0a a6 c0 e5 d2 1a 3d 87 44 05 5a fd b1 8d 63 R......=.D.Z...c 00e0 6d ef 8f f9 a6 15 36 6c 87 30 9e 8c 19 00 12 f6 m.....6l.0...... 00f0 d6 dc 1a 77 7d 41 24 0e e3 bd 9a 0c ba fb 9f 05 ...w}A$......... 0100 fd e9 3e a9 bb b8 94 df 5c 16 61 b0 ec 98 3d aa ..>.....\.a...=. 0110 1b 0b 42 a3 b1 f0 96 f4 ce ed 43 30 4e 5f 9f bc ..B.......C0N_.. 0120 f9 37 b9 0d d2 22 4d 06 12 50 7d f7 13 af 15 ba .7..."M..P}..... 0130 5c 57 9f de c9 38 5e de e7 bf f4 47 9f e4 93 39 \W...8^....G...9 0140 9f 29 b1 1a 2b 48 76 de b5 42 82 a5 d1 a3 91 86 .)..+Hv..B...... 0150 62 d2 71 28 1f 49 bc 69 e1 3a 7e 40 49 a7 22 5a b.q(.I.i.:~@I."Z 0160 33 c6 e7 e6 b7 02 b3 2e 59 8d 3a 3d 4c e0 dd 34 3.......Y.:=L..4 0170 a7 2d 1c ab 4f e9 d7 aa 22 70 9c af e6 9b 67 e0 .-..O..."p....g. 0180 00 86 a9 d1 4a 91 fd 8e c4 5a 06 26 2d 7e 6d 78 ....J....Z.&-~mx 0190 12 0a ec 7a 09 c5 ff 23 92 8e e6 c3 94 49 e0 8b ...z...#.....I.. 01a0 46 86 1d 36 9e f3 cb 88 4f fc 12 91 88 f1 35 38 F..6....O.....58 01b0 5b c3 57 1b 15 c2 ac 81 ff 93 2b 16 33 ce ed 74 [.W.......+.3..t 01c0 73 19 56 17 f0 65 83 65 25 56 2c fa 3b e6 ce 63 s.V..e.e%V,.;..c 01d0 97 b7 46 50 2d 20 a5 98 0a 13 3e 38 71 39 69 6d ..FP- ....>8q9im 01e0 a3 4f cd c3 b0 c4 25 e3 67 71 19 c5 11 f0 6f 52 .O....%.gq....oR 01f0 ec 90 87 a6 5c 73 5b e0 48 97 a1 89 ac 29 66 02 ....\s[.H....)f. 0200 ba 49 aa 65 ea 09 fd 40 c4 3b 81 7b 60 f1 d9 c4 .I.e...@.;.{`... 0210 a8 4c 1b 64 12 6d 60 2b f6 ab e9 d4 3a 8f 17 dd .L.d.m`+....:... 0220 be 01 66 52 4a fe 0c 4c c2 c3 03 89 13 1a 9a a4 ..fRJ..L........ 0230 e2 09 7c 6a c2 7c 71 3e 8a ec 8c 31 99 eb a3 1b ..|j.|q>...1.... 0240 2f 86 79 26 16 8e cd c7 ba f7 99 68 64 a0 66 3d /.y&.......hd.f= 0250 fe 06 03 64 ee 6d 29 f2 32 d9 35 3b bd 90 bd 7f ...d.m).2.5;.... 0260 4e 06 11 b2 93 4e 18 3b b3 97 38 28 e5 62 2b f7 N....N.;..8(.b+. 0270 42 3a 54 70 b5 0b 89 16 3b 99 dd 8e c4 f2 85 c6 B:Tp....;....... 0280 50 2f 6f 23 1e 91 93 bc 8b 7a 17 48 e7 52 29 c0 P/o#.....z.H.R). 0290 3d a7 5c 6a 56 c2 1b 7d 11 26 dc bb 5f 9e ee f5 =.\jV..}.&.._... 02a0 d9 22 5d 43 0c d7 c2 98 4e 95 26 1c 01 55 a4 9b ."]C....N.&..U.. 02b0 a3 cd d2 2f d6 c9 fa e7 40 d8 08 1d 73 88 8b c0 .../....@...s... 02c0 f2 ff 61 5c 17 d8 c6 b8 22 9b 27 34 aa 76 85 de ..a\....".'4.v.. 02d0 a6 7f c9 5a ea 71 08 76 4d fc 07 d0 29 0f 65 94 ...Z.q.vM...).e. 02e0 60 4f 10 7c 57 3b c4 93 09 70 1c 90 b5 81 f5 41 `O.|W;...p.....A 02f0 bf 86 10 a0 84 5e 18 c6 e2 6c 32 e4 79 45 5a e6 .....^...l2.yEZ. 0300 90 31 a4 6f f2 39 85 64 f3 f2 18 4e 8e 25 1c 73 .1.o.9.d...N.%.s 0310 2b be f1 33 88 32 ad 99 85 21 5c 7f 4d 3f 11 10 +..3.2...!\.M?.. 0320 5e 77 a5 a4 32 9f b4 4d 12 a5 34 d7 41 75 f0 6a ^w..2..M..4.Au.j 0330 81 c1 78 62 fd 6e e7 bb a6 c8 ab e2 24 7b 5e 94 ..xb.n......${^. 0340 d3 b5 01 84 c1 62 7c 53 b6 da 66 24 ff 68 27 a2 .....b|S..f$.h'. 0350 37 19 06 7e e8 af 0f bc 5e a5 85 21 02 ed 02 65 7..~....^..!...e 0360 e8 67 12 1a 12 81 cd a2 5d cb 33 85 a6 af f3 cf .g......].3..... 0370 6a df 86 4f 28 c3 f8 e3 d2 fe 36 bb 21 0c d8 d8 j..O(.....6.!... 0380 07 9c f5 c4 6f a7 9f 68 c7 b3 cb fa 6d ba b6 dc ....o..h....m... 0390 05 ba fc 2d a9 b0 d5 94 61 9b d5 1f 40 ee 00 ef ...-....a...@... 03a0 ea 35 40 ac 88 81 03 6d 58 ff dd e1 49 88 76 02 .5@....mX...I.v. 03b0 01 d8 9e b2 bf 0d ac 79 5b 4e 0e aa f5 8a 03 80 .......y[N...... 03c0 2b 84 17 16 d6 06 ff 53 2b 72 9c 4a 01 9f cb 3c +......S+r.J...< 03d0 ea c8 a8 ff ad d4 36 81 d7 45 d1 19 be bc 77 6a ......6..E....wj 03e0 94 7e 82 93 d0 88 6d f7 09 a5 8c da f9 e6 2c 51 .~....m.......,Q 03f0 1a d9 48 a9 32 2b ca 3c a9 a7 f9 d9 d2 28 f3 62 ..H.2+.<.....(.b 0400 51 ab 73 13 26 f9 fb e0 79 21 c3 bf c5 68 7a fb Q.s.&...y!...hz. 0410 5b 63 82 e6 37 63 fe 11 41 19 35 95 0d ee 6a a5 [c..7c..A.5...j. 0420 89 6d 97 60 03 65 81 f7 ea 53 1f 09 db d1 a2 25 .m.`.e...S.....% 0430 a9 97 c1 fd e3 20 15 42 48 8c ae 03 37 60 8f f6 ..... .BH...7`.. 0440 c9 c6 e9 8c fe d5 a1 3d 43 36 9d 49 04 1e f3 52 .......=C6.I...R 0450 f0 0b 9c 37 6e 89 0b a7 57 a1 e0 b2 d0 40 87 bd ...7n...W....@.. 0460 0a 68 57 ba 36 66 85 2b f7 aa 32 1a e2 62 94 50 .hW.6f.+..2..b.P 0470 0c c1 6d 13 3e 95 70 c2 2d 14 dc 84 f9 73 ec 62 ..m.>.p.-....s.b 0480 95 5e af 64 8f 43 5b 00 00 a0 65 57 81 a7 c7 1b .^.d.C[...eW.... 0490 46 80 ec 6b 1a 3f 45 b2 f2 c1 63 62 a2 5a 11 21 F..k.?E...cb.Z.! 04a0 a8 62 f2 e2 27 9d 06 f2 0a 95 2e 42 af 07 d2 a4 .b..'......B.... 04b0 d0 0e 3b 4a 45 85 73 d1 54 59 9c a0 5e 22 18 0f ..;JE.s.TY..^".. 04c0 54 c6 4b f5 03 7f ff 1d e0 c4 f7 68 32 ba 46 87 T.K........h2.F. 04d0 00 e7 70 b4 6e c2 80 ef 07 b8 e2 9c d8 7f 29 f2 ..p.n.........). 04e0 3f 37 26 42 a5 ca db 4a 8e b9 95 f2 7b 41 40 0b ?7&B...J....{A@. 04f0 17 37 bb fe f4 f3 cc b7 62 6c d8 b9 e4 89 09 35 .7......bl.....5 0500 b8 dd 34 ec 68 ba 5a 2d 6b 54 a3 40 69 af bd 08 ..4.h.Z-kT.@i... 0510 d1 cc 85 7d 43 c7 10 e0 4b f4 7f 06 4e e5 b5 2b ...}C...K...N..+ 0520 95 08 c1 93 25 68 dd 0f 52 49 1c 8d 57 3f 64 c6 ....%h..RI..W?d. 0530 0c 9a 09 80 43 76 f7 61 65 c4 58 14 1d 12 29 78 ....Cv.ae.X...)x 0540 07 90 4c 3e ab 37 e4 d7 10 bd 90 b4 47 51 6e 0b ..L>.7......GQn. 0550 d8 1c ad 3e 97 43 11 9e af f4 bd df 8b a0 e9 33 ...>.C.........3 0560 e7 de 8e d0 ad 3f b3 92 da 4a 4c d2 a7 4a c1 24 .....?...JL..J.$ 0570 86 01 0a 6b d3 df 5c b3 b4 66 0d bf de 06 f9 64 ...k..\..f.....d 0580 f0 cf a6 38 7b 80 8b ca a1 52 4a d5 93 5a 96 ab ...8{....RJ..Z.. 0590 e7 dd ca 34 60 1f 57 a4 bb bf b0 7f ce 7d 23 f3 ...4`.W......}#. 05a0 d0 8d 13 49 78 32 92 93 5d 91 9e ab 55 40 12 3a ...Ix2..]...U@.: 05b0 af 9a 92 d7 0b e0 f0 4e df 10 9a d8 bd 9f 9b c2 .......N........ 05c0 78 88 bb b6 8c 6f 6f 9b 10 78 ae 99 49 b6 2d e1 x....oo..x..I.-. 05d0 49 53 72 af e8 96 69 8c 47 8c 41 0f 18 a8 09 99 ISr...i.G.A..... 05e0 41 79 fe 97 83 00 80 92 ac e7 Ay........ No. Time Source Destination Protocol Info 201 67.666008 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1647 bytes) Frame 201 (292 bytes on wire, 292 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 32481, Ack: 7401, Len: 238 Lightweight Directory Access Protocol SASL Buffer Length: 1694 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF42F2721824639099FA40405ED47E9C8... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F42F272182463909 krb5_sgn_cksum: 9FA40405ED47E9C8 krb5_confounder: 84719E4BF3D2B8C2 GSS-API Encrypted payload (1647 bytes) Frame (292 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 16 2e 17 40 00 80 06 70 bf ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 d2 5e d3 1c 23 b9 50 18 .h.....h.^..#.P. 0030 f6 db d5 8b 00 00 bb 1e dc e1 67 e2 b8 b0 2a e0 ..........g...*. 0040 26 4c 4d 1a a9 aa 31 cf 62 00 fe da 81 6f 99 1b &LM...1.b....o.. 0050 66 d0 e9 a8 8d 3b e3 31 bd 4d b4 fc 73 d1 ca 90 f....;.1.M..s... 0060 1a 15 c7 79 bc 9b 92 07 63 5e 71 73 fb ce 54 4e ...y....c^qs..TN 0070 65 14 44 8c cf cc 56 f5 69 25 3a 42 85 5f 95 39 e.D...V.i%:B._.9 0080 f5 9e c9 cd e8 14 85 28 0b 8a 20 1e 45 a8 9a 57 .......(.. .E..W 0090 1c 68 68 8f e4 66 56 46 ea cd 4e 63 7b 51 0f 2a .hh..fVF..Nc{Q.* 00a0 13 ad 98 ec 8c 27 a5 05 e9 7c ec 4f 3e 4e f0 62 .....'...|.O>N.b 00b0 2f 3a a0 ac af 65 85 b3 29 c4 d6 62 6d c0 17 ab /:...e..)..bm... 00c0 82 cd 96 80 ac 6b 6b 8e a4 e3 68 67 a9 78 71 94 .....kk...hg.xq. 00d0 d9 e4 89 b7 83 92 bc cb 90 6b 40 ed 72 ae 47 c9 .........k@.r.G. 00e0 7e 9c ac bf b8 69 fc e5 56 9d ad b1 f5 74 9d 20 ~....i..V....t. 00f0 a4 55 10 d8 8c e0 7d 5f 48 3f a4 ad 16 b0 df 28 .U....}_H?.....( 0100 ab f9 2e a9 a1 51 3f fb 29 8a 17 bd e6 b8 30 27 .....Q?.).....0' 0110 1d f8 ff e6 3b 52 63 73 d9 b2 b8 90 e2 ca af 3d ....;Rcs.......= 0120 a0 d9 44 fa ..D. Reassembled TCP (1698 bytes): 0000 00 00 06 9e 60 82 06 9a 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff f4 2f 27 21 82 ............/'!. 0020 46 39 09 9f a4 04 05 ed 47 e9 c8 84 71 9e 4b f3 F9......G...q.K. 0030 d2 b8 c2 9a a6 5e 43 fb c0 08 40 92 41 fc d6 06 .....^C...@.A... 0040 fa 33 60 49 59 f4 ba bf c2 01 d5 fd 1c 48 8f f2 .3`IY........H.. 0050 af 46 e2 7a 51 ed 24 a9 c9 48 af 45 da 6b 50 e5 .F.zQ.$..H.E.kP. 0060 9b a6 d4 c6 6a b8 78 79 55 25 6a e6 d1 05 fa 92 ....j.xyU%j..... 0070 9b f7 ea 4d 4d 20 29 4e 9c c2 65 db 77 32 1e a1 ...MM )N..e.w2.. 0080 80 66 2f 02 27 d4 4e bb 03 92 53 42 2b c4 63 e5 .f/.'.N...SB+.c. 0090 ad 7f 67 c0 58 01 5f fe 06 4a 52 0a a6 c0 e5 d2 ..g.X._..JR..... 00a0 1a 3d 87 44 05 5a fd b1 8d 63 6d ef 8f f9 a6 15 .=.D.Z...cm..... 00b0 36 6c 87 30 9e 8c 19 00 12 f6 d6 dc 1a 77 7d 41 6l.0.........w}A 00c0 24 0e e3 bd 9a 0c ba fb 9f 05 fd e9 3e a9 bb b8 $...........>... 00d0 94 df 5c 16 61 b0 ec 98 3d aa 1b 0b 42 a3 b1 f0 ..\.a...=...B... 00e0 96 f4 ce ed 43 30 4e 5f 9f bc f9 37 b9 0d d2 22 ....C0N_...7..." 00f0 4d 06 12 50 7d f7 13 af 15 ba 5c 57 9f de c9 38 M..P}.....\W...8 0100 5e de e7 bf f4 47 9f e4 93 39 9f 29 b1 1a 2b 48 ^....G...9.)..+H 0110 76 de b5 42 82 a5 d1 a3 91 86 62 d2 71 28 1f 49 v..B......b.q(.I 0120 bc 69 e1 3a 7e 40 49 a7 22 5a 33 c6 e7 e6 b7 02 .i.:~@I."Z3..... 0130 b3 2e 59 8d 3a 3d 4c e0 dd 34 a7 2d 1c ab 4f e9 ..Y.:=L..4.-..O. 0140 d7 aa 22 70 9c af e6 9b 67 e0 00 86 a9 d1 4a 91 .."p....g.....J. 0150 fd 8e c4 5a 06 26 2d 7e 6d 78 12 0a ec 7a 09 c5 ...Z.&-~mx...z.. 0160 ff 23 92 8e e6 c3 94 49 e0 8b 46 86 1d 36 9e f3 .#.....I..F..6.. 0170 cb 88 4f fc 12 91 88 f1 35 38 5b c3 57 1b 15 c2 ..O.....58[.W... 0180 ac 81 ff 93 2b 16 33 ce ed 74 73 19 56 17 f0 65 ....+.3..ts.V..e 0190 83 65 25 56 2c fa 3b e6 ce 63 97 b7 46 50 2d 20 .e%V,.;..c..FP- 01a0 a5 98 0a 13 3e 38 71 39 69 6d a3 4f cd c3 b0 c4 ....>8q9im.O.... 01b0 25 e3 67 71 19 c5 11 f0 6f 52 ec 90 87 a6 5c 73 %.gq....oR....\s 01c0 5b e0 48 97 a1 89 ac 29 66 02 ba 49 aa 65 ea 09 [.H....)f..I.e.. 01d0 fd 40 c4 3b 81 7b 60 f1 d9 c4 a8 4c 1b 64 12 6d .@.;.{`....L.d.m 01e0 60 2b f6 ab e9 d4 3a 8f 17 dd be 01 66 52 4a fe `+....:.....fRJ. 01f0 0c 4c c2 c3 03 89 13 1a 9a a4 e2 09 7c 6a c2 7c .L..........|j.| 0200 71 3e 8a ec 8c 31 99 eb a3 1b 2f 86 79 26 16 8e q>...1..../.y&.. 0210 cd c7 ba f7 99 68 64 a0 66 3d fe 06 03 64 ee 6d .....hd.f=...d.m 0220 29 f2 32 d9 35 3b bd 90 bd 7f 4e 06 11 b2 93 4e ).2.5;....N....N 0230 18 3b b3 97 38 28 e5 62 2b f7 42 3a 54 70 b5 0b .;..8(.b+.B:Tp.. 0240 89 16 3b 99 dd 8e c4 f2 85 c6 50 2f 6f 23 1e 91 ..;.......P/o#.. 0250 93 bc 8b 7a 17 48 e7 52 29 c0 3d a7 5c 6a 56 c2 ...z.H.R).=.\jV. 0260 1b 7d 11 26 dc bb 5f 9e ee f5 d9 22 5d 43 0c d7 .}.&.._...."]C.. 0270 c2 98 4e 95 26 1c 01 55 a4 9b a3 cd d2 2f d6 c9 ..N.&..U...../.. 0280 fa e7 40 d8 08 1d 73 88 8b c0 f2 ff 61 5c 17 d8 ..@...s.....a\.. 0290 c6 b8 22 9b 27 34 aa 76 85 de a6 7f c9 5a ea 71 ..".'4.v.....Z.q 02a0 08 76 4d fc 07 d0 29 0f 65 94 60 4f 10 7c 57 3b .vM...).e.`O.|W; 02b0 c4 93 09 70 1c 90 b5 81 f5 41 bf 86 10 a0 84 5e ...p.....A.....^ 02c0 18 c6 e2 6c 32 e4 79 45 5a e6 90 31 a4 6f f2 39 ...l2.yEZ..1.o.9 02d0 85 64 f3 f2 18 4e 8e 25 1c 73 2b be f1 33 88 32 .d...N.%.s+..3.2 02e0 ad 99 85 21 5c 7f 4d 3f 11 10 5e 77 a5 a4 32 9f ...!\.M?..^w..2. 02f0 b4 4d 12 a5 34 d7 41 75 f0 6a 81 c1 78 62 fd 6e .M..4.Au.j..xb.n 0300 e7 bb a6 c8 ab e2 24 7b 5e 94 d3 b5 01 84 c1 62 ......${^......b 0310 7c 53 b6 da 66 24 ff 68 27 a2 37 19 06 7e e8 af |S..f$.h'.7..~.. 0320 0f bc 5e a5 85 21 02 ed 02 65 e8 67 12 1a 12 81 ..^..!...e.g.... 0330 cd a2 5d cb 33 85 a6 af f3 cf 6a df 86 4f 28 c3 ..].3.....j..O(. 0340 f8 e3 d2 fe 36 bb 21 0c d8 d8 07 9c f5 c4 6f a7 ....6.!.......o. 0350 9f 68 c7 b3 cb fa 6d ba b6 dc 05 ba fc 2d a9 b0 .h....m......-.. 0360 d5 94 61 9b d5 1f 40 ee 00 ef ea 35 40 ac 88 81 ..a...@....5@... 0370 03 6d 58 ff dd e1 49 88 76 02 01 d8 9e b2 bf 0d .mX...I.v....... 0380 ac 79 5b 4e 0e aa f5 8a 03 80 2b 84 17 16 d6 06 .y[N......+..... 0390 ff 53 2b 72 9c 4a 01 9f cb 3c ea c8 a8 ff ad d4 .S+r.J...<...... 03a0 36 81 d7 45 d1 19 be bc 77 6a 94 7e 82 93 d0 88 6..E....wj.~.... 03b0 6d f7 09 a5 8c da f9 e6 2c 51 1a d9 48 a9 32 2b m.......,Q..H.2+ 03c0 ca 3c a9 a7 f9 d9 d2 28 f3 62 51 ab 73 13 26 f9 .<.....(.bQ.s.&. 03d0 fb e0 79 21 c3 bf c5 68 7a fb 5b 63 82 e6 37 63 ..y!...hz.[c..7c 03e0 fe 11 41 19 35 95 0d ee 6a a5 89 6d 97 60 03 65 ..A.5...j..m.`.e 03f0 81 f7 ea 53 1f 09 db d1 a2 25 a9 97 c1 fd e3 20 ...S.....%..... 0400 15 42 48 8c ae 03 37 60 8f f6 c9 c6 e9 8c fe d5 .BH...7`........ 0410 a1 3d 43 36 9d 49 04 1e f3 52 f0 0b 9c 37 6e 89 .=C6.I...R...7n. 0420 0b a7 57 a1 e0 b2 d0 40 87 bd 0a 68 57 ba 36 66 ..W....@...hW.6f 0430 85 2b f7 aa 32 1a e2 62 94 50 0c c1 6d 13 3e 95 .+..2..b.P..m.>. 0440 70 c2 2d 14 dc 84 f9 73 ec 62 95 5e af 64 8f 43 p.-....s.b.^.d.C 0450 5b 00 00 a0 65 57 81 a7 c7 1b 46 80 ec 6b 1a 3f [...eW....F..k.? 0460 45 b2 f2 c1 63 62 a2 5a 11 21 a8 62 f2 e2 27 9d E...cb.Z.!.b..'. 0470 06 f2 0a 95 2e 42 af 07 d2 a4 d0 0e 3b 4a 45 85 .....B......;JE. 0480 73 d1 54 59 9c a0 5e 22 18 0f 54 c6 4b f5 03 7f s.TY..^"..T.K... 0490 ff 1d e0 c4 f7 68 32 ba 46 87 00 e7 70 b4 6e c2 .....h2.F...p.n. 04a0 80 ef 07 b8 e2 9c d8 7f 29 f2 3f 37 26 42 a5 ca ........).?7&B.. 04b0 db 4a 8e b9 95 f2 7b 41 40 0b 17 37 bb fe f4 f3 .J....{A@..7.... 04c0 cc b7 62 6c d8 b9 e4 89 09 35 b8 dd 34 ec 68 ba ..bl.....5..4.h. 04d0 5a 2d 6b 54 a3 40 69 af bd 08 d1 cc 85 7d 43 c7 Z-kT.@i......}C. 04e0 10 e0 4b f4 7f 06 4e e5 b5 2b 95 08 c1 93 25 68 ..K...N..+....%h 04f0 dd 0f 52 49 1c 8d 57 3f 64 c6 0c 9a 09 80 43 76 ..RI..W?d.....Cv 0500 f7 61 65 c4 58 14 1d 12 29 78 07 90 4c 3e ab 37 .ae.X...)x..L>.7 0510 e4 d7 10 bd 90 b4 47 51 6e 0b d8 1c ad 3e 97 43 ......GQn....>.C 0520 11 9e af f4 bd df 8b a0 e9 33 e7 de 8e d0 ad 3f .........3.....? 0530 b3 92 da 4a 4c d2 a7 4a c1 24 86 01 0a 6b d3 df ...JL..J.$...k.. 0540 5c b3 b4 66 0d bf de 06 f9 64 f0 cf a6 38 7b 80 \..f.....d...8{. 0550 8b ca a1 52 4a d5 93 5a 96 ab e7 dd ca 34 60 1f ...RJ..Z.....4`. 0560 57 a4 bb bf b0 7f ce 7d 23 f3 d0 8d 13 49 78 32 W......}#....Ix2 0570 92 93 5d 91 9e ab 55 40 12 3a af 9a 92 d7 0b e0 ..]...U@.:...... 0580 f0 4e df 10 9a d8 bd 9f 9b c2 78 88 bb b6 8c 6f .N........x....o 0590 6f 9b 10 78 ae 99 49 b6 2d e1 49 53 72 af e8 96 o..x..I.-.ISr... 05a0 69 8c 47 8c 41 0f 18 a8 09 99 41 79 fe 97 83 00 i.G.A.....Ay.... 05b0 80 92 ac e7 bb 1e dc e1 67 e2 b8 b0 2a e0 26 4c ........g...*.&L 05c0 4d 1a a9 aa 31 cf 62 00 fe da 81 6f 99 1b 66 d0 M...1.b....o..f. 05d0 e9 a8 8d 3b e3 31 bd 4d b4 fc 73 d1 ca 90 1a 15 ...;.1.M..s..... 05e0 c7 79 bc 9b 92 07 63 5e 71 73 fb ce 54 4e 65 14 .y....c^qs..TNe. 05f0 44 8c cf cc 56 f5 69 25 3a 42 85 5f 95 39 f5 9e D...V.i%:B._.9.. 0600 c9 cd e8 14 85 28 0b 8a 20 1e 45 a8 9a 57 1c 68 .....(.. .E..W.h 0610 68 8f e4 66 56 46 ea cd 4e 63 7b 51 0f 2a 13 ad h..fVF..Nc{Q.*.. 0620 98 ec 8c 27 a5 05 e9 7c ec 4f 3e 4e f0 62 2f 3a ...'...|.O>N.b/: 0630 a0 ac af 65 85 b3 29 c4 d6 62 6d c0 17 ab 82 cd ...e..)..bm..... 0640 96 80 ac 6b 6b 8e a4 e3 68 67 a9 78 71 94 d9 e4 ...kk...hg.xq... 0650 89 b7 83 92 bc cb 90 6b 40 ed 72 ae 47 c9 7e 9c .......k@.r.G.~. 0660 ac bf b8 69 fc e5 56 9d ad b1 f5 74 9d 20 a4 55 ...i..V....t. .U 0670 10 d8 8c e0 7d 5f 48 3f a4 ad 16 b0 df 28 ab f9 ....}_H?.....(.. 0680 2e a9 a1 51 3f fb 29 8a 17 bd e6 b8 30 27 1d f8 ...Q?.).....0'.. 0690 ff e6 3b 52 63 73 d9 b2 b8 90 e2 ca af 3d a0 d9 ..;Rcs.......=.. 06a0 44 fa D. No. Time Source Destination Protocol Info 202 67.666483 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=7401 Ack=32719 Win=64240 Len=0 Frame 202 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7401, Ack: 32719, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 2d 40 00 80 06 bf 96 ac 1f 01 68 ac 1f .(.-@........h.. 0020 01 65 07 f0 01 85 d3 1c 23 b9 0b 68 d3 4c 50 10 .e......#..h.LP. 0030 fa f0 7a d8 00 00 00 00 00 a0 60 81 ..z.......`. No. Time Source Destination Protocol Info 203 67.668084 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 203 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7401, Ack: 32719, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6FA6A99C500FCAB21B5A0B7F630B5326... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6FA6A99C500FCAB2 krb5_sgn_cksum: 1B5A0B7F630B5326 krb5_confounder: F56DB5BCE2EAB362 GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 2e 40 00 80 06 bf 2f ac 1f 01 68 ac 1f ....@..../...h.. 0020 01 65 07 f0 01 85 d3 1c 23 b9 0b 68 d3 4c 50 18 .e......#..h.LP. 0030 fa f0 fc e5 00 00 00 00 00 62 60 60 06 09 2a 86 .........b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 6f H..............o 0050 a6 a9 9c 50 0f ca b2 1b 5a 0b 7f 63 0b 53 26 f5 ...P....Z..c.S&. 0060 6d b5 bc e2 ea b3 62 de 82 75 6d be b9 94 17 b0 m.....b..um..... 0070 72 62 23 19 89 3e da f6 4d 40 31 dc 47 3b 60 e5 rb#..>..M@1.G;`. 0080 76 48 16 b4 a5 ef 46 51 2a a4 a7 b6 ec 81 68 30 vH....FQ*.....h0 0090 cd d2 0e 74 7f c0 f7 c9 8b a6 bd 1a ...t........ No. Time Source Destination Protocol Info 204 67.669054 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 204 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 32719, Ack: 7503, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 18 40 00 80 06 6b f8 ac 1f 01 65 ac 1f ....@...k....e.. 0020 01 68 01 85 07 f0 0b 68 d3 4c d3 1c 24 1f 50 10 .h.....h.L..$.P. 0030 f6 75 e4 5a 00 00 00 00 09 dd 60 82 09 d9 06 09 .u.Z......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 49 a7 fc 75 ab c7 ce 26 ba 79 d3 71 62 c8 b1 .I..u...&.y.qb.. 0060 b6 41 7c 0f 25 49 b9 9a 15 53 44 11 59 4e d5 8b .A|.%I...SD.YN.. 0070 c3 92 29 8d 6c 32 61 77 b8 6d be b2 56 ba bb a2 ..).l2aw.m..V... 0080 d8 e9 d7 0e 95 24 cb 83 b9 a6 94 d4 d7 7f 4b fa .....$........K. 0090 48 fd 71 cc 5d 4b 1a 40 e5 76 7d b8 74 81 59 c0 H.q.]K.@.v}.t.Y. 00a0 d3 d6 f9 ed d9 56 fd 7d 33 eb 6a 16 98 48 35 99 .....V.}3.j..H5. 00b0 46 01 1a 9c be de 66 24 15 0f c0 76 d7 e2 2d b4 F.....f$...v..-. 00c0 32 07 55 a2 03 56 45 71 68 ce 32 f1 a1 14 52 bb 2.U..VEqh.2...R. 00d0 c2 f6 1b 8d 9e 0c d4 0d cf 3f aa 90 6a 62 a3 b0 .........?..jb.. 00e0 fa 20 fb 48 3f 9e 30 41 17 78 cb da 5b ea 18 e6 . .H?.0A.x..[... 00f0 6d 69 bc 88 37 65 4a 4b aa 8c 71 df 55 29 4c 8e mi..7eJK..q.U)L. 0100 56 63 3c 60 aa c4 15 37 f3 6e 3a 7b 52 e8 41 43 Vc<`...7.n:{R.AC 0110 67 d0 8e da 4e b0 2d 21 4f c0 c8 bf e4 c0 c1 d9 g...N.-!O....... 0120 86 b0 08 8f a3 98 5a 46 c4 01 5e c8 f0 d0 eb 31 ......ZF..^....1 0130 8b 61 9b 1a dd 4a 97 88 ef e4 51 e3 f6 54 df 10 .a...J....Q..T.. 0140 01 4f 3a 5f 78 88 fa 23 9d 73 6a e1 eb a6 6e 8a .O:_x..#.sj...n. 0150 3c cc 8a 43 71 25 63 f0 b2 2d 0f 73 f1 aa f2 bc <..Cq%c..-.s.... 0160 57 56 cb 29 34 ce 84 d8 4a 94 86 9a 01 1f d0 2d WV.)4...J......- 0170 07 1d 91 ca 7c 67 bd 43 f2 48 13 67 79 07 a5 ca ....|g.C.H.gy... 0180 fb db 17 fd 37 af 69 3c 4e 6e 90 7a a3 29 c1 8b ....7.i.H 01f0 df ce 98 c0 c0 02 19 fe 12 ee ce 6b f2 ee b6 88 ...........k.... 0200 e4 c1 10 8a a4 40 8e a2 16 c4 fd 5a 31 ae 5c 4f .....@.....Z1.\O 0210 a5 ff 72 15 c6 bb 8f d2 c0 a5 1a 2f 21 bb 0c 59 ..r......../!..Y 0220 46 df 93 67 f0 16 fa f3 8c 84 8b 5b e1 a6 37 90 F..g.......[..7. 0230 ec dd 33 08 0c 9b 91 97 d8 2a c1 fa 1e 7e fe cd ..3......*...~.. 0240 ee 97 d3 4a 64 44 e0 04 69 8f 93 fc 69 dc 42 60 ...JdD..i...i.B` 0250 1b 9b 26 05 ba e1 48 ec 7d 68 d8 1d fb fc 5f c2 ..&...H.}h...._. 0260 45 c7 48 29 73 64 bb 80 b5 8a 57 f7 51 7f dc 11 E.H)sd....W.Q... 0270 b0 95 94 81 d4 ba 05 fe 6c e7 40 bb 04 d4 7e bc ........l.@...~. 0280 81 84 f1 19 14 48 97 74 73 88 fe 7f b2 6d 80 7d .....H.ts....m.} 0290 dd 77 ca f9 a3 43 c2 88 e4 a0 99 01 73 01 f8 9e .w...C......s... 02a0 41 2c 02 be e0 e9 c0 2b a1 3f b9 66 38 0a 03 2a A,.....+.?.f8..* 02b0 9f d9 4f 77 fd 5f 8e ca 44 65 4c e5 41 24 a7 89 ..Ow._..DeL.A$.. 02c0 85 53 4c 1e 52 a2 ba e6 0f 12 18 e3 15 43 2e 42 .SL.R........C.B 02d0 8c b0 f6 af 17 b6 82 0b c0 65 d9 bd 5e c3 d6 46 .........e..^..F 02e0 e5 c6 8b 5d 57 a1 bb e2 c8 b7 2f af 5d 41 1a 26 ...]W...../.]A.& 02f0 e1 4f f2 dc 0b f3 b4 66 de f0 f1 53 a9 92 70 e3 .O.....f...S..p. 0300 cf 0f a0 de 74 e8 77 b9 48 a6 dd aa e3 54 5d 8d ....t.w.H....T]. 0310 e7 2b 51 01 54 83 fb 55 61 9c 74 0e 8a 15 9b 8c .+Q.T..Ua.t..... 0320 d5 29 e5 26 23 df 8a da fc 88 5e cd 65 85 4f ec .).&#.....^.e.O. 0330 1a 90 2d 29 53 45 f8 97 04 64 5b e7 ce a1 e6 ed ..-)SE...d[..... 0340 91 41 c8 3e 32 5d c5 6b 54 90 8a a6 c8 7d bb f3 .A.>2].kT....}.. 0350 5b d5 34 35 72 60 aa 19 0b 12 f0 3d fb 17 bf 66 [.45r`.....=...f 0360 89 42 db 76 58 39 e8 94 d7 72 e6 3b 0a aa ff 90 .B.vX9...r.;.... 0370 b6 c9 34 d3 68 8b 45 26 81 88 6b a3 55 10 b4 15 ..4.h.E&..k.U... 0380 c2 f2 eb 7b 3a 0b fb 4e 30 8b d9 03 51 83 29 58 ...{:..N0...Q.)X 0390 71 2c 22 6b 50 9d 00 ae d2 01 82 f6 48 1f 82 47 q,"kP.......H..G 03a0 f5 37 c8 5c 94 4b 65 b1 5b 96 f6 9d 57 31 dc 57 .7.\.Ke.[...W1.W 03b0 64 dc 02 b8 d0 fe 98 fd ca 47 c9 56 04 95 6a dd d........G.V..j. 03c0 46 c1 d0 f9 40 8b 6a 3d 51 4a 48 79 e5 cf 1a bc F...@.j=QJHy.... 03d0 2f ec 6c 42 34 ee 99 e5 d9 73 57 b1 ee 97 2f 4c /.lB4....sW.../L 03e0 b9 52 3f 7f 7a 5f 02 0a 55 86 19 c0 06 82 b4 09 .R?.z_..U....... 03f0 e8 5e 73 26 ac 9f 06 73 c9 6a 7d 48 bb 6d 15 c6 .^s&...s.j}H.m.. 0400 20 0f 41 a9 3b 40 4f 6b f5 38 ad 01 49 8b a2 9e .A.;@Ok.8..I... 0410 e1 bc af 78 b8 20 1c fb 85 77 ac 0e 80 58 97 9e ...x. ...w...X.. 0420 d2 5b d9 9b f7 85 4e 15 f3 8c 32 62 41 eb 82 dd .[....N...2bA... 0430 d8 a6 91 a5 2b 54 8b e4 b6 16 63 a7 ea ae e6 63 ....+T....c....c 0440 d3 e6 88 de f8 71 d6 d7 52 5d 6d 9f 1e 16 a1 b4 .....q..R]m..... 0450 c3 10 bb ae 95 66 19 eb a8 eb 8b 47 48 d8 e8 8f .....f.....GH... 0460 fd a1 22 99 20 2d e7 d9 1e e4 9c bb 86 eb e0 0b ..". -.......... 0470 67 29 20 04 03 12 9c a8 eb 5d 6d 1c 2a f8 2a a3 g) ......]m.*.*. 0480 76 d5 81 88 6a ae 18 7c 4a 91 0f 2d d3 3a a0 b8 v...j..|J..-.:.. 0490 f7 07 f4 74 28 33 13 f3 9a e0 77 2f bc bf 21 2f ...t(3....w/..!/ 04a0 3e 41 0e 24 a7 c1 b1 62 c7 1b c7 ac d5 e1 dc 1a >A.$...b........ 04b0 10 dc 76 89 42 eb 48 f7 37 d2 eb a5 c7 36 a2 6b ..v.B.H.7....6.k 04c0 d8 31 12 4c a9 bb 16 a1 0f 21 d6 4c f5 88 02 49 .1.L.....!.L...I 04d0 4e 06 1e 05 fb 40 d7 f0 55 50 01 98 1c 99 1f 9c N....@..UP...... 04e0 80 11 f7 9b dd e0 42 71 ea 6f ba dd 7d 26 c0 ff ......Bq.o..}&.. 04f0 3c 2d 49 bd f0 b2 6a 1a e9 70 96 8d 5b 98 c4 ca <-I...j..p..[... 0500 29 fe af e1 16 e5 46 83 92 7e 90 15 ae d0 dd 36 ).....F..~.....6 0510 75 28 a2 c5 35 4f 4e 3c b8 4d ab 65 48 51 f3 10 u(..5ON<.M.eHQ.. 0520 32 9f b1 23 61 a0 01 fa 27 09 10 08 1a 21 f5 4b 2..#a...'....!.K 0530 41 bc 5e 62 0a 76 e6 39 9a 99 cd 6c 75 c3 f5 ee A.^b.v.9...lu... 0540 a4 4d 48 5a bd db 32 a7 31 92 6c 26 ce 2d 0d 67 .MHZ..2.1.l&.-.g 0550 6d 92 ee bd 16 61 57 23 11 d3 8b 19 f4 c6 44 ac m....aW#......D. 0560 5b c0 fc d4 0b a1 ce 7f ba d5 1e 97 5b b5 01 59 [...........[..Y 0570 8c bc e3 09 24 98 df bc 72 89 60 3b 31 a5 90 a6 ....$...r.`;1... 0580 6e 6e d4 ed f8 27 af fb fa 60 f3 32 82 4c e7 21 nn...'...`.2.L.! 0590 ae b2 18 a0 68 ff 25 25 92 e7 6f d7 35 42 f1 9a ....h.%%..o.5B.. 05a0 6b 33 b0 7b 1a 8a 2d 59 c9 05 26 c1 ed 28 b1 e3 k3.{..-Y..&..(.. 05b0 01 1e 48 35 6d a8 6f 2a 0f d7 d5 af 89 8d 8e 1d ..H5m.o*........ 05c0 3c ca 6d 6e f8 c5 f0 8b f5 a6 52 f1 e0 93 be 65 <.mn......R....e 05d0 ed f7 a2 5e 41 a5 3b 6c 07 ff 19 c0 eb ec a1 8f ...^A.;l........ 05e0 a1 17 c6 f7 06 05 05 7a 25 4d .......z%M No. Time Source Destination Protocol Info 205 67.669145 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 205 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 34179, Ack: 7503, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF49A7FC75ABC7CE26BA79D37162C8B1B6... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 49A7FC75ABC7CE26 krb5_sgn_cksum: BA79D37162C8B1B6 krb5_confounder: 417C0F2549B99A15 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2e 19 40 00 80 06 6d 7e ac 1f 01 65 ac 1f .U..@...m~...e.. 0020 01 68 01 85 07 f0 0b 68 d9 00 d3 1c 24 1f 50 18 .h.....h....$.P. 0030 f6 75 80 a1 00 00 92 cf df 43 93 28 74 a7 4e 41 .u.......C.(t.NA 0040 8f b1 88 8f 97 ef a4 fc 0c 27 87 61 bb b4 d1 84 .........'.a.... 0050 38 d3 1e 6f 9d ef 89 7a c1 dd a5 f9 84 ee 75 5f 8..o...z......u_ 0060 5f 32 4f 4f ff 43 28 c5 6b 46 80 6f 79 b5 03 10 _2OO.C(.kF.oy... 0070 30 2c e6 d4 30 d2 33 9d f8 c0 03 15 80 ea dc 28 0,..0.3........( 0080 af ae a4 d0 c0 b6 36 9f e7 2f 4a 5b 8e ae 3d dc ......6../J[..=. 0090 67 ac b0 96 dd 8f cf ab 71 2e b8 ef 80 04 d5 66 g.......q......f 00a0 79 4b 3c 68 b5 a5 b3 d7 9d 99 da 44 90 c1 8f d0 yKf%<...CCc8xG. 0200 2e fc a9 c5 a1 40 e7 64 a0 5d 19 f9 ec 1e f8 23 .....@.d.].....# 0210 b4 14 bb 9b cb 74 72 35 0a e7 2b ee 55 ba 5f 4b .....tr5..+.U._K 0220 40 79 13 d0 6b f9 34 47 65 85 95 e2 70 38 bf e0 @y..k.4Ge...p8.. 0230 a7 07 80 e6 38 b8 7e ef ff 40 f1 58 df f6 4f 5e ....8.~..@.X..O^ 0240 db c2 55 ad 89 11 e5 a2 6e 6f 3b ed 83 82 72 c1 ..U.....no;...r. 0250 f7 1a 0c 19 aa e1 69 1e ed 0a d6 55 51 dd f5 2e ......i....UQ... 0260 93 bb 94 6d cc 0d 44 5e a4 68 8f 3b 0d 10 61 04 ...m..D^.h.;..a. 0270 2a 79 36 a2 cf d0 6e 78 b3 0d 88 21 53 45 f0 18 *y6...nx...!SE.. 0280 09 0c 21 95 80 8b eb 36 ff 7d d7 40 e8 2d b7 70 ..!....6.}.@.-.p 0290 b6 1e 34 89 61 35 d8 34 39 5f 68 9a d6 95 3e 34 ..4.a5.49_h...>4 02a0 88 4f b5 e0 73 fa 88 92 11 16 ad 28 e5 ac 6c 8c .O..s......(..l. 02b0 77 b1 6d b2 9e ac 02 ea 9e da 69 da 21 08 36 75 w.m.......i.!.6u 02c0 4a 0c af 65 85 cd 4f 8b 8c f4 b4 98 9f ee 51 a9 J..e..O.......Q. 02d0 03 af bb 1d cc b2 15 61 41 fa 87 48 80 12 14 fa .......aA..H.... 02e0 f1 da a2 b1 71 8f 77 be ef ce 82 39 45 9f 1a 36 ....q.w....9E..6 02f0 34 a0 fc 22 2a 2e 51 05 68 28 9b 34 b4 c0 04 5f 4.."*.Q.h(.4..._ 0300 27 fe 2a 09 64 37 a4 c5 b5 5a 88 e2 ba 26 97 3a '.*.d7...Z...&.: 0310 a2 00 b3 31 e2 d5 b9 88 64 88 42 d7 92 18 d0 87 ...1....d.B..... 0320 15 bd a9 14 8b 21 50 fd 35 af d2 82 de c2 88 c0 .....!P.5....... 0330 2f 0c a9 5b 56 b4 2b 95 32 34 af c4 15 d1 ef ae /..[V.+.24...... 0340 2e 5a f4 c5 57 f3 19 48 fe 17 77 1f 5d 0c db 74 .Z..W..H..w.]..t 0350 f2 f7 4b d1 c0 65 96 70 2d d7 82 c8 7f 63 ab 90 ..K..e.p-....c.. 0360 c8 62 48 34 75 9e e1 81 ac f6 65 b7 d9 de 37 10 .bH4u.....e...7. 0370 a8 35 73 04 bd 78 ab 3c 2d 2f 70 f8 b1 94 61 ed .5s..x.<-/p...a. 0380 39 fe 3f b9 e4 d0 33 2d 4b 42 74 99 aa 39 5b ab 9.?...3-KBt..9[. 0390 b5 f6 63 bd b3 5b 28 a7 0e a8 22 e5 04 b1 cb 50 ..c..[(..."....P 03a0 f5 9a 08 f0 b6 7c 99 30 b3 d2 81 71 21 12 f7 7f .....|.0...q!... 03b0 12 f2 7c f5 13 e8 16 50 54 ef a0 f3 42 20 73 0f ..|....PT...B s. 03c0 55 5f 46 f1 39 c5 e9 9c f4 b9 03 ab 62 46 82 ff U_F.9.......bF.. 03d0 f7 29 14 3f 4e c6 1b 25 18 5c 6c 90 fd 7f 04 bd .).?N..%.\l..... 03e0 53 77 d5 93 b0 1e 00 0e 54 9d ec 3b ba 20 75 a7 Sw......T..;. u. 03f0 71 60 df 92 7d 5b a5 38 e7 86 f2 22 ab 29 af 7c q`..}[.8...".).| 0400 42 57 fc c1 a5 ac 92 31 0a 90 78 3c 3a b7 33 df BW.....1..x<:.3. 0410 3f 07 26 44 a5 8c 38 d4 6a cb 1b 06 52 41 d6 c1 ?.&D..8.j...RA.. 0420 84 91 33 15 6b ab 8a 71 8b 3c 5e c4 72 e9 c5 9a ..3.k..q.<^.r... 0430 a5 ba 91 3e 98 28 50 e7 ba e0 ae 43 36 78 77 a9 ...>.(P....C6xw. 0440 70 7a 72 fb ec ad f8 63 22 69 85 f0 46 87 ef 6c pzr....c"i..F..l 0450 18 0b a0 95 5c 16 a1 39 e1 4d 72 78 8a 59 d9 1f ....\..9.Mrx.Y.. 0460 39 a2 0a 9.. Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 49 a7 fc 75 ab ...........I..u. 0020 c7 ce 26 ba 79 d3 71 62 c8 b1 b6 41 7c 0f 25 49 ..&.y.qb...A|.%I 0030 b9 9a 15 53 44 11 59 4e d5 8b c3 92 29 8d 6c 32 ...SD.YN....).l2 0040 61 77 b8 6d be b2 56 ba bb a2 d8 e9 d7 0e 95 24 aw.m..V........$ 0050 cb 83 b9 a6 94 d4 d7 7f 4b fa 48 fd 71 cc 5d 4b ........K.H.q.]K 0060 1a 40 e5 76 7d b8 74 81 59 c0 d3 d6 f9 ed d9 56 .@.v}.t.Y......V 0070 fd 7d 33 eb 6a 16 98 48 35 99 46 01 1a 9c be de .}3.j..H5.F..... 0080 66 24 15 0f c0 76 d7 e2 2d b4 32 07 55 a2 03 56 f$...v..-.2.U..V 0090 45 71 68 ce 32 f1 a1 14 52 bb c2 f6 1b 8d 9e 0c Eqh.2...R....... 00a0 d4 0d cf 3f aa 90 6a 62 a3 b0 fa 20 fb 48 3f 9e ...?..jb... .H?. 00b0 30 41 17 78 cb da 5b ea 18 e6 6d 69 bc 88 37 65 0A.x..[...mi..7e 00c0 4a 4b aa 8c 71 df 55 29 4c 8e 56 63 3c 60 aa c4 JK..q.U)L.Vc<`.. 00d0 15 37 f3 6e 3a 7b 52 e8 41 43 67 d0 8e da 4e b0 .7.n:{R.ACg...N. 00e0 2d 21 4f c0 c8 bf e4 c0 c1 d9 86 b0 08 8f a3 98 -!O............. 00f0 5a 46 c4 01 5e c8 f0 d0 eb 31 8b 61 9b 1a dd 4a ZF..^....1.a...J 0100 97 88 ef e4 51 e3 f6 54 df 10 01 4f 3a 5f 78 88 ....Q..T...O:_x. 0110 fa 23 9d 73 6a e1 eb a6 6e 8a 3c cc 8a 43 71 25 .#.sj...n.<..Cq% 0120 63 f0 b2 2d 0f 73 f1 aa f2 bc 57 56 cb 29 34 ce c..-.s....WV.)4. 0130 84 d8 4a 94 86 9a 01 1f d0 2d 07 1d 91 ca 7c 67 ..J......-....|g 0140 bd 43 f2 48 13 67 79 07 a5 ca fb db 17 fd 37 af .C.H.gy.......7. 0150 69 3c 4e 6e 90 7a a3 29 c1 8b 70 8a ad dd 12 37 i.H...... 01c0 19 fe 12 ee ce 6b f2 ee b6 88 e4 c1 10 8a a4 40 .....k.........@ 01d0 8e a2 16 c4 fd 5a 31 ae 5c 4f a5 ff 72 15 c6 bb .....Z1.\O..r... 01e0 8f d2 c0 a5 1a 2f 21 bb 0c 59 46 df 93 67 f0 16 ...../!..YF..g.. 01f0 fa f3 8c 84 8b 5b e1 a6 37 90 ec dd 33 08 0c 9b .....[..7...3... 0200 91 97 d8 2a c1 fa 1e 7e fe cd ee 97 d3 4a 64 44 ...*...~.....JdD 0210 e0 04 69 8f 93 fc 69 dc 42 60 1b 9b 26 05 ba e1 ..i...i.B`..&... 0220 48 ec 7d 68 d8 1d fb fc 5f c2 45 c7 48 29 73 64 H.}h...._.E.H)sd 0230 bb 80 b5 8a 57 f7 51 7f dc 11 b0 95 94 81 d4 ba ....W.Q......... 0240 05 fe 6c e7 40 bb 04 d4 7e bc 81 84 f1 19 14 48 ..l.@...~......H 0250 97 74 73 88 fe 7f b2 6d 80 7d dd 77 ca f9 a3 43 .ts....m.}.w...C 0260 c2 88 e4 a0 99 01 73 01 f8 9e 41 2c 02 be e0 e9 ......s...A,.... 0270 c0 2b a1 3f b9 66 38 0a 03 2a 9f d9 4f 77 fd 5f .+.?.f8..*..Ow._ 0280 8e ca 44 65 4c e5 41 24 a7 89 85 53 4c 1e 52 a2 ..DeL.A$...SL.R. 0290 ba e6 0f 12 18 e3 15 43 2e 42 8c b0 f6 af 17 b6 .......C.B...... 02a0 82 0b c0 65 d9 bd 5e c3 d6 46 e5 c6 8b 5d 57 a1 ...e..^..F...]W. 02b0 bb e2 c8 b7 2f af 5d 41 1a 26 e1 4f f2 dc 0b f3 ..../.]A.&.O.... 02c0 b4 66 de f0 f1 53 a9 92 70 e3 cf 0f a0 de 74 e8 .f...S..p.....t. 02d0 77 b9 48 a6 dd aa e3 54 5d 8d e7 2b 51 01 54 83 w.H....T]..+Q.T. 02e0 fb 55 61 9c 74 0e 8a 15 9b 8c d5 29 e5 26 23 df .Ua.t......).&#. 02f0 8a da fc 88 5e cd 65 85 4f ec 1a 90 2d 29 53 45 ....^.e.O...-)SE 0300 f8 97 04 64 5b e7 ce a1 e6 ed 91 41 c8 3e 32 5d ...d[......A.>2] 0310 c5 6b 54 90 8a a6 c8 7d bb f3 5b d5 34 35 72 60 .kT....}..[.45r` 0320 aa 19 0b 12 f0 3d fb 17 bf 66 89 42 db 76 58 39 .....=...f.B.vX9 0330 e8 94 d7 72 e6 3b 0a aa ff 90 b6 c9 34 d3 68 8b ...r.;......4.h. 0340 45 26 81 88 6b a3 55 10 b4 15 c2 f2 eb 7b 3a 0b E&..k.U......{:. 0350 fb 4e 30 8b d9 03 51 83 29 58 71 2c 22 6b 50 9d .N0...Q.)Xq,"kP. 0360 00 ae d2 01 82 f6 48 1f 82 47 f5 37 c8 5c 94 4b ......H..G.7.\.K 0370 65 b1 5b 96 f6 9d 57 31 dc 57 64 dc 02 b8 d0 fe e.[...W1.Wd..... 0380 98 fd ca 47 c9 56 04 95 6a dd 46 c1 d0 f9 40 8b ...G.V..j.F...@. 0390 6a 3d 51 4a 48 79 e5 cf 1a bc 2f ec 6c 42 34 ee j=QJHy..../.lB4. 03a0 99 e5 d9 73 57 b1 ee 97 2f 4c b9 52 3f 7f 7a 5f ...sW.../L.R?.z_ 03b0 02 0a 55 86 19 c0 06 82 b4 09 e8 5e 73 26 ac 9f ..U........^s&.. 03c0 06 73 c9 6a 7d 48 bb 6d 15 c6 20 0f 41 a9 3b 40 .s.j}H.m.. .A.;@ 03d0 4f 6b f5 38 ad 01 49 8b a2 9e e1 bc af 78 b8 20 Ok.8..I......x. 03e0 1c fb 85 77 ac 0e 80 58 97 9e d2 5b d9 9b f7 85 ...w...X...[.... 03f0 4e 15 f3 8c 32 62 41 eb 82 dd d8 a6 91 a5 2b 54 N...2bA.......+T 0400 8b e4 b6 16 63 a7 ea ae e6 63 d3 e6 88 de f8 71 ....c....c.....q 0410 d6 d7 52 5d 6d 9f 1e 16 a1 b4 c3 10 bb ae 95 66 ..R]m..........f 0420 19 eb a8 eb 8b 47 48 d8 e8 8f fd a1 22 99 20 2d .....GH.....". - 0430 e7 d9 1e e4 9c bb 86 eb e0 0b 67 29 20 04 03 12 ..........g) ... 0440 9c a8 eb 5d 6d 1c 2a f8 2a a3 76 d5 81 88 6a ae ...]m.*.*.v...j. 0450 18 7c 4a 91 0f 2d d3 3a a0 b8 f7 07 f4 74 28 33 .|J..-.:.....t(3 0460 13 f3 9a e0 77 2f bc bf 21 2f 3e 41 0e 24 a7 c1 ....w/..!/>A.$.. 0470 b1 62 c7 1b c7 ac d5 e1 dc 1a 10 dc 76 89 42 eb .b..........v.B. 0480 48 f7 37 d2 eb a5 c7 36 a2 6b d8 31 12 4c a9 bb H.7....6.k.1.L.. 0490 16 a1 0f 21 d6 4c f5 88 02 49 4e 06 1e 05 fb 40 ...!.L...IN....@ 04a0 d7 f0 55 50 01 98 1c 99 1f 9c 80 11 f7 9b dd e0 ..UP............ 04b0 42 71 ea 6f ba dd 7d 26 c0 ff 3c 2d 49 bd f0 b2 Bq.o..}&..<-I... 04c0 6a 1a e9 70 96 8d 5b 98 c4 ca 29 fe af e1 16 e5 j..p..[...)..... 04d0 46 83 92 7e 90 15 ae d0 dd 36 75 28 a2 c5 35 4f F..~.....6u(..5O 04e0 4e 3c b8 4d ab 65 48 51 f3 10 32 9f b1 23 61 a0 N<.M.eHQ..2..#a. 04f0 01 fa 27 09 10 08 1a 21 f5 4b 41 bc 5e 62 0a 76 ..'....!.KA.^b.v 0500 e6 39 9a 99 cd 6c 75 c3 f5 ee a4 4d 48 5a bd db .9...lu....MHZ.. 0510 32 a7 31 92 6c 26 ce 2d 0d 67 6d 92 ee bd 16 61 2.1.l&.-.gm....a 0520 57 23 11 d3 8b 19 f4 c6 44 ac 5b c0 fc d4 0b a1 W#......D.[..... 0530 ce 7f ba d5 1e 97 5b b5 01 59 8c bc e3 09 24 98 ......[..Y....$. 0540 df bc 72 89 60 3b 31 a5 90 a6 6e 6e d4 ed f8 27 ..r.`;1...nn...' 0550 af fb fa 60 f3 32 82 4c e7 21 ae b2 18 a0 68 ff ...`.2.L.!....h. 0560 25 25 92 e7 6f d7 35 42 f1 9a 6b 33 b0 7b 1a 8a %%..o.5B..k3.{.. 0570 2d 59 c9 05 26 c1 ed 28 b1 e3 01 1e 48 35 6d a8 -Y..&..(....H5m. 0580 6f 2a 0f d7 d5 af 89 8d 8e 1d 3c ca 6d 6e f8 c5 o*........<.mn.. 0590 f0 8b f5 a6 52 f1 e0 93 be 65 ed f7 a2 5e 41 a5 ....R....e...^A. 05a0 3b 6c 07 ff 19 c0 eb ec a1 8f a1 17 c6 f7 06 05 ;l.............. 05b0 05 7a 25 4d 92 cf df 43 93 28 74 a7 4e 41 8f b1 .z%M...C.(t.NA.. 05c0 88 8f 97 ef a4 fc 0c 27 87 61 bb b4 d1 84 38 d3 .......'.a....8. 05d0 1e 6f 9d ef 89 7a c1 dd a5 f9 84 ee 75 5f 5f 32 .o...z......u__2 05e0 4f 4f ff 43 28 c5 6b 46 80 6f 79 b5 03 10 30 2c OO.C(.kF.oy...0, 05f0 e6 d4 30 d2 33 9d f8 c0 03 15 80 ea dc 28 af ae ..0.3........(.. 0600 a4 d0 c0 b6 36 9f e7 2f 4a 5b 8e ae 3d dc 67 ac ....6../J[..=.g. 0610 b0 96 dd 8f cf ab 71 2e b8 ef 80 04 d5 66 79 4b ......q......fyK 0620 3c 68 b5 a5 b3 d7 9d 99 da 44 90 c1 8f d0 5d a1 f%<...CCc8xG... 0780 a9 c5 a1 40 e7 64 a0 5d 19 f9 ec 1e f8 23 b4 14 ...@.d.].....#.. 0790 bb 9b cb 74 72 35 0a e7 2b ee 55 ba 5f 4b 40 79 ...tr5..+.U._K@y 07a0 13 d0 6b f9 34 47 65 85 95 e2 70 38 bf e0 a7 07 ..k.4Ge...p8.... 07b0 80 e6 38 b8 7e ef ff 40 f1 58 df f6 4f 5e db c2 ..8.~..@.X..O^.. 07c0 55 ad 89 11 e5 a2 6e 6f 3b ed 83 82 72 c1 f7 1a U.....no;...r... 07d0 0c 19 aa e1 69 1e ed 0a d6 55 51 dd f5 2e 93 bb ....i....UQ..... 07e0 94 6d cc 0d 44 5e a4 68 8f 3b 0d 10 61 04 2a 79 .m..D^.h.;..a.*y 07f0 36 a2 cf d0 6e 78 b3 0d 88 21 53 45 f0 18 09 0c 6...nx...!SE.... 0800 21 95 80 8b eb 36 ff 7d d7 40 e8 2d b7 70 b6 1e !....6.}.@.-.p.. 0810 34 89 61 35 d8 34 39 5f 68 9a d6 95 3e 34 88 4f 4.a5.49_h...>4.O 0820 b5 e0 73 fa 88 92 11 16 ad 28 e5 ac 6c 8c 77 b1 ..s......(..l.w. 0830 6d b2 9e ac 02 ea 9e da 69 da 21 08 36 75 4a 0c m.......i.!.6uJ. 0840 af 65 85 cd 4f 8b 8c f4 b4 98 9f ee 51 a9 03 af .e..O.......Q... 0850 bb 1d cc b2 15 61 41 fa 87 48 80 12 14 fa f1 da .....aA..H...... 0860 a2 b1 71 8f 77 be ef ce 82 39 45 9f 1a 36 34 a0 ..q.w....9E..64. 0870 fc 22 2a 2e 51 05 68 28 9b 34 b4 c0 04 5f 27 fe ."*.Q.h(.4..._'. 0880 2a 09 64 37 a4 c5 b5 5a 88 e2 ba 26 97 3a a2 00 *.d7...Z...&.:.. 0890 b3 31 e2 d5 b9 88 64 88 42 d7 92 18 d0 87 15 bd .1....d.B....... 08a0 a9 14 8b 21 50 fd 35 af d2 82 de c2 88 c0 2f 0c ...!P.5......./. 08b0 a9 5b 56 b4 2b 95 32 34 af c4 15 d1 ef ae 2e 5a .[V.+.24.......Z 08c0 f4 c5 57 f3 19 48 fe 17 77 1f 5d 0c db 74 f2 f7 ..W..H..w.]..t.. 08d0 4b d1 c0 65 96 70 2d d7 82 c8 7f 63 ab 90 c8 62 K..e.p-....c...b 08e0 48 34 75 9e e1 81 ac f6 65 b7 d9 de 37 10 a8 35 H4u.....e...7..5 08f0 73 04 bd 78 ab 3c 2d 2f 70 f8 b1 94 61 ed 39 fe s..x.<-/p...a.9. 0900 3f b9 e4 d0 33 2d 4b 42 74 99 aa 39 5b ab b5 f6 ?...3-KBt..9[... 0910 63 bd b3 5b 28 a7 0e a8 22 e5 04 b1 cb 50 f5 9a c..[(..."....P.. 0920 08 f0 b6 7c 99 30 b3 d2 81 71 21 12 f7 7f 12 f2 ...|.0...q!..... 0930 7c f5 13 e8 16 50 54 ef a0 f3 42 20 73 0f 55 5f |....PT...B s.U_ 0940 46 f1 39 c5 e9 9c f4 b9 03 ab 62 46 82 ff f7 29 F.9.......bF...) 0950 14 3f 4e c6 1b 25 18 5c 6c 90 fd 7f 04 bd 53 77 .?N..%.\l.....Sw 0960 d5 93 b0 1e 00 0e 54 9d ec 3b ba 20 75 a7 71 60 ......T..;. u.q` 0970 df 92 7d 5b a5 38 e7 86 f2 22 ab 29 af 7c 42 57 ..}[.8...".).|BW 0980 fc c1 a5 ac 92 31 0a 90 78 3c 3a b7 33 df 3f 07 .....1..x<:.3.?. 0990 26 44 a5 8c 38 d4 6a cb 1b 06 52 41 d6 c1 84 91 &D..8.j...RA.... 09a0 33 15 6b ab 8a 71 8b 3c 5e c4 72 e9 c5 9a a5 ba 3.k..q.<^.r..... 09b0 91 3e 98 28 50 e7 ba e0 ae 43 36 78 77 a9 70 7a .>.(P....C6xw.pz 09c0 72 fb ec ad f8 63 22 69 85 f0 46 87 ef 6c 18 0b r....c"i..F..l.. 09d0 a0 95 5c 16 a1 39 e1 4d 72 78 8a 59 d9 1f 39 a2 ..\..9.Mrx.Y..9. 09e0 0a . No. Time Source Destination Protocol Info 206 67.669419 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=7503 Ack=35248 Win=64240 Len=0 Frame 206 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7503, Ack: 35248, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 2f 40 00 80 06 bf 94 ac 1f 01 68 ac 1f .(./@........h.. 0020 01 65 07 f0 01 85 d3 1c 24 1f 0b 68 dd 2d 50 10 .e......$..h.-P. 0030 fa f0 70 91 00 00 02 04 05 b4 01 01 ..p......... No. Time Source Destination Protocol Info 207 67.670515 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 207 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7503, Ack: 35248, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF7B8A32B9C85EA28D827828E300DCD71B... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 7B8A32B9C85EA28D krb5_sgn_cksum: 827828E300DCD71B krb5_confounder: A21FFB56B13DB45A GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 30 40 00 80 06 bf 00 ac 1f 01 68 ac 1f ...0@........h.. 0020 01 65 07 f0 01 85 d3 1c 24 1f 0b 68 dd 2d 50 18 .e......$..h.-P. 0030 fa f0 f9 d6 00 00 00 00 00 8f 60 81 8c 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 7b 8a 32 b9 c8 5e a2 8d 82 78 28 e3 00 dc d7 1b {.2..^...x(..... 0060 a2 1f fb 56 b1 3d b4 5a d7 21 4f bf b3 dd ec 3c ...V.=.Z.!O....< 0070 2b f8 b7 5e ca 11 13 b3 bd 1b f9 ef 24 73 41 63 +..^........$sAc 0080 c0 ed 99 74 5e 74 ea 92 75 fe 63 e2 0f 6b 91 fd ...t^t..u.c..k.. 0090 c9 82 c6 85 af 06 0a dd 66 41 86 f6 f7 18 16 93 ........fA...... 00a0 4a 9d 6e cc 48 9a 47 0f cd 0f 43 00 8a e4 8b 9a J.n.H.G...C..... 00b0 ec 3b e5 f3 55 95 61 fe 06 99 69 7d c9 b7 21 c5 .;..U.a...i}..!. 00c0 34 95 29 ef 19 a8 0a 64 bc 4.)....d. No. Time Source Destination Protocol Info 208 67.671239 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 208 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 35248, Ack: 7650, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF8A2200BB6B5A8DED80359E765CBD21D5... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 8A2200BB6B5A8DED krb5_sgn_cksum: 80359E765CBD21D5 krb5_confounder: 41812D7D0FA73819 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 1a 40 00 80 06 70 f8 ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 dd 2d d3 1c 24 b2 50 18 .h.....h.-..$.P. 0030 f5 e2 a8 a3 00 00 00 00 00 ae 60 81 ab 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 8a 22 00 bb 6b 5a 8d ed 80 35 9e 76 5c bd 21 d5 ."..kZ...5.v\.!. 0060 41 81 2d 7d 0f a7 38 19 73 95 25 e2 50 cd fd a3 A.-}..8.s.%.P... 0070 83 cf 8b e2 30 21 6a 2f 45 09 fc f1 89 73 61 3b ....0!j/E....sa; 0080 d8 38 26 72 a4 95 a9 83 bb 24 f6 3b 0d d7 4d c3 .8&r.....$.;..M. 0090 bc f6 3d 87 02 66 01 96 82 28 7f 12 e6 5b d2 1a ..=..f...(...[.. 00a0 aa 12 52 d2 17 ea 34 7e f2 4e 23 81 fe 7b 38 2a ..R...4~.N#..{8* 00b0 2f 16 e7 04 25 ff 50 3e 4c 00 4e 5c fd 77 30 88 /...%.P>L.N\.w0. 00c0 78 f4 04 25 91 ab cd 66 a3 78 0c be 54 d2 07 b3 x..%...f.x..T... 00d0 00 e5 90 ef f8 90 8c 89 bc 57 e6 55 01 7f fb db .........W.U.... 00e0 1a 39 3d ec 99 e1 4d 07 .9=...M. No. Time Source Destination Protocol Info 209 67.695173 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (119 bytes) Frame 209 (223 bytes on wire, 223 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 7650, Ack: 35426, Len: 169 Lightweight Directory Access Protocol SASL Buffer Length: 165 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCB7EF5A1F4544054E911C968CA928A18... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CB7EF5A1F4544054 krb5_sgn_cksum: E911C968CA928A18 krb5_confounder: 267FBA6CCB9712A1 GSS-API Encrypted payload (119 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 d1 e0 31 40 00 80 06 be e9 ac 1f 01 68 ac 1f ...1@........h.. 0020 01 65 07 f0 01 85 d3 1c 24 b2 0b 68 dd df 50 18 .e......$..h..P. 0030 fa 3e c6 8b 00 00 00 00 00 a5 60 81 a2 06 09 2a .>........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 cb 7e f5 a1 f4 54 40 54 e9 11 c9 68 ca 92 8a 18 .~...T@T...h.... 0060 26 7f ba 6c cb 97 12 a1 1a 35 03 c7 34 0e 59 27 &..l.....5..4.Y' 0070 a3 78 ae 18 a8 33 12 26 f7 c7 7d 8d 40 d4 ce 50 .x...3.&..}.@..P 0080 3a f8 6d ee f4 5b af ba 34 e7 a9 ac 9c c8 33 c2 :.m..[..4.....3. 0090 e4 ee 00 f2 10 ed 83 1c 2b c8 18 3d 2c d6 79 a0 ........+..=,.y. 00a0 e2 16 2d de 88 98 72 32 3a f2 94 e4 87 97 4d 70 ..-...r2:.....Mp 00b0 e4 0a 15 4e 24 0a 5e be c5 96 d2 9a 60 54 aa bf ...N$.^.....`T.. 00c0 2c 1a 09 72 3d 6d 6a c3 33 a7 ec d0 69 d1 01 9f ,..r=mj.3...i... 00d0 da bd b5 b1 29 62 af 1e 8b e6 88 d7 bd 9d 8c ....)b......... No. Time Source Destination Protocol Info 210 67.696087 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (151 bytes) Frame 210 (255 bytes on wire, 255 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 35426, Ack: 7819, Len: 201 Lightweight Directory Access Protocol SASL Buffer Length: 197 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF44B9FDEFD7878A500DBB49A787F56722... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 44B9FDEFD7878A50 krb5_sgn_cksum: 0DBB49A787F56722 krb5_confounder: B8BCC6025A443DEC GSS-API Encrypted payload (151 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 f1 2e 1b 40 00 80 06 70 e0 ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 68 dd df d3 1c 25 5b 50 18 .h.....h....%[P. 0030 fa f0 91 7b 00 00 00 00 00 c5 60 81 c2 06 09 2a ...{......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 44 b9 fd ef d7 87 8a 50 0d bb 49 a7 87 f5 67 22 D......P..I...g" 0060 b8 bc c6 02 5a 44 3d ec d4 d7 2e ab 13 a8 34 fc ....ZD=.......4. 0070 3d d5 77 3b 15 30 5e da 7c 54 cb d1 05 b4 89 57 =.w;.0^.|T.....W 0080 5e 08 e3 82 0f 40 53 ea f3 c1 89 ab b5 f9 be d8 ^....@S......... 0090 75 9b c7 6b f3 bb a0 77 37 79 83 07 f1 13 5b cb u..k...w7y....[. 00a0 b5 00 04 4c 67 4f 0d 72 cc 8c ed 79 b7 60 2e 1c ...LgO.r...y.`.. 00b0 0c c0 bf 9c ad f8 86 a3 0b 10 c8 92 dd fe d8 0c ................ 00c0 8c a8 e4 f1 9d 79 53 9b 63 a3 a7 c7 f6 e6 dd 6a .....yS.c......j 00d0 28 8e 95 23 a5 57 a4 ca 36 84 8b d3 4b 86 16 05 (..#.W..6...K... 00e0 c9 85 d9 62 e3 3a 92 1f 48 db 51 3c 61 31 fe 54 ...b.:..H.Q..W.. 0120 66 3c 92 6e 37 cb 75 ec bf 21 9f ad e1 30 4d 45 f<.n7.u..!...0ME 0130 ff 8a 38 3b ed 37 9f 1a 90 e6 9e 00 b0 9b 2e cd ..8;.7.......... 0140 6f 70 34 c8 2f 88 f4 24 05 f5 b2 73 98 02 ee 76 op4./..$...s...v 0150 4b 6e 13 08 20 27 35 b2 4c 8a 2d 0a 95 b4 cd 02 Kn.. '5.L.-..... 0160 23 f4 64 a8 42 18 e3 a3 a2 e2 fe 84 fe 20 91 12 #.d.B........ .. 0170 ef 0b 53 31 4a fd 0d c0 db 86 d9 5a e9 7a 29 c6 ..S1J......Z.z). 0180 f5 6e .n No. Time Source Destination Protocol Info 212 67.709417 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (1342 bytes) Frame 212 (1447 bytes on wire, 1447 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 35627, Ack: 8151, Len: 1393 Lightweight Directory Access Protocol SASL Buffer Length: 1389 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE405F35A49EEEA0FEF8D9830186AB903... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E405F35A49EEEA0F krb5_sgn_cksum: EF8D9830186AB903 krb5_confounder: 525D94B202BBBDA8 GSS-API Encrypted payload (1342 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 99 2e 1c 40 00 80 06 6c 37 ac 1f 01 65 ac 1f ....@...l7...e.. 0020 01 68 01 85 07 f0 0b 68 de a8 d3 1c 26 a7 50 18 .h.....h....&.P. 0030 f9 a4 19 24 00 00 00 00 05 6d 60 82 05 69 06 09 ...$.....m`..i.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff e4 05 f3 5a 49 ee ea 0f ef 8d 98 30 18 6a b9 ....ZI......0.j. 0060 03 52 5d 94 b2 02 bb bd a8 b6 e0 05 84 d6 53 22 .R]...........S" 0070 e1 ed 7f b2 dc dd 66 b6 cf bc 74 6a 40 ec 5b 47 ......f...tj@.[G 0080 0c a6 5c ae f7 ca 4a d6 c7 6b 4f c1 65 18 dc 12 ..\...J..kO.e... 0090 e9 cd 55 b3 ca fb 5e 7b bf 3a 02 31 b1 3d 22 c3 ..U...^{.:.1.=". 00a0 61 e4 10 b8 6f 67 3c a1 b5 10 8a 75 de f4 17 84 a...og<....u.... 00b0 6e e6 c0 98 e1 77 9b 3e c6 3b b7 2c b1 39 7f 08 n....w.>.;.,.9.. 00c0 94 5f a8 f5 6c c1 f8 fe 4d a6 a1 f3 03 8a 05 e7 ._..l...M....... 00d0 b5 4f 9e b0 6a ad 56 23 d8 50 85 f7 16 71 a8 e4 .O..j.V#.P...q.. 00e0 0f 15 97 c3 62 a6 58 be c0 21 3a d8 76 35 10 d8 ....b.X..!:.v5.. 00f0 59 aa fb b9 1a d2 59 eb ed a7 87 75 92 eb 15 3e Y.....Y....u...> 0100 b4 88 67 0f 74 cb 25 6a 9f 41 f1 ea 5f 02 d2 e8 ..g.t.%j.A.._... 0110 af d5 1f ef 2f d0 0d 1a a3 eb b4 56 51 82 d0 df ..../......VQ... 0120 b5 67 2e f3 1e 25 20 46 63 47 13 68 24 fa 4f 31 .g...% FcG.h$.O1 0130 66 e7 62 fa fb 57 bd d3 4d 60 47 42 da a1 53 c9 f.b..W..M`GB..S. 0140 73 67 35 ab 42 52 43 4d ba 9e 08 70 e3 35 d3 2e sg5.BRCM...p.5.. 0150 b7 43 68 ec 83 6d 44 48 c6 ba 56 97 83 5a 43 70 .Ch..mDH..V..ZCp 0160 ad d5 a9 e1 4b 97 1a b1 ed 92 df 56 83 ac 27 67 ....K......V..'g 0170 ca 28 06 07 29 82 a5 4d cf a0 6a f5 13 ce 8a 2b .(..)..M..j....+ 0180 50 02 2d 09 10 f6 ba fb 5b 5b b6 b6 1d e7 98 45 P.-.....[[.....E 0190 5a a1 1f 65 83 43 81 52 53 24 cf 4e 4b 0a 1b 2c Z..e.C.RS$.NK.., 01a0 34 0a 2d b9 8a ea dc a9 1e be c4 3e 70 3f 85 05 4.-........>p?.. 01b0 16 38 a7 73 62 7c 5c 22 3a 54 fd 97 61 7a ff 54 .8.sb|\":T..az.T 01c0 97 7b 54 c2 c2 31 32 f0 2e 45 01 3c 4d 9d 2f 5b .{T..12..E.......... 0270 54 a8 e2 d8 b5 cc 5d 8e 2b 28 27 b3 14 23 dc 8c T.....].+('..#.. 0280 55 f0 ba 3d 87 b9 f2 1b a4 14 96 ba bb c8 68 7a U..=..........hz 0290 ce 18 72 21 7f 90 7a 24 f6 d0 d5 5b b1 b0 78 17 ..r!..z$...[..x. 02a0 d4 29 e9 e4 82 d2 e3 e1 cb 12 9f 8a 94 1a f0 9e .).............. 02b0 43 98 ea 00 95 d8 b0 fe 9c 35 79 c1 b6 a6 09 77 C........5y....w 02c0 27 e3 3d 3c 1b 26 83 6a 8f 0d 75 cc b3 da ea 4b '.=<.&.j..u....K 02d0 ce 44 a9 19 4a b3 ee ae c8 66 e9 43 eb e3 5e 6e .D..J....f.C..^n 02e0 06 37 60 bc dd dc 76 f0 ce f3 7a 28 b8 85 84 24 .7`...v...z(...$ 02f0 42 bf 04 44 74 0b 3c a0 66 ed 19 fc 52 c3 d2 60 B..Dt.<.f...R..` 0300 7d 3b ba f4 4b 19 fc 55 5f d5 1d 3f 0d 1a d3 c2 };..K..U_..?.... 0310 5d 2f 6e 5b 8e 80 fe 00 59 c8 52 f9 e5 d3 65 7d ]/n[....Y.R...e} 0320 0e 38 59 5b 66 1b c7 db dc 36 96 de 28 30 42 20 .8Y[f....6..(0B 0330 74 41 50 58 64 f4 00 8a 94 6e 9c 4d 4f c1 d3 3e tAPXd....n.MO..> 0340 33 10 14 0a 37 0f 7b f3 06 7c 28 88 53 8c 03 7c 3...7.{..|(.S..| 0350 2a 91 41 1b f9 0d ed ed a3 fc 77 6c f1 3b 31 75 *.A.......wl.;1u 0360 ca 0c 8e 2f 3d af 81 55 17 e7 6f f4 d2 3f 78 7b .../=..U..o..?x{ 0370 88 00 e3 f9 b8 a6 04 55 aa d6 d2 2f 2a e6 5b 2e .......U.../*.[. 0380 1c f2 be 11 67 4e c2 a5 94 7f 5f 6c a6 3f b9 10 ....gN...._l.?.. 0390 96 ba c5 8e da a4 c3 41 09 d3 9c e8 24 7d 59 81 .......A....$}Y. 03a0 32 92 80 0a 9e 1e 51 a1 35 69 af 00 03 7b eb 90 2.....Q.5i...{.. 03b0 33 78 d0 9b a4 0d bd c6 a0 68 f1 23 ec 02 8c 9c 3x.......h.#.... 03c0 01 30 fa 71 f1 37 d4 52 eb 23 40 d8 38 7d 14 78 .0.q.7.R.#@.8}.x 03d0 c4 16 45 9a 5d 9d 14 27 01 c8 9e fc a3 c1 6b 1a ..E.]..'......k. 03e0 9b 2e c2 24 d6 3e 41 3a dc 25 ec 4f bd 38 cb 68 ...$.>A:.%.O.8.h 03f0 46 02 b2 3f 32 08 b9 ef d1 b9 27 ed 4b 99 79 33 F..?2.....'.K.y3 0400 e5 49 0b af 6d a6 4c 1f 66 96 46 f6 74 de 1b 79 .I..m.L.f.F.t..y 0410 a6 a4 94 96 24 a2 a6 42 02 12 cf 03 71 83 2d a7 ....$..B....q.-. 0420 09 59 2e 46 64 76 bb 58 ec 22 a9 0a f6 00 50 10 .Y.Fdv.X."....P. 0430 f8 fc f6 a1 4b 43 b5 1d cd 39 19 fa 98 50 ce 52 ....KC...9...P.R 0440 10 dc 08 c6 4c e7 74 97 74 9d 34 b2 a1 5e dc 3b ....L.t.t.4..^.; 0450 84 bb bf 6e f9 77 a5 d2 58 84 66 66 51 2e 65 d6 ...n.w..X.ffQ.e. 0460 67 3e 6d 6a c6 fe f6 04 94 ee f2 84 ab 13 e9 b7 g>mj............ 0470 87 d3 00 71 3b 41 7b 3e 6f 0f 94 f9 4a 45 59 d8 ...q;A{>o...JEY. 0480 cf 72 8e f1 d0 33 ac 45 1d 34 c7 9d 60 94 3f 17 .r...3.E.4..`.?. 0490 c2 b5 03 68 5c 2c 4c 12 de 3a 39 3d fb 6f 12 bb ...h\,L..:9=.o.. 04a0 b6 4b bd 75 b9 75 d0 28 cd 86 28 df b8 dd d3 53 .K.u.u.(..(....S 04b0 ec 77 96 a2 91 b4 d4 f4 1e b3 ae 08 5f 30 01 1f .w.........._0.. 04c0 07 f2 3f 88 68 55 35 e0 44 f3 8a 08 b5 c5 5c 0e ..?.hU5.D.....\. 04d0 4a ae 80 f2 84 e4 21 67 b7 03 34 51 79 55 46 06 J.....!g..4QyUF. 04e0 3b 5b 1c 44 95 48 20 ae 9f d3 10 92 f9 8c 16 0a ;[.D.H ......... 04f0 96 20 ff 05 fa 7b 26 a0 78 7a e5 45 a6 bd eb ea . ...{&.xz.E.... 0500 52 b8 68 1e fd d2 ae 3d 52 c7 ce af 08 74 59 35 R.h....=R....tY5 0510 db f7 ed 21 59 83 6f 5a 79 5b 17 90 d9 74 73 db ...!Y.oZy[...ts. 0520 2d 47 06 39 a8 eb 47 52 1e a5 41 9f 77 90 76 59 -G.9..GR..A.w.vY 0530 44 f9 f1 10 3e 3f 68 8c 59 42 a6 b5 11 81 82 ee D...>?h.YB...... 0540 30 04 0e 43 ec f3 f2 b2 67 ac 40 d4 d9 93 88 18 0..C....g.@..... 0550 77 88 a0 c1 4e 8b 38 b3 99 db 84 9f 90 fe 49 c6 w...N.8.......I. 0560 60 ab bc 2e f9 02 d4 fa 7f 95 ca e4 3b 49 84 73 `...........;I.s 0570 45 eb 15 a1 30 cd 0d 4c 78 4e 00 69 64 22 37 18 E...0..LxN.id"7. 0580 49 93 3f 08 bf 30 19 ed 79 66 ec 9e 81 11 d7 7b I.?..0..yf.....{ 0590 f5 c6 c0 ea cd 28 42 b1 5f 63 d2 ec 60 8f d5 72 .....(B._c..`..r 05a0 14 0b 8a 07 69 f4 3a ....i.: No. Time Source Destination Protocol Info 213 67.711365 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 213 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8151, Ack: 37020, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF710E7A6097E332E8C5F6E98AE488620D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 710E7A6097E332E8 krb5_sgn_cksum: C5F6E98AE488620D krb5_confounder: 9BA8F0F9C0CA9B8B GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 33 40 00 80 06 bf 2a ac 1f 01 68 ac 1f ...3@....*...h.. 0020 01 65 07 f0 01 85 d3 1c 26 a7 0b 68 e4 19 50 18 .e......&..h..P. 0030 fa f0 6f 1d 00 00 00 00 00 62 60 60 06 09 2a 86 ..o......b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 71 H..............q 0050 0e 7a 60 97 e3 32 e8 c5 f6 e9 8a e4 88 62 0d 9b .z`..2.......b.. 0060 a8 f0 f9 c0 ca 9b 8b 48 81 40 4d 5c f2 eb dd 46 .......H.@M\...F 0070 5a ad 41 dc a5 21 45 5b 14 0a da 26 f7 e0 a9 2b Z.A..!E[...&...+ 0080 4b 4e d9 ac f0 d5 74 30 32 66 3b f2 5c 47 c7 35 KN....t02f;.\G.5 0090 83 b0 5a 52 25 e8 eb 29 6c 31 aa 73 ..ZR%..)l1.s No. Time Source Destination Protocol Info 214 67.712161 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 214 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 37020, Ack: 8253, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 1d 40 00 80 06 6b f3 ac 1f 01 65 ac 1f ....@...k....e.. 0020 01 68 01 85 07 f0 0b 68 e4 19 d3 1c 27 0d 50 10 .h.....h....'.P. 0030 f9 3e 59 9c 00 00 00 00 09 dd 60 82 09 d9 06 09 .>Y.......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 06 e2 72 be 56 fa 14 aa e9 3c ba 24 a1 30 21 ...r.V....<.$.0! 0060 77 0b 9e 43 8f ef a7 52 92 98 ae 6d 04 71 0e 35 w..C...R...m.q.5 0070 47 44 ad 70 e3 72 fe b4 52 de 63 c8 08 78 2b 64 GD.p.r..R.c..x+d 0080 4f f2 85 e1 5d 27 72 7b c7 5d 59 6a c0 6c 85 81 O...]'r{.]Yj.l.. 0090 6c eb ec 5b 86 9c a5 e1 cc 0d 1f bb ad 02 e4 6b l..[...........k 00a0 12 a0 88 64 11 68 83 58 ab f5 0d bb 25 74 88 d5 ...d.h.X....%t.. 00b0 73 75 71 65 ad 23 9a dc 4c 1a 46 6b 82 24 3a 42 suqe.#..L.Fk.$:B 00c0 d3 47 b0 31 74 3d 74 e2 7f b5 c9 4e 9b db 0d e6 .G.1t=t....N.... 00d0 d5 b9 92 62 c4 f0 03 2f b8 31 11 bf d2 99 8a 04 ...b.../.1...... 00e0 90 ea 24 ae 73 ca c0 4d e1 2c 6d 65 2d f8 44 9d ..$.s..M.,me-.D. 00f0 0a f4 cd 28 66 1d 82 8c 82 06 15 7c fd 63 39 26 ...(f......|.c9& 0100 b0 bb 11 97 ab bd 44 6c d8 92 15 33 b3 33 6a 3a ......Dl...3.3j: 0110 4d c2 b2 c6 eb 67 eb cb dd d7 7f cc 34 2b c4 3c M....g......4+.< 0120 26 a1 e8 5e 39 09 c3 84 bf b6 60 50 85 82 f3 fd &..^9.....`P.... 0130 d2 e5 d8 c0 8b 53 19 4b 41 7d e2 31 36 9d a2 01 .....S.KA}.16... 0140 a5 12 98 79 63 d9 db e8 29 af 81 a9 d9 c5 cd 85 ...yc...)....... 0150 fa 48 23 5f 81 b8 25 67 dd d8 a5 1f 0f 70 e7 1d .H#_..%g.....p.. 0160 54 11 4a 59 5e c5 f1 9a 4e e2 4f 62 98 ef ae f6 T.JY^...N.Ob.... 0170 57 99 0b 52 cc b2 4a a9 a0 e0 85 22 d3 60 18 d3 W..R..J....".`.. 0180 48 d4 07 8a b6 91 fc 9a 76 e3 46 a8 91 9b 01 75 H.......v.F....u 0190 ca 7a 2d a8 cb 2f 5c dc ed 27 58 f0 fd e4 2b 1b .z-../\..'X...+. 01a0 4f f9 5f cc 23 a3 11 65 60 1c 7f b1 36 68 c9 db O._.#..e`...6h.. 01b0 41 b4 86 a5 1c d9 fa 2c da 90 81 f7 52 bb 4e b7 A......,....R.N. 01c0 e6 47 43 34 7e 1e a4 70 71 d2 b2 e8 b6 40 53 ab .GC4~..pq....@S. 01d0 7c a2 19 45 bc 30 f1 80 cc 9a 77 ef dc a5 63 e5 |..E.0....w...c. 01e0 1c 18 1f 3e e3 69 39 e6 a8 ce 27 96 03 d6 4b 8c ...>.i9...'...K. 01f0 81 c1 cb 49 00 67 d8 c5 d3 3a d6 dd 4b 81 76 23 ...I.g...:..K.v# 0200 6c a9 3b 96 95 6e 72 00 c8 0f 6b 75 f5 34 9c 66 l.;..nr...ku.4.f 0210 39 be d5 5a 9a 6c 70 15 0d 9d f2 8b 02 91 28 bb 9..Z.lp.......(. 0220 96 52 36 44 58 f7 04 69 6d c2 ad 7a 09 6f 2e d6 .R6DX..im..z.o.. 0230 87 5e b1 97 c1 cb c4 33 8d 78 64 4d 9e 33 a0 60 .^.....3.xdM.3.` 0240 9f 3b 60 ef 2a 40 93 d4 08 73 53 43 aa 4b 24 31 .;`.*@...sSC.K$1 0250 f4 64 5c 7d bb f8 4c c4 23 75 7b b3 7f 11 16 05 .d\}..L.#u{..... 0260 ed 8f d9 77 56 88 9e 5d 49 c1 32 31 a2 cb 35 0a ...wV..]I.21..5. 0270 66 b2 45 2f d4 37 ec 89 ed 50 47 92 11 86 c8 fe f.E/.7...PG..... 0280 d1 14 b8 15 08 7b 1f be 1f bd 02 18 c5 f5 66 50 .....{........fP 0290 e0 57 ef 47 d4 2e f8 3f af fa ea cc 2b f4 35 13 .W.G...?....+.5. 02a0 b0 5a b2 72 d8 c4 d0 31 ba 52 16 ab 32 0f c4 de .Z.r...1.R..2... 02b0 4b ed 40 96 db cc d9 06 93 77 cd ce df 21 22 16 K.@......w...!". 02c0 01 16 31 78 f6 45 3c d4 40 de 51 74 d7 b8 23 dc ..1x.E<.@.Qt..#. 02d0 45 33 b0 b4 d1 11 54 27 d4 a0 a4 f6 09 a2 aa f4 E3....T'........ 02e0 ec c8 e0 a9 49 d7 7d e2 78 89 95 35 b3 f0 47 c0 ....I.}.x..5..G. 02f0 04 0c 85 fa 7b d5 16 a7 56 77 ef e1 fb b8 4d b8 ....{...Vw....M. 0300 fb 4b 8b 41 6a 71 1b dd c9 db e3 58 35 2f 0d 1d .K.Ajq.....X5/.. 0310 10 ff 93 06 3c 6e d5 c9 d7 41 38 8f 6a be 8d 59 ........|...f..%.. 0040 78 08 66 66 1c d6 9b a1 02 40 1c b3 a0 5e 80 e7 x.ff.....@...^.. 0050 ae 55 42 63 2d 43 1e 89 8d 95 2c 5d 25 15 9e aa .UBc-C....,]%... 0060 69 6e 39 cb 46 d5 1e c5 91 33 33 47 cd 06 4e ed in9.F....33G..N. 0070 4a 3b b7 d6 52 7a 52 ea b0 eb 4f 1f 86 8d 69 57 J;..RzR...O...iW 0080 56 9c 0b a8 d1 63 74 b3 64 bc 3b 19 9e af f1 eb V....ct.d.;..... 0090 61 21 51 f4 c7 8c d9 8c 14 a8 88 46 21 0c 1c 16 a!Q........F!... 00a0 57 17 ff 54 22 79 c7 68 23 e9 57 9d 97 14 2e b5 W..T"y.h#.W..... 00b0 e8 a1 6a f1 35 4b 8e 22 a2 e2 4f 2c 25 24 38 f4 ..j.5K."..O,%$8. 00c0 10 4a bf 94 a5 ea fa 5b ab 85 20 3c 12 95 e1 a9 .J.....[.. <.... 00d0 a9 81 aa 2f 85 dc 45 57 80 c2 c5 d4 41 38 d0 84 .../..EW....A8.. 00e0 9e 0c 8f 59 dd f9 29 74 56 8f a9 47 3b be 2e 00 ...Y..)tV..G;... 00f0 66 1c 4b 24 6b 72 cf bb cf 1a 61 5d 14 cb 06 9d f.K$kr....a].... 0100 ce f4 1e 20 39 38 2e 01 3e 1d b0 73 40 8f 33 40 ... 98..>..s@.3@ 0110 8f 8b a3 49 42 0d 77 ab 89 b5 8a 23 f3 04 4e a8 ...IB.w....#..N. 0120 e5 f1 68 ae 68 49 bd 29 b5 7b 92 78 49 02 0d 68 ..h.hI.).{.xI..h 0130 db f2 45 80 be 9d 2e 53 d3 5e 06 60 8e fa 21 2f ..E....S.^.`..!/ 0140 1c 9a e6 a8 c7 dd b3 66 a5 aa 69 0b 16 77 51 39 .......f..i..wQ9 0150 c8 81 55 89 e5 6f 11 82 89 4b eb f4 b2 76 c3 e4 ..U..o...K...v.. 0160 88 13 6a d8 4d 35 81 30 d1 cf 76 4d 80 3a c8 66 ..j.M5.0..vM.:.f 0170 cb e6 a1 e6 9d f1 03 36 ea 46 0d 5f dc 61 df 04 .......6.F._.a.. 0180 c8 ac 1d e6 0d ad bf c8 31 9f b6 5b 3a fd e2 db ........1..[:... 0190 9e 1a f3 2b af 9a 13 b8 6a 7e 1d 77 56 9b 4a 32 ...+....j~.wV.J2 01a0 96 c0 ea ec 93 cb 68 b4 d0 c5 f0 95 83 d3 6f f1 ......h.......o. 01b0 9b ab 94 6b 7f 57 61 79 17 46 72 cc 3d e1 e2 c0 ...k.Way.Fr.=... 01c0 cf 66 8e 6f 54 7d 81 dd 87 09 88 72 90 29 7f de .f.oT}.....r.).. 01d0 b4 7c 56 0b 3f 76 19 6e 98 f3 8f 20 dd 42 f7 9b .|V.?v.n... .B.. 01e0 fd 6f cf 8e b8 f9 21 d1 8b b2 3b e7 02 fe 1f 86 .o....!...;..... 01f0 87 6c 84 2c 3f c1 fd 38 64 14 1a c5 42 27 11 7c .l.,?..8d...B'.| 0200 3a 5a 9b bb 0a 48 b8 73 77 b3 0b ca c3 33 d0 43 :Z...H.sw....3.C 0210 95 2e c1 cc f3 10 e8 c4 48 5e 69 8c da aa 0a 07 ........H^i..... 0220 8d 26 dc c8 3f ca 1e 36 be 8e 35 2d 0b db 12 bd .&..?..6..5-.... 0230 e6 42 88 d0 88 c4 4d 37 71 eb df 3a 26 bd 09 5e .B....M7q..:&..^ 0240 6f 10 11 ea 49 8a 18 04 7a dc 1c 54 aa 1d 1d b4 o...I...z..T.... 0250 5c 94 70 ff 6f 26 04 b8 8b 42 65 56 66 3c 26 b3 \.p.o&...BeVf<&. 0260 e6 57 36 c8 4a 89 89 9d 7a 07 ee e1 90 2e 46 b5 .W6.J...z.....F. 0270 cd 24 0b 7b ef 2e 64 a3 9e a3 58 e7 f1 d6 5e ca .$.{..d...X...^. 0280 0a 74 09 cb 9b 14 8a 5e 7f c5 de f0 0b d9 75 81 .t.....^......u. 0290 27 54 b5 be 63 46 1f 5d 2e 74 da 80 3f b0 8f 32 'T..cF.].t..?..2 02a0 3b a5 a0 87 d2 e7 95 45 6f 73 8c a9 94 81 0f 9c ;......Eos...... 02b0 aa f9 f4 64 d6 ae d8 62 2b d0 ef c4 73 13 3d cf ...d...b+...s.=. 02c0 b9 4c 48 c8 cf 96 8f 43 89 31 b0 80 83 08 55 cd .LH....C.1....U. 02d0 95 a7 04 c0 04 4b 65 99 e3 c8 4a 3e 88 f4 2c 94 .....Ke...J>..,. 02e0 11 42 30 80 48 ad 14 46 81 49 48 02 c5 22 3e 02 .B0.H..F.IH..">. 02f0 61 15 4d e7 5e 72 13 a7 42 a5 8a 98 24 48 18 5c a.M.^r..B...$H.\ 0300 c6 a8 fe 94 59 86 20 0b 8c cc fa a4 a9 05 3f d6 ....Y. .......?. 0310 f7 e0 0d 12 3e 3a 23 70 5f 57 d3 2e fd 53 1d 7d ....>:#p_W...S.} 0320 11 e1 52 c8 b0 43 0c 49 9d 65 2d 5d 8a 42 ed c3 ..R..C.I.e-].B.. 0330 08 ee 2a 8b 14 43 51 af 7e a1 61 01 0e 6a 3f e1 ..*..CQ.~.a..j?. 0340 c8 90 59 00 97 f4 ed a9 c7 59 e3 09 d5 bd 82 7e ..Y......Y.....~ 0350 83 d0 61 89 ef 94 39 5a 0c a7 42 55 01 e6 03 23 ..a...9Z..BU...# 0360 22 4c 54 2a 32 b5 fc a7 bd 3e ec ec 13 89 77 ff "LT*2....>....w. 0370 ee 91 7c 62 a4 75 45 a2 1a 2c ae 98 81 25 44 36 ..|b.uE..,...%D6 0380 4e 49 87 76 e9 94 27 09 1f cc f2 14 f3 fb bc 76 NI.v..'........v 0390 a4 60 90 ae b2 68 56 9c a2 fe 91 83 d6 92 ba 1f .`...hV......... 03a0 b3 32 b3 9d ba 6c 74 07 8a e0 b5 50 34 2a 5d 4d .2...lt....P4*]M 03b0 26 ab 46 f9 62 97 79 18 37 69 80 ba 11 49 d4 c0 &.F.b.y.7i...I.. 03c0 81 6b 61 77 a2 b4 62 80 58 32 d3 49 35 fe e0 7f .kaw..b.X2.I5... 03d0 85 03 44 4e cf 49 b8 43 9e 2c ed aa 5c 26 94 dd ..DN.I.C.,..\&.. 03e0 85 5e dc 57 ef de 42 8e 22 24 83 d4 71 5c e9 f1 .^.W..B."$..q\.. 03f0 b4 68 aa a4 af d4 8f 41 83 02 13 38 ca 89 17 38 .h.....A...8...8 0400 ee af 5d 9e 71 eb 0e c2 27 79 99 42 1c 12 2d 85 ..].q...'y.B..-. 0410 00 fe 74 84 2c ab e1 bf 6a 60 10 a2 4b 53 5b 5f ..t.,...j`..KS[_ 0420 3d f4 10 4a fb 82 b1 e1 c2 18 15 8e 0c 0a c4 75 =..J...........u 0430 cd 53 a2 08 93 49 b1 ab 86 ba de 4c e8 fa f9 c7 .S...I.....L.... 0440 fe 4d bf 01 f5 2f 3c 70 10 2d 55 5f f7 70 ad eb .M.../.i 01b0 39 e6 a8 ce 27 96 03 d6 4b 8c 81 c1 cb 49 00 67 9...'...K....I.g 01c0 d8 c5 d3 3a d6 dd 4b 81 76 23 6c a9 3b 96 95 6e ...:..K.v#l.;..n 01d0 72 00 c8 0f 6b 75 f5 34 9c 66 39 be d5 5a 9a 6c r...ku.4.f9..Z.l 01e0 70 15 0d 9d f2 8b 02 91 28 bb 96 52 36 44 58 f7 p.......(..R6DX. 01f0 04 69 6d c2 ad 7a 09 6f 2e d6 87 5e b1 97 c1 cb .im..z.o...^.... 0200 c4 33 8d 78 64 4d 9e 33 a0 60 9f 3b 60 ef 2a 40 .3.xdM.3.`.;`.*@ 0210 93 d4 08 73 53 43 aa 4b 24 31 f4 64 5c 7d bb f8 ...sSC.K$1.d\}.. 0220 4c c4 23 75 7b b3 7f 11 16 05 ed 8f d9 77 56 88 L.#u{........wV. 0230 9e 5d 49 c1 32 31 a2 cb 35 0a 66 b2 45 2f d4 37 .]I.21..5.f.E/.7 0240 ec 89 ed 50 47 92 11 86 c8 fe d1 14 b8 15 08 7b ...PG..........{ 0250 1f be 1f bd 02 18 c5 f5 66 50 e0 57 ef 47 d4 2e ........fP.W.G.. 0260 f8 3f af fa ea cc 2b f4 35 13 b0 5a b2 72 d8 c4 .?....+.5..Z.r.. 0270 d0 31 ba 52 16 ab 32 0f c4 de 4b ed 40 96 db cc .1.R..2...K.@... 0280 d9 06 93 77 cd ce df 21 22 16 01 16 31 78 f6 45 ...w...!"...1x.E 0290 3c d4 40 de 51 74 d7 b8 23 dc 45 33 b0 b4 d1 11 <.@.Qt..#.E3.... 02a0 54 27 d4 a0 a4 f6 09 a2 aa f4 ec c8 e0 a9 49 d7 T'............I. 02b0 7d e2 78 89 95 35 b3 f0 47 c0 04 0c 85 fa 7b d5 }.x..5..G.....{. 02c0 16 a7 56 77 ef e1 fb b8 4d b8 fb 4b 8b 41 6a 71 ..Vw....M..K.Ajq 02d0 1b dd c9 db e3 58 35 2f 0d 1d 10 ff 93 06 3c 6e .....X5/........s@.3@.. 0690 a3 49 42 0d 77 ab 89 b5 8a 23 f3 04 4e a8 e5 f1 .IB.w....#..N... 06a0 68 ae 68 49 bd 29 b5 7b 92 78 49 02 0d 68 db f2 h.hI.).{.xI..h.. 06b0 45 80 be 9d 2e 53 d3 5e 06 60 8e fa 21 2f 1c 9a E....S.^.`..!/.. 06c0 e6 a8 c7 dd b3 66 a5 aa 69 0b 16 77 51 39 c8 81 .....f..i..wQ9.. 06d0 55 89 e5 6f 11 82 89 4b eb f4 b2 76 c3 e4 88 13 U..o...K...v.... 06e0 6a d8 4d 35 81 30 d1 cf 76 4d 80 3a c8 66 cb e6 j.M5.0..vM.:.f.. 06f0 a1 e6 9d f1 03 36 ea 46 0d 5f dc 61 df 04 c8 ac .....6.F._.a.... 0700 1d e6 0d ad bf c8 31 9f b6 5b 3a fd e2 db 9e 1a ......1..[:..... 0710 f3 2b af 9a 13 b8 6a 7e 1d 77 56 9b 4a 32 96 c0 .+....j~.wV.J2.. 0720 ea ec 93 cb 68 b4 d0 c5 f0 95 83 d3 6f f1 9b ab ....h.......o... 0730 94 6b 7f 57 61 79 17 46 72 cc 3d e1 e2 c0 cf 66 .k.Way.Fr.=....f 0740 8e 6f 54 7d 81 dd 87 09 88 72 90 29 7f de b4 7c .oT}.....r.)...| 0750 56 0b 3f 76 19 6e 98 f3 8f 20 dd 42 f7 9b fd 6f V.?v.n... .B...o 0760 cf 8e b8 f9 21 d1 8b b2 3b e7 02 fe 1f 86 87 6c ....!...;......l 0770 84 2c 3f c1 fd 38 64 14 1a c5 42 27 11 7c 3a 5a .,?..8d...B'.|:Z 0780 9b bb 0a 48 b8 73 77 b3 0b ca c3 33 d0 43 95 2e ...H.sw....3.C.. 0790 c1 cc f3 10 e8 c4 48 5e 69 8c da aa 0a 07 8d 26 ......H^i......& 07a0 dc c8 3f ca 1e 36 be 8e 35 2d 0b db 12 bd e6 42 ..?..6..5-.....B 07b0 88 d0 88 c4 4d 37 71 eb df 3a 26 bd 09 5e 6f 10 ....M7q..:&..^o. 07c0 11 ea 49 8a 18 04 7a dc 1c 54 aa 1d 1d b4 5c 94 ..I...z..T....\. 07d0 70 ff 6f 26 04 b8 8b 42 65 56 66 3c 26 b3 e6 57 p.o&...BeVf<&..W 07e0 36 c8 4a 89 89 9d 7a 07 ee e1 90 2e 46 b5 cd 24 6.J...z.....F..$ 07f0 0b 7b ef 2e 64 a3 9e a3 58 e7 f1 d6 5e ca 0a 74 .{..d...X...^..t 0800 09 cb 9b 14 8a 5e 7f c5 de f0 0b d9 75 81 27 54 .....^......u.'T 0810 b5 be 63 46 1f 5d 2e 74 da 80 3f b0 8f 32 3b a5 ..cF.].t..?..2;. 0820 a0 87 d2 e7 95 45 6f 73 8c a9 94 81 0f 9c aa f9 .....Eos........ 0830 f4 64 d6 ae d8 62 2b d0 ef c4 73 13 3d cf b9 4c .d...b+...s.=..L 0840 48 c8 cf 96 8f 43 89 31 b0 80 83 08 55 cd 95 a7 H....C.1....U... 0850 04 c0 04 4b 65 99 e3 c8 4a 3e 88 f4 2c 94 11 42 ...Ke...J>..,..B 0860 30 80 48 ad 14 46 81 49 48 02 c5 22 3e 02 61 15 0.H..F.IH..">.a. 0870 4d e7 5e 72 13 a7 42 a5 8a 98 24 48 18 5c c6 a8 M.^r..B...$H.\.. 0880 fe 94 59 86 20 0b 8c cc fa a4 a9 05 3f d6 f7 e0 ..Y. .......?... 0890 0d 12 3e 3a 23 70 5f 57 d3 2e fd 53 1d 7d 11 e1 ..>:#p_W...S.}.. 08a0 52 c8 b0 43 0c 49 9d 65 2d 5d 8a 42 ed c3 08 ee R..C.I.e-].B.... 08b0 2a 8b 14 43 51 af 7e a1 61 01 0e 6a 3f e1 c8 90 *..CQ.~.a..j?... 08c0 59 00 97 f4 ed a9 c7 59 e3 09 d5 bd 82 7e 83 d0 Y......Y.....~.. 08d0 61 89 ef 94 39 5a 0c a7 42 55 01 e6 03 23 22 4c a...9Z..BU...#"L 08e0 54 2a 32 b5 fc a7 bd 3e ec ec 13 89 77 ff ee 91 T*2....>....w... 08f0 7c 62 a4 75 45 a2 1a 2c ae 98 81 25 44 36 4e 49 |b.uE..,...%D6NI 0900 87 76 e9 94 27 09 1f cc f2 14 f3 fb bc 76 a4 60 .v..'........v.` 0910 90 ae b2 68 56 9c a2 fe 91 83 d6 92 ba 1f b3 32 ...hV..........2 0920 b3 9d ba 6c 74 07 8a e0 b5 50 34 2a 5d 4d 26 ab ...lt....P4*]M&. 0930 46 f9 62 97 79 18 37 69 80 ba 11 49 d4 c0 81 6b F.b.y.7i...I...k 0940 61 77 a2 b4 62 80 58 32 d3 49 35 fe e0 7f 85 03 aw..b.X2.I5..... 0950 44 4e cf 49 b8 43 9e 2c ed aa 5c 26 94 dd 85 5e DN.I.C.,..\&...^ 0960 dc 57 ef de 42 8e 22 24 83 d4 71 5c e9 f1 b4 68 .W..B."$..q\...h 0970 aa a4 af d4 8f 41 83 02 13 38 ca 89 17 38 ee af .....A...8...8.. 0980 5d 9e 71 eb 0e c2 27 79 99 42 1c 12 2d 85 00 fe ].q...'y.B..-... 0990 74 84 2c ab e1 bf 6a 60 10 a2 4b 53 5b 5f 3d f4 t.,...j`..KS[_=. 09a0 10 4a fb 82 b1 e1 c2 18 15 8e 0c 0a c4 75 cd 53 .J...........u.S 09b0 a2 08 93 49 b1 ab 86 ba de 4c e8 fa f9 c7 fe 4d ...I.....L.....M 09c0 bf 01 f5 2f 3c 70 10 2d 55 5f f7 70 ad eb 49 7d .../ ldap [ACK] Seq=8253 Ack=39549 Win=64240 Len=0 Frame 216 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8253, Ack: 39549, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 34 40 00 80 06 bf 8f ac 1f 01 68 ac 1f .(.4@........h.. 0020 01 65 07 f0 01 85 d3 1c 27 0d 0b 68 ed fa 50 10 .e......'..h..P. 0030 fa f0 5c d6 00 00 00 00 00 78 60 76 ..\......x`v No. Time Source Destination Protocol Info 217 67.714528 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (172 bytes) Frame 217 (276 bytes on wire, 276 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8253, Ack: 39549, Len: 222 Lightweight Directory Access Protocol SASL Buffer Length: 218 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF1A149818D64604B2E70D55756293F0B1... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 1A149818D64604B2 krb5_sgn_cksum: E70D55756293F0B1 krb5_confounder: 2CA71F165D1BFA8E GSS-API Encrypted payload (172 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 06 e0 35 40 00 80 06 be b0 ac 1f 01 68 ac 1f ...5@........h.. 0020 01 65 07 f0 01 85 d3 1c 27 0d 0b 68 ed fa 50 18 .e......'..h..P. 0030 fa f0 24 82 00 00 00 00 00 da 60 81 d7 06 09 2a ..$.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 1a 14 98 18 d6 46 04 b2 e7 0d 55 75 62 93 f0 b1 .....F....Uub... 0060 2c a7 1f 16 5d 1b fa 8e 27 e2 79 a1 52 b5 74 77 ,...]...'.y.R.tw 0070 6f 0b 72 d2 9c 0c a6 83 18 00 3c a3 bf f4 89 8c o.r.......<..... 0080 4b f2 ff 25 87 d6 a6 77 8e eb 57 f3 e4 74 47 2b K..%...w..W..tG+ 0090 12 84 6a 2a 02 a4 f3 44 85 3e c3 52 35 28 73 24 ..j*...D.>.R5(s$ 00a0 6e ec 17 58 3e 75 77 10 a3 96 fb a1 28 69 e7 4b n..X>uw.....(i.K 00b0 61 3a f0 39 85 2a 38 2a 31 00 15 16 94 ac f9 ff a:.9.*8*1....... 00c0 33 35 c4 c4 8e 27 1c 7d 41 cf e3 19 c9 80 a4 36 35...'.}A......6 00d0 d4 5c 82 27 f5 6a 53 84 6f af b0 12 cc 83 41 5f .\.'.jS.o.....A_ 00e0 4b aa be c8 34 c5 cc d0 1f da 8b a9 5a 98 78 7f K...4.......Z.x. 00f0 29 79 d1 df 61 83 46 6c d5 60 db 32 b1 69 2b 70 )y..a.Fl.`.2.i+p 0100 8e ff 99 80 26 40 82 65 b8 02 94 11 42 46 f6 a6 ....&@.e....BF.. 0110 f3 92 00 f9 .... No. Time Source Destination Protocol Info 218 67.732105 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (202 bytes) Frame 218 (306 bytes on wire, 306 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 39549, Ack: 8475, Len: 252 Lightweight Directory Access Protocol SASL Buffer Length: 248 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE8379C412A6FF86DFDBF60A9ED80E493... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E8379C412A6FF86D krb5_sgn_cksum: FDBF60A9ED80E493 krb5_confounder: 574542A9DF6386B0 GSS-API Encrypted payload (202 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 24 2e 1f 40 00 80 06 70 a9 ac 1f 01 65 ac 1f .$..@...p....e.. 0020 01 68 01 85 07 f0 0b 68 ed fa d3 1c 27 eb 50 18 .h.....h....'.P. 0030 f8 60 de c4 00 00 00 00 00 f8 60 81 f5 06 09 2a .`........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 e8 37 9c 41 2a 6f f8 6d fd bf 60 a9 ed 80 e4 93 .7.A*o.m..`..... 0060 57 45 42 a9 df 63 86 b0 9d 32 9f e2 c5 25 8c 1b WEB..c...2...%.. 0070 60 7a 22 b3 ea b2 d5 c0 4e b7 5d 6e b4 73 b3 db `z".....N.]n.s.. 0080 db 5d cb ae 9d 5d 10 31 a5 f4 13 54 0b 68 0c 7d .]...].1...T.h.} 0090 cc e9 d7 42 c8 74 26 92 8d bc ef b8 a9 2e c9 e1 ...B.t&......... 00a0 1d 57 e2 86 e1 6e 7b 8c c2 62 87 62 44 1c a0 19 .W...n{..b.bD... 00b0 5a c2 52 bd ea 98 31 82 cc 69 2d 2b 03 53 27 f6 Z.R...1..i-+.S'. 00c0 ac 11 ff 77 34 f5 fb 1d 7b 7c 9c 5a dc 26 1e 84 ...w4...{|.Z.&.. 00d0 6f f4 f2 67 19 82 1a 1e 9f 25 59 f0 dd 7c 1b bc o..g.....%Y..|.. 00e0 a0 31 3e ff 5b 6b f6 ac ea 02 9f fa 37 43 3c 41 .1>.[k......7C.. 00b0 7b 16 f5 b8 97 85 96 4e da e0 2e 65 b8 4a 88 ee {......N...e.J.. 00c0 58 8b c1 d6 92 a6 bf 03 7a 1c de 8a da 59 77 c2 X.......z....Yw. 00d0 3b b6 c5 03 dd d6 69 b5 b0 a4 1c cc 93 6b 67 a0 ;.....i......kg. 00e0 22 19 81 0f ce 37 ed 9e fd d4 a3 49 46 02 0c 0b "....7.....IF... 00f0 b6 d6 ca 12 b3 e7 92 5d 1a 11 d0 90 51 9a af 9b .......]....Q... 0100 57 00 27 f9 2a 0d 56 24 08 76 64 6a 79 44 2f f9 W.'.*.V$.vdjyD/. 0110 52 f7 c8 9f 0e 9a e0 a8 93 81 a6 71 95 e8 b3 c5 R..........q.... 0120 07 d9 6a 9a 65 e1 2a b3 ff 75 96 59 e5 e9 62 b2 ..j.e.*..u.Y..b. 0130 3b 61 59 75 11 f2 d2 23 12 f1 53 f8 4b d0 92 2b ;aYu...#..S.K..+ 0140 05 35 d4 df fe 8d c6 63 9c 82 a7 2e 61 a9 5d 62 .5.....c....a.]b 0150 d3 f4 e8 58 ec 35 e4 bd bb fd 08 f4 53 7f ba 86 ...X.5......S... 0160 cc e4 c5 c6 bc 15 be 5a f4 00 54 67 94 3d e1 0a .......Z..Tg.=.. 0170 01 8f 3e ef f5 25 bb f3 6d a1 f1 f4 f6 0d 61 5c ..>..%..m.....a\ 0180 08 14 f7 24 16 2b 75 23 fe 31 b6 4d 3d 6c 9f 6f ...$.+u#.1.M=l.o 0190 15 77 06 2b b5 bd 42 bc 0d 1e d2 8c 07 2c 46 ea .w.+..B......,F. 01a0 bb 1c 25 29 8a 9e 4c b7 3c 48 e9 23 96 ec 90 7d ..%)..L.?.6 0290 df fc de 75 af 27 8b e5 f5 e5 5c 94 60 6f e0 12 ...u.'....\.`o.. 02a0 d2 f3 f2 a3 bd c2 ff 08 5a d8 cc 61 fd 43 f6 b5 ........Z..a.C.. 02b0 f6 43 1d 9a 64 e8 44 64 66 df a4 bd 58 42 e9 56 .C..d.Ddf...XB.V 02c0 4b 4b e1 e1 c2 44 b0 08 11 6d 0e 95 eb 31 44 fa KK...D...m...1D. 02d0 81 db 40 1b be 1a 1c 2f 67 a2 a0 af 28 97 12 65 ..@..../g...(..e 02e0 66 72 ef bb 15 ec 6d 01 5a 78 48 36 16 c0 26 ac fr....m.ZxH6..&. 02f0 04 3a 12 1b 1a 16 12 d3 09 a4 80 1d a1 f1 10 43 .:.............C 0300 83 0b 3b dc 68 3c a6 d8 94 18 68 e4 54 8f 1b 27 ..;.h<....h.T..' 0310 8a bb dc 63 57 8c 79 c2 47 f0 f6 16 83 b4 c9 cc ...cW.y.G....... 0320 e7 fa 50 04 d8 5e 5e ab 8c e4 aa 6a c0 37 90 37 ..P..^^....j.7.7 0330 fa 55 f9 6c a4 56 a7 54 6e 24 c7 ac e5 45 32 2e .U.l.V.Tn$...E2. 0340 90 eb 81 fa 14 28 00 73 f8 f4 9f 31 7b 07 f3 b7 .....(.s...1{... 0350 71 fe de 9b c0 2d b0 cf d0 28 11 24 00 f9 04 f4 q....-...(.$.... 0360 f6 bd 28 41 b5 73 d3 d9 c5 b2 fe 8f a9 3f 1c 43 ..(A.s.......?.C 0370 1a 5f f5 47 f0 b4 6e 5f 39 7d 16 2b 7c 30 38 25 ._.G..n_9}.+|08% 0380 75 66 95 e3 ef 67 33 c7 5d 26 de 78 8b 38 ed 42 uf...g3.]&.x.8.B 0390 68 46 67 9a 7c d6 dc ca 8d 07 23 a5 33 55 84 a0 hFg.|.....#.3U.. 03a0 0c c1 b7 f3 69 e3 bf 62 c4 0f 9a b9 4c f3 9d 80 ....i..b....L... 03b0 51 1c 91 2b 2a d4 c8 d8 fb eb b8 44 80 a4 15 73 Q..+*......D...s 03c0 cf f0 87 e3 aa d2 86 e1 c4 b5 a1 43 19 66 a7 3c ...........C.f.< 03d0 52 8d e7 3c 0f 21 c3 92 20 99 c4 c1 0b a1 77 cc R..<.!.. .....w. 03e0 59 90 d3 04 a1 d0 9b 10 c6 c6 97 95 d9 3e 76 3d Y............>v= 03f0 3d 62 d9 a0 f5 7d 81 ed 83 60 ed c7 3b f7 14 f0 =b...}...`..;... 0400 db 85 e9 73 43 1f d6 05 aa 84 c5 d6 b3 92 6b bb ...sC.........k. 0410 de d7 2a ab 0f 1a 25 ce fa e2 92 3a 05 79 e2 98 ..*...%....:.y.. 0420 55 4f 10 26 68 60 6d 26 50 1b 34 58 73 b8 6e 31 UO.&h`m&P.4Xs.n1 0430 1e 90 f8 25 72 9b 09 1d 8c b3 b9 f8 bb b8 dc 3d ...%r..........= 0440 8e 08 b7 a5 91 a1 7f f5 79 eb 52 10 e8 ce bf 62 ........y.R....b 0450 fe 69 8c 91 60 6b 55 9f 2e 50 52 f7 08 ac 49 ee .i..`kU..PR...I. 0460 49 fd 9f b9 21 18 30 e8 38 3d 5b 95 71 49 f2 92 I...!.0.8=[.qI.. 0470 c4 93 41 7f 21 6f ec ef 89 58 46 0f fa 44 e4 74 ..A.!o...XF..D.t 0480 94 b8 1e 4b 7a c4 a6 c8 93 5b 67 55 98 ae 06 66 ...Kz....[gU...f 0490 ad ce 94 f9 a4 5a 25 85 7a bc e0 05 17 74 a3 3f .....Z%.z....t.? 04a0 62 b5 0a 26 a8 d4 76 69 da 2f 1d 9c 0f 18 ec c0 b..&..vi./...... 04b0 03 81 00 c2 f9 da 9a 3e 83 36 64 99 27 df c8 6e .......>.6d.'..n 04c0 ad 23 5d b5 6f 57 6f 5c 30 56 43 20 a0 ed 1c 57 .#].oWo\0VC ...W 04d0 ca e4 bc 2d 12 09 5a b4 8e 55 ef d3 f7 36 5a b3 ...-..Z..U...6Z. 04e0 7c 46 cb cd 94 8d 81 d1 02 d0 5c f3 1f 0a c5 8b |F........\..... 04f0 c1 cc 95 7a 24 31 f7 c0 29 59 77 bf e7 11 4b c8 ...z$1..)Yw...K. 0500 3d c8 1f 46 7a bf c5 0f 39 14 32 d7 dc 2b 38 c7 =..Fz...9.2..+8. 0510 82 51 90 e1 50 9d 95 9e ba a9 50 f8 65 41 91 d6 .Q..P.....P.eA.. 0520 8e 66 db 59 fa 21 78 7e 4e 98 ae f0 54 4b 6b fd .f.Y.!x~N...TKk. 0530 37 b9 4c 47 be 47 07 48 e7 b8 68 f4 45 8b 06 14 7.LG.G.H..h.E... 0540 f2 67 a6 46 88 68 23 51 d8 5d ea 62 f5 43 23 f2 .g.F.h#Q.].b.C#. 0550 83 d3 9d 07 fb e6 b7 c9 2f 55 56 3d 10 42 f6 e1 ......../UV=.B.. 0560 5a cc 9b ea af 12 57 40 ef 4e 57 b3 bb a0 f7 c6 Z.....W@.NW..... 0570 3e 25 6a 8b 11 30 c8 4e 09 3b 73 ef 0e a4 34 f7 >%j..0.N.;s...4. 0580 92 c0 64 e8 b9 42 82 60 98 cc 92 06 96 de 3c 62 ..d..B.`........ 0120 c9 71 86 9e 3a da 7a 0d 09 11 94 1c 0f 85 b2 e8 .q..:.z......... 0130 e3 7a 69 c6 4c 75 4a 63 48 36 f0 2f 2f 76 d8 10 .zi.LuJcH6.//v.. 0140 79 ab c0 fa 2f d5 f8 3e ac 26 92 fb 8e 75 27 54 y.../..>.&...u'T 0150 6c 33 b9 79 de ca d8 50 48 c6 2b 89 ed e5 21 b6 l3.y...PH.+...!. 0160 98 8b e7 ec f1 7f b9 28 7e c3 4a ba c3 64 5f 49 .......(~.J..d_I 0170 03 d6 f0 9e 0b b9 67 c0 27 7f e2 1d 94 44 5b 1f ......g.'....D[. 0180 5b 99 9c 2f 9f ae 25 b1 56 cf ed 96 b8 d8 24 80 [../..%.V.....$. 0190 91 32 88 f5 60 e2 .2..`. Reassembled TCP (1812 bytes): 0000 00 00 07 10 60 82 07 0c 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 01 fb 8a 7a 9d ..............z. 0020 3b 82 b6 cc 76 bc 40 04 e2 19 ef fc d7 04 49 b4 ;...v.@.......I. 0030 d9 70 39 bd cd 04 97 dc d6 21 59 a2 54 fa a2 b2 .p9......!Y.T... 0040 31 b3 3b 7e 19 0a 77 38 46 de 4a 6f 64 0e 84 14 1.;~..w8F.Jod... 0050 17 ff ad be cd dd 36 f4 26 0d d8 5f c8 97 fa 59 ......6.&.._...Y 0060 5b 46 bc 9b fb 0f 25 a4 f8 58 9b 55 0c 8a ca 31 [F....%..X.U...1 0070 56 1d 76 2f 58 df 41 3e ed 16 7b 16 f5 b8 97 85 V.v/X.A>..{..... 0080 96 4e da e0 2e 65 b8 4a 88 ee 58 8b c1 d6 92 a6 .N...e.J..X..... 0090 bf 03 7a 1c de 8a da 59 77 c2 3b b6 c5 03 dd d6 ..z....Yw.;..... 00a0 69 b5 b0 a4 1c cc 93 6b 67 a0 22 19 81 0f ce 37 i......kg."....7 00b0 ed 9e fd d4 a3 49 46 02 0c 0b b6 d6 ca 12 b3 e7 .....IF......... 00c0 92 5d 1a 11 d0 90 51 9a af 9b 57 00 27 f9 2a 0d .]....Q...W.'.*. 00d0 56 24 08 76 64 6a 79 44 2f f9 52 f7 c8 9f 0e 9a V$.vdjyD/.R..... 00e0 e0 a8 93 81 a6 71 95 e8 b3 c5 07 d9 6a 9a 65 e1 .....q......j.e. 00f0 2a b3 ff 75 96 59 e5 e9 62 b2 3b 61 59 75 11 f2 *..u.Y..b.;aYu.. 0100 d2 23 12 f1 53 f8 4b d0 92 2b 05 35 d4 df fe 8d .#..S.K..+.5.... 0110 c6 63 9c 82 a7 2e 61 a9 5d 62 d3 f4 e8 58 ec 35 .c....a.]b...X.5 0120 e4 bd bb fd 08 f4 53 7f ba 86 cc e4 c5 c6 bc 15 ......S......... 0130 be 5a f4 00 54 67 94 3d e1 0a 01 8f 3e ef f5 25 .Z..Tg.=....>..% 0140 bb f3 6d a1 f1 f4 f6 0d 61 5c 08 14 f7 24 16 2b ..m.....a\...$.+ 0150 75 23 fe 31 b6 4d 3d 6c 9f 6f 15 77 06 2b b5 bd u#.1.M=l.o.w.+.. 0160 42 bc 0d 1e d2 8c 07 2c 46 ea bb 1c 25 29 8a 9e B......,F...%).. 0170 4c b7 3c 48 e9 23 96 ec 90 7d 11 55 41 30 58 c5 L.?.6...u.' 0260 8b e5 f5 e5 5c 94 60 6f e0 12 d2 f3 f2 a3 bd c2 ....\.`o........ 0270 ff 08 5a d8 cc 61 fd 43 f6 b5 f6 43 1d 9a 64 e8 ..Z..a.C...C..d. 0280 44 64 66 df a4 bd 58 42 e9 56 4b 4b e1 e1 c2 44 Ddf...XB.VKK...D 0290 b0 08 11 6d 0e 95 eb 31 44 fa 81 db 40 1b be 1a ...m...1D...@... 02a0 1c 2f 67 a2 a0 af 28 97 12 65 66 72 ef bb 15 ec ./g...(..efr.... 02b0 6d 01 5a 78 48 36 16 c0 26 ac 04 3a 12 1b 1a 16 m.ZxH6..&..:.... 02c0 12 d3 09 a4 80 1d a1 f1 10 43 83 0b 3b dc 68 3c .........C..;.h< 02d0 a6 d8 94 18 68 e4 54 8f 1b 27 8a bb dc 63 57 8c ....h.T..'...cW. 02e0 79 c2 47 f0 f6 16 83 b4 c9 cc e7 fa 50 04 d8 5e y.G.........P..^ 02f0 5e ab 8c e4 aa 6a c0 37 90 37 fa 55 f9 6c a4 56 ^....j.7.7.U.l.V 0300 a7 54 6e 24 c7 ac e5 45 32 2e 90 eb 81 fa 14 28 .Tn$...E2......( 0310 00 73 f8 f4 9f 31 7b 07 f3 b7 71 fe de 9b c0 2d .s...1{...q....- 0320 b0 cf d0 28 11 24 00 f9 04 f4 f6 bd 28 41 b5 73 ...(.$......(A.s 0330 d3 d9 c5 b2 fe 8f a9 3f 1c 43 1a 5f f5 47 f0 b4 .......?.C._.G.. 0340 6e 5f 39 7d 16 2b 7c 30 38 25 75 66 95 e3 ef 67 n_9}.+|08%uf...g 0350 33 c7 5d 26 de 78 8b 38 ed 42 68 46 67 9a 7c d6 3.]&.x.8.BhFg.|. 0360 dc ca 8d 07 23 a5 33 55 84 a0 0c c1 b7 f3 69 e3 ....#.3U......i. 0370 bf 62 c4 0f 9a b9 4c f3 9d 80 51 1c 91 2b 2a d4 .b....L...Q..+*. 0380 c8 d8 fb eb b8 44 80 a4 15 73 cf f0 87 e3 aa d2 .....D...s...... 0390 86 e1 c4 b5 a1 43 19 66 a7 3c 52 8d e7 3c 0f 21 .....C.f.v==b...} 03c0 81 ed 83 60 ed c7 3b f7 14 f0 db 85 e9 73 43 1f ...`..;......sC. 03d0 d6 05 aa 84 c5 d6 b3 92 6b bb de d7 2a ab 0f 1a ........k...*... 03e0 25 ce fa e2 92 3a 05 79 e2 98 55 4f 10 26 68 60 %....:.y..UO.&h` 03f0 6d 26 50 1b 34 58 73 b8 6e 31 1e 90 f8 25 72 9b m&P.4Xs.n1...%r. 0400 09 1d 8c b3 b9 f8 bb b8 dc 3d 8e 08 b7 a5 91 a1 .........=...... 0410 7f f5 79 eb 52 10 e8 ce bf 62 fe 69 8c 91 60 6b ..y.R....b.i..`k 0420 55 9f 2e 50 52 f7 08 ac 49 ee 49 fd 9f b9 21 18 U..PR...I.I...!. 0430 30 e8 38 3d 5b 95 71 49 f2 92 c4 93 41 7f 21 6f 0.8=[.qI....A.!o 0440 ec ef 89 58 46 0f fa 44 e4 74 94 b8 1e 4b 7a c4 ...XF..D.t...Kz. 0450 a6 c8 93 5b 67 55 98 ae 06 66 ad ce 94 f9 a4 5a ...[gU...f.....Z 0460 25 85 7a bc e0 05 17 74 a3 3f 62 b5 0a 26 a8 d4 %.z....t.?b..&.. 0470 76 69 da 2f 1d 9c 0f 18 ec c0 03 81 00 c2 f9 da vi./............ 0480 9a 3e 83 36 64 99 27 df c8 6e ad 23 5d b5 6f 57 .>.6d.'..n.#].oW 0490 6f 5c 30 56 43 20 a0 ed 1c 57 ca e4 bc 2d 12 09 o\0VC ...W...-.. 04a0 5a b4 8e 55 ef d3 f7 36 5a b3 7c 46 cb cd 94 8d Z..U...6Z.|F.... 04b0 81 d1 02 d0 5c f3 1f 0a c5 8b c1 cc 95 7a 24 31 ....\........z$1 04c0 f7 c0 29 59 77 bf e7 11 4b c8 3d c8 1f 46 7a bf ..)Yw...K.=..Fz. 04d0 c5 0f 39 14 32 d7 dc 2b 38 c7 82 51 90 e1 50 9d ..9.2..+8..Q..P. 04e0 95 9e ba a9 50 f8 65 41 91 d6 8e 66 db 59 fa 21 ....P.eA...f.Y.! 04f0 78 7e 4e 98 ae f0 54 4b 6b fd 37 b9 4c 47 be 47 x~N...TKk.7.LG.G 0500 07 48 e7 b8 68 f4 45 8b 06 14 f2 67 a6 46 88 68 .H..h.E....g.F.h 0510 23 51 d8 5d ea 62 f5 43 23 f2 83 d3 9d 07 fb e6 #Q.].b.C#....... 0520 b7 c9 2f 55 56 3d 10 42 f6 e1 5a cc 9b ea af 12 ../UV=.B..Z..... 0530 57 40 ef 4e 57 b3 bb a0 f7 c6 3e 25 6a 8b 11 30 W@.NW.....>%j..0 0540 c8 4e 09 3b 73 ef 0e a4 34 f7 92 c0 64 e8 b9 42 .N.;s...4...d..B 0550 82 60 98 cc 92 06 96 de 3c 62 9c 97 56 32 51 8d .`.........q 06a0 86 9e 3a da 7a 0d 09 11 94 1c 0f 85 b2 e8 e3 7a ..:.z..........z 06b0 69 c6 4c 75 4a 63 48 36 f0 2f 2f 76 d8 10 79 ab i.LuJcH6.//v..y. 06c0 c0 fa 2f d5 f8 3e ac 26 92 fb 8e 75 27 54 6c 33 ../..>.&...u'Tl3 06d0 b9 79 de ca d8 50 48 c6 2b 89 ed e5 21 b6 98 8b .y...PH.+...!... 06e0 e7 ec f1 7f b9 28 7e c3 4a ba c3 64 5f 49 03 d6 .....(~.J..d_I.. 06f0 f0 9e 0b b9 67 c0 27 7f e2 1d 94 44 5b 1f 5b 99 ....g.'....D[.[. 0700 9c 2f 9f ae 25 b1 56 cf ed 96 b8 d8 24 80 91 32 ./..%.V.....$..2 0710 88 f5 60 e2 ..`. No. Time Source Destination Protocol Info 222 67.734940 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=8731 Ack=41613 Win=64240 Len=0 Frame 222 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8731, Ack: 41613, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 37 40 00 80 06 bf 8c ac 1f 01 68 ac 1f .(.7@........h.. 0020 01 65 07 f0 01 85 d3 1c 28 eb 0b 68 f6 0a 50 10 .e......(..h..P. 0030 fa f0 52 e8 00 00 00 00 00 9f 60 81 ..R.......`. No. Time Source Destination Protocol Info 223 67.736550 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 223 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8731, Ack: 41613, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF10A073A13785E23B96825C71E45BA0FE... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 10A073A13785E23B krb5_sgn_cksum: 96825C71E45BA0FE krb5_confounder: B82511D3B1674752 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 38 40 00 80 06 bf 25 ac 1f 01 68 ac 1f ...8@....%...h.. 0020 01 65 07 f0 01 85 d3 1c 28 eb 0b 68 f6 0a 50 18 .e......(..h..P. 0030 fa f0 5d 5f 00 00 00 00 00 62 60 60 06 09 2a 86 ..]_.....b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 10 H............... 0050 a0 73 a1 37 85 e2 3b 96 82 5c 71 e4 5b a0 fe b8 .s.7..;..\q.[... 0060 25 11 d3 b1 67 47 52 a7 c6 30 2f 18 72 d0 e9 e5 %...gGR..0/.r... 0070 4f 6b 3c 25 d1 fb 79 19 f7 37 ad a8 93 4f 36 c8 Ok<%..y..7...O6. 0080 c0 3d 12 f9 e3 7a b9 23 98 38 af b8 d3 c9 6a 2d .=...z.#.8....j- 0090 5f 14 fd 19 67 43 27 e7 81 d8 20 fe _...gC'... . No. Time Source Destination Protocol Info 224 67.738285 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 224 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 41613, Ack: 8833, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 22 40 00 80 06 6b ee ac 1f 01 65 ac 1f ..."@...k....e.. 0020 01 68 01 85 07 f0 0b 68 f6 0a d3 1c 29 51 50 10 .h.....h....)QP. 0030 f6 fa b1 5d 00 00 00 00 09 dd 60 82 09 d9 06 09 ...]......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff f1 01 5b 14 4f ee c6 33 65 2b 7c c7 d9 4d 21 ...[.O..3e+|..M! 0060 55 2d 56 47 11 44 3c 0d 57 94 c5 83 40 87 80 01 U-VG.D<.W...@... 0070 56 b2 4d 27 ed c8 b3 a9 b1 97 47 4c ac 59 50 8c V.M'......GL.YP. 0080 d2 a7 2f 47 59 f2 d0 6b 44 d3 4c 8d 16 e7 0c 6e ../GY..kD.L....n 0090 c1 0c a9 f9 aa 56 e8 0c 8b 81 f5 21 6c 0b e8 40 .....V.....!l..@ 00a0 9c 8b d5 9f 0f 84 a5 42 84 ae 88 f9 1a ea 47 db .......B......G. 00b0 95 c9 12 76 27 58 d4 cc e0 10 07 35 8d 9d b9 8d ...v'X.....5.... 00c0 0e 83 04 3d 0f 5a 1a 73 1d 2d 92 fe 33 f6 2a 61 ...=.Z.s.-..3.*a 00d0 d8 bd 9b 4e 76 ac 92 ca 86 57 1f 69 50 c6 e8 a7 ...Nv....W.iP... 00e0 84 b1 13 f8 0c f6 06 41 d7 8b 68 85 e9 e0 ae c1 .......A..h..... 00f0 51 6b 03 c9 23 b0 df 3f 0e a0 3e 61 bc b3 26 d3 Qk..#..?..>a..&. 0100 48 8a 9d 61 df e0 76 17 c1 0a 63 cd 69 fa a7 78 H..a..v...c.i..x 0110 e4 98 b9 3b 73 72 b0 c0 d3 fc 0f 27 e1 58 27 8d ...;sr.....'.X'. 0120 79 9d 62 76 4d dc 43 c0 27 ba 18 eb da 83 8f 44 y.bvM.C.'......D 0130 e3 a8 c6 29 21 11 b8 b5 14 71 00 2e e7 3c ac aa ...)!....q...<.. 0140 b7 c8 26 d5 59 e0 14 b9 e9 18 6d 52 3d a3 2d b7 ..&.Y.....mR=.-. 0150 16 97 19 fc 1e 72 b8 14 15 13 c6 0e ab fe 0d e7 .....r.......... 0160 e8 08 78 e6 2a 2e 48 c7 8e 92 dd c2 0b 4f 69 85 ..x.*.H......Oi. 0170 09 51 01 b6 be 80 8a 5a 28 a5 63 38 7c dc 11 8e .Q.....Z(.c8|... 0180 20 4a 1d b8 b8 72 b9 55 7f 07 97 3e 7c cb 76 bd J...r.U...>|.v. 0190 ee 0e 7a e0 e4 8c bd 8a 61 6e 7b 1b 1d 30 e6 b8 ..z.....an{..0.. 01a0 7d ea 4f 42 07 24 e1 5f 80 35 b5 55 99 bb 43 d6 }.OB.$._.5.U..C. 01b0 81 db 35 49 cf 26 68 7f 8e 99 a8 b1 2a 2b da 1e ..5I.&h.....*+.. 01c0 cf 19 90 da 02 c9 66 0d ab c7 a9 57 36 5b e5 ae ......f....W6[.. 01d0 4c a1 69 34 1b 99 5c f1 d8 31 71 9d 5b c7 89 84 L.i4..\..1q.[... 01e0 25 b8 7c be 56 cf e3 79 0d 4b ff 4e f2 d1 81 08 %.|.V..y.K.N.... 01f0 aa 41 2b 07 e8 00 3a 2c bd 87 52 a1 78 b0 ee 59 .A+...:,..R.x..Y 0200 56 2c 0c d9 4d 12 f7 14 c6 17 79 08 64 cf 88 93 V,..M.....y.d... 0210 9d cd 8f a0 fb b9 b3 01 b7 5e 1b d8 04 8f a7 d5 .........^...... 0220 c5 3a 33 31 90 0a bb f3 90 4e d0 fe 38 6b bf f5 .:31.....N..8k.. 0230 74 86 2b 37 16 6e ae b1 8d c3 1a fe df bd b2 72 t.+7.n.........r 0240 e6 5c 58 0a de ff a8 7b 45 75 ba d1 df 88 e1 d7 .\X....{Eu...... 0250 3f f6 9f 45 bd 44 c9 1a 9a 1c 10 0d 91 ef 21 4b ?..E.D........!K 0260 dd a0 a4 6d ea c7 07 62 94 18 3a e9 93 2e 11 13 ...m...b..:..... 0270 24 81 68 1a 7f cd d3 28 df 7c 27 75 20 84 90 88 $.h....(.|'u ... 0280 40 76 38 62 02 c0 be 00 cb 2a a4 05 15 b8 67 61 @v8b.....*....ga 0290 7c 81 9f 32 77 f5 80 9b 86 94 06 80 9d c4 e2 a3 |..2w........... 02a0 2b b9 00 04 05 18 5f 9b 88 e2 22 a2 de a2 90 ac +....._..."..... 02b0 d7 ff d6 81 8b f1 d6 20 56 16 39 d7 d3 95 c0 1e ....... V.9..... 02c0 ed 6b 1a 02 59 b2 73 7b c6 e9 7a d8 68 3d 30 13 .k..Y.s{..z.h=0. 02d0 5e b1 9c 3b 03 19 6b 8c c2 d7 da 6d ad d9 14 2d ^..;..k....m...- 02e0 d5 8d a9 48 f0 a2 9b 3c 64 23 ec a7 29 04 c8 ce ...H...Qzdtk. 0470 3d 86 ec 03 2a b6 96 29 b7 39 ae e3 2e 93 b2 99 =...*..).9...... 0480 b3 5b fe 21 91 22 81 d6 61 c3 09 d1 19 6f 4e bf .[.!."..a....oN. 0490 d6 e1 50 dc fd e1 a0 de 32 ee 69 a7 97 ff fd c0 ..P.....2.i..... 04a0 3a 59 42 20 f8 19 16 b5 78 34 b7 e7 70 83 72 c9 :YB ....x4..p.r. 04b0 1a 72 6a 87 16 b8 20 80 29 06 7d 5e 70 d2 a5 94 .rj... .).}^p... 04c0 6a 9c b5 5d 2f 6a d2 1c 8d 42 e9 b7 7e cf 96 e9 j..]/j...B..~... 04d0 fe a5 07 6f 9f 50 c7 1c d3 2c 1b 6a ab a4 71 89 ...o.P...,.j..q. 04e0 d9 d9 52 75 25 e1 cd bb ef 84 3f c8 d3 5e dc 8a ..Ru%.....?..^.. 04f0 62 f7 fe 95 8e f0 46 6a 61 e1 3c 4b b1 45 87 a3 b.....Fja...E.|...H.7.L 05a0 cd bd dc d9 fd e1 ab 64 ed 88 cc ef 3a 51 c2 33 .......d....:Q.3 05b0 87 da 8b 13 00 a5 94 e1 48 b3 e9 8e ba ab 52 75 ........H.....Ru 05c0 1a fd db 60 de 91 e0 df f0 f9 da eb 22 eb 2e 18 ...`........"... 05d0 05 06 84 f2 1f 58 47 b8 ff 9d e9 d1 13 17 bd d5 .....XG......... 05e0 0d 5e ac c9 d6 9a a6 15 01 f2 .^........ No. Time Source Destination Protocol Info 225 67.738391 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2478 bytes) Frame 225 (1123 bytes on wire, 1123 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 43073, Ack: 8833, Len: 1069 Lightweight Directory Access Protocol SASL Buffer Length: 2525 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF1015B144FEEC633652B7CC7D94D2155... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F1015B144FEEC633 krb5_sgn_cksum: 652B7CC7D94D2155 krb5_confounder: 2D564711443C0D57 GSS-API Encrypted payload (2478 bytes) Frame (1123 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 04 55 2e 23 40 00 80 06 6d 74 ac 1f 01 65 ac 1f .U.#@...mt...e.. 0020 01 68 01 85 07 f0 0b 68 fb be d3 1c 29 51 50 18 .h.....h....)QP. 0030 f6 fa 3c 3a 00 00 8f 54 c5 db 42 44 98 00 56 1d ..<:...T..BD..V. 0040 05 00 a5 58 73 e7 19 04 3e 0f fb 3b f5 82 c4 a4 ...Xs...>..;.... 0050 50 fe cc 96 6c a6 e5 bc 7a bd 3b a2 38 ee 35 4b P...l...z.;.8.5K 0060 a5 46 b7 92 84 2a 89 91 88 fc 1a af 7e 4b 66 13 .F...*......~Kf. 0070 51 d9 91 23 85 b8 f4 f0 15 7e 50 a0 e2 24 b6 de Q..#.....~P..$.. 0080 90 a1 19 9e 6b c4 7d 20 54 ae 10 d4 1e b4 ff f3 ....k.} T....... 0090 b1 06 21 2a b5 91 6e 1a 7c b4 41 a1 44 59 42 f5 ..!*..n.|.A.DYB. 00a0 5c 34 98 12 71 16 1f e8 d4 a1 ba 4c d5 56 6d 80 \4..q......L.Vm. 00b0 f9 9a 31 cc a1 f2 91 bb 29 d5 8a 9f d6 97 8e da ..1.....)....... 00c0 9f 36 0e 3b ee 20 f3 05 f9 6d 94 eb 9c 85 46 94 .6.;. ...m....F. 00d0 e9 55 6b 4b fb 33 88 54 de 27 68 ba 66 2a 1a 40 .UkK.3.T.'h.f*.@ 00e0 d5 12 9c 50 5a cb 76 0e 5a 3c 87 e4 99 cb 2c 00 ...PZ.v.Z<....,. 00f0 0f 70 93 e1 d8 64 fa 3b c4 31 73 fc 69 b9 b0 9c .p...d.;.1s.i... 0100 6b ee b4 40 e1 6f 20 ec fb fe 2d 1b 69 06 0a 79 k..@.o ...-.i..y 0110 1b c2 8b ec 33 5b d4 27 61 f0 48 3f c2 db 8f 27 ....3[.'a.H?...' 0120 f1 f8 ad 2d 82 c6 24 70 d8 cb f5 b5 cc 9d 0b 05 ...-..$p........ 0130 d4 77 0e ac 88 22 c5 ee 29 c0 43 a4 89 b2 a8 7f .w..."..).C..... 0140 4a e5 4c cf ea bb 2b a8 2a 4d e5 3a 4f 9d eb 10 J.L...+.*M.:O... 0150 9e 30 e9 a2 10 c6 89 b9 c3 44 ea 6b 09 86 69 02 .0.......D.k..i. 0160 ec 25 ab c6 95 08 06 16 4f e2 94 f2 9b c0 90 9c .%......O....... 0170 0b 14 f5 49 f1 91 8f 86 53 22 89 77 d7 88 05 58 ...I....S".w...X 0180 b0 e9 55 97 01 be 34 fc da 4a a4 07 de 7c ee 02 ..U...4..J...|.. 0190 26 8b 85 6d f2 c3 ff 1e 09 ff 31 d7 3a 5d 0d 6d &..m......1.:].m 01a0 81 eb be ec dc a5 ae be ea b5 41 8f ae 1a a5 4e ..........A....N 01b0 6b 40 65 4d 80 c1 d4 07 42 68 21 dd e8 88 b6 ca k@eM....Bh!..... 01c0 38 a8 93 61 96 8c 29 f8 c3 61 c2 7c 60 0e 8b 64 8..a..)..a.|`..d 01d0 1c 84 b8 26 5a e8 48 a1 d2 4f 68 93 e5 87 64 6f ...&Z.H..Oh...do 01e0 5c 31 97 5f bb 34 78 e2 14 0e b8 ad 32 5e 51 72 \1._.4x.....2^Qr 01f0 4a d7 c2 44 cb 3a 6a 20 9b 62 7b 8a 2f 10 d5 0a J..D.:j .b{./... 0200 95 72 e2 f9 4b e6 99 ef 7c 33 f0 cc c7 aa f8 88 .r..K...|3...... 0210 77 7d f1 69 37 14 dd 48 b9 11 aa af fc 33 22 84 w}.i7..H.....3". 0220 fc 18 f9 71 d4 80 31 5b a9 7d b7 19 08 01 75 22 ...q..1[.}....u" 0230 89 19 f4 01 fe 1b 63 19 42 e5 af 18 a0 f4 95 a2 ......c.B....... 0240 15 de 48 4f 69 89 45 31 82 02 c9 ce 4c bb 06 a3 ..HOi.E1....L... 0250 a9 55 89 11 6e 5d 6a ab 86 69 e5 4a bd 1a 09 e7 .U..n]j..i.J.... 0260 49 9a 39 f5 4c 70 7f 64 ec aa 0f f1 cf 8a 4c f2 I.9.Lp.d......L. 0270 5f a0 41 f2 a5 cf dd 80 6b 86 59 a3 8c 3d 65 c0 _.A.....k.Y..=e. 0280 fe d5 4f 73 bc 97 c2 db 26 69 8f cc ff 5a 7d 4f ..Os....&i...Z}O 0290 16 52 86 8d 22 18 ac 83 b5 65 32 c0 86 f3 6b ba .R.."....e2...k. 02a0 4f d0 e9 ae ea e1 ff 53 a7 ea e1 8c cf 31 76 7e O......S.....1v~ 02b0 ae 32 3e af 32 82 0d 9e bc 88 c7 4b 76 c5 f1 e7 .2>.2......Kv... 02c0 48 2a 56 22 0e 7f 64 5e 5d 93 5a 58 4d 18 a8 1e H*V"..d^].ZXM... 02d0 d3 83 a3 0e 87 1a 28 21 56 43 e8 cd 13 b0 cd 60 ......(!VC.....` 02e0 e1 7a c5 82 cf 0d af c7 31 33 e9 ac de 66 8d 7f .z......13...f.. 02f0 c6 d2 78 b9 79 2a 37 ad fd 51 c5 9b 98 d7 68 af ..x.y*7..Q....h. 0300 16 64 e6 e7 f7 ea 73 80 ec 3c d0 ff b2 1e a5 de .d....s..<...... 0310 70 41 fe 0b 42 9a 96 8b 4c 7c 1b 1c fd e0 d9 7e pA..B...L|.....~ 0320 76 51 ab cc 94 1d 18 62 9a 63 fa bc 7d 12 e9 dc vQ.....b.c..}... 0330 76 84 a6 6a 0f 04 a8 1c 91 62 ba 1a 9b d9 f3 d3 v..j.....b...... 0340 aa 5d ee 75 34 d5 91 77 e6 eb 2a f2 cd ab 9a fa .].u4..w..*..... 0350 c7 fc b5 76 a0 31 44 d8 c0 f4 0b dd ad b2 77 c4 ...v.1D.......w. 0360 53 39 f9 88 54 64 2f 0b 65 70 72 3b c6 86 a4 ab S9..Td/.epr;.... 0370 e0 43 5a 13 80 f5 64 c4 13 fe 5a 5e e7 d3 ab cc .CZ...d...Z^.... 0380 f5 39 93 54 fb 04 fe e4 02 2b 52 62 f7 2f 00 8a .9.T.....+Rb./.. 0390 46 7b 97 47 f6 31 3a 96 04 8b ae 89 02 b9 48 80 F{.G.1:.......H. 03a0 14 30 93 a2 54 74 b0 9a 17 4a 9d ea 1b 1f f6 20 .0..Tt...J..... 03b0 16 fa e7 5b af fd 63 64 18 48 88 b8 72 f5 fc 0c ...[..cd.H..r... 03c0 80 00 d9 0a 80 c3 54 0a af e7 a4 fe c3 85 16 5b ......T........[ 03d0 d9 4a c2 fc 0e 83 a0 e7 ed b2 f7 01 6c bd 42 45 .J..........l.BE 03e0 c9 64 5a 46 2d 68 8b c3 7d 56 f9 3f 0f b3 fa 2c .dZF-h..}V.?..., 03f0 45 4d 15 48 c3 6d e4 4f dc 1e c1 c1 3c d9 71 be EM.H.m.O....<.q. 0400 91 05 9f 95 9a 4a f0 e2 d3 9c dc eb 6e 3f c0 8c .....J......n?.. 0410 5e f1 2f ab 38 43 37 44 92 79 f9 9c ea 2c bc 46 ^./.8C7D.y...,.F 0420 85 b5 ab cb 8a 2e 11 52 59 8f 24 07 32 88 58 2a .......RY.$.2.X* 0430 88 15 3c 4b dd 18 0d 51 57 25 b5 26 d3 90 b1 89 ..a..&.H..a.. 00d0 76 17 c1 0a 63 cd 69 fa a7 78 e4 98 b9 3b 73 72 v...c.i..x...;sr 00e0 b0 c0 d3 fc 0f 27 e1 58 27 8d 79 9d 62 76 4d dc .....'.X'.y.bvM. 00f0 43 c0 27 ba 18 eb da 83 8f 44 e3 a8 c6 29 21 11 C.'......D...)!. 0100 b8 b5 14 71 00 2e e7 3c ac aa b7 c8 26 d5 59 e0 ...q...<....&.Y. 0110 14 b9 e9 18 6d 52 3d a3 2d b7 16 97 19 fc 1e 72 ....mR=.-......r 0120 b8 14 15 13 c6 0e ab fe 0d e7 e8 08 78 e6 2a 2e ............x.*. 0130 48 c7 8e 92 dd c2 0b 4f 69 85 09 51 01 b6 be 80 H......Oi..Q.... 0140 8a 5a 28 a5 63 38 7c dc 11 8e 20 4a 1d b8 b8 72 .Z(.c8|... J...r 0150 b9 55 7f 07 97 3e 7c cb 76 bd ee 0e 7a e0 e4 8c .U...>|.v...z... 0160 bd 8a 61 6e 7b 1b 1d 30 e6 b8 7d ea 4f 42 07 24 ..an{..0..}.OB.$ 0170 e1 5f 80 35 b5 55 99 bb 43 d6 81 db 35 49 cf 26 ._.5.U..C...5I.& 0180 68 7f 8e 99 a8 b1 2a 2b da 1e cf 19 90 da 02 c9 h.....*+........ 0190 66 0d ab c7 a9 57 36 5b e5 ae 4c a1 69 34 1b 99 f....W6[..L.i4.. 01a0 5c f1 d8 31 71 9d 5b c7 89 84 25 b8 7c be 56 cf \..1q.[...%.|.V. 01b0 e3 79 0d 4b ff 4e f2 d1 81 08 aa 41 2b 07 e8 00 .y.K.N.....A+... 01c0 3a 2c bd 87 52 a1 78 b0 ee 59 56 2c 0c d9 4d 12 :,..R.x..YV,..M. 01d0 f7 14 c6 17 79 08 64 cf 88 93 9d cd 8f a0 fb b9 ....y.d......... 01e0 b3 01 b7 5e 1b d8 04 8f a7 d5 c5 3a 33 31 90 0a ...^.......:31.. 01f0 bb f3 90 4e d0 fe 38 6b bf f5 74 86 2b 37 16 6e ...N..8k..t.+7.n 0200 ae b1 8d c3 1a fe df bd b2 72 e6 5c 58 0a de ff .........r.\X... 0210 a8 7b 45 75 ba d1 df 88 e1 d7 3f f6 9f 45 bd 44 .{Eu......?..E.D 0220 c9 1a 9a 1c 10 0d 91 ef 21 4b dd a0 a4 6d ea c7 ........!K...m.. 0230 07 62 94 18 3a e9 93 2e 11 13 24 81 68 1a 7f cd .b..:.....$.h... 0240 d3 28 df 7c 27 75 20 84 90 88 40 76 38 62 02 c0 .(.|'u ...@v8b.. 0250 be 00 cb 2a a4 05 15 b8 67 61 7c 81 9f 32 77 f5 ...*....ga|..2w. 0260 80 9b 86 94 06 80 9d c4 e2 a3 2b b9 00 04 05 18 ..........+..... 0270 5f 9b 88 e2 22 a2 de a2 90 ac d7 ff d6 81 8b f1 _..."........... 0280 d6 20 56 16 39 d7 d3 95 c0 1e ed 6b 1a 02 59 b2 . V.9......k..Y. 0290 73 7b c6 e9 7a d8 68 3d 30 13 5e b1 9c 3b 03 19 s{..z.h=0.^..;.. 02a0 6b 8c c2 d7 da 6d ad d9 14 2d d5 8d a9 48 f0 a2 k....m...-...H.. 02b0 9b 3c 64 23 ec a7 29 04 c8 ce d2 5c f4 4a fa 5d .Qzdtk.=...*. 0440 96 29 b7 39 ae e3 2e 93 b2 99 b3 5b fe 21 91 22 .).9.......[.!." 0450 81 d6 61 c3 09 d1 19 6f 4e bf d6 e1 50 dc fd e1 ..a....oN...P... 0460 a0 de 32 ee 69 a7 97 ff fd c0 3a 59 42 20 f8 19 ..2.i.....:YB .. 0470 16 b5 78 34 b7 e7 70 83 72 c9 1a 72 6a 87 16 b8 ..x4..p.r..rj... 0480 20 80 29 06 7d 5e 70 d2 a5 94 6a 9c b5 5d 2f 6a .).}^p...j..]/j 0490 d2 1c 8d 42 e9 b7 7e cf 96 e9 fe a5 07 6f 9f 50 ...B..~......o.P 04a0 c7 1c d3 2c 1b 6a ab a4 71 89 d9 d9 52 75 25 e1 ...,.j..q...Ru%. 04b0 cd bb ef 84 3f c8 d3 5e dc 8a 62 f7 fe 95 8e f0 ....?..^..b..... 04c0 46 6a 61 e1 3c 4b b1 45 87 a3 41 d9 db b9 aa 8b Fja...E 0560 83 7c 0b e5 bb 48 9d 37 cc 4c cd bd dc d9 fd e1 .|...H.7.L...... 0570 ab 64 ed 88 cc ef 3a 51 c2 33 87 da 8b 13 00 a5 .d....:Q.3...... 0580 94 e1 48 b3 e9 8e ba ab 52 75 1a fd db 60 de 91 ..H.....Ru...`.. 0590 e0 df f0 f9 da eb 22 eb 2e 18 05 06 84 f2 1f 58 ......"........X 05a0 47 b8 ff 9d e9 d1 13 17 bd d5 0d 5e ac c9 d6 9a G..........^.... 05b0 a6 15 01 f2 8f 54 c5 db 42 44 98 00 56 1d 05 00 .....T..BD..V... 05c0 a5 58 73 e7 19 04 3e 0f fb 3b f5 82 c4 a4 50 fe .Xs...>..;....P. 05d0 cc 96 6c a6 e5 bc 7a bd 3b a2 38 ee 35 4b a5 46 ..l...z.;.8.5K.F 05e0 b7 92 84 2a 89 91 88 fc 1a af 7e 4b 66 13 51 d9 ...*......~Kf.Q. 05f0 91 23 85 b8 f4 f0 15 7e 50 a0 e2 24 b6 de 90 a1 .#.....~P..$.... 0600 19 9e 6b c4 7d 20 54 ae 10 d4 1e b4 ff f3 b1 06 ..k.} T......... 0610 21 2a b5 91 6e 1a 7c b4 41 a1 44 59 42 f5 5c 34 !*..n.|.A.DYB.\4 0620 98 12 71 16 1f e8 d4 a1 ba 4c d5 56 6d 80 f9 9a ..q......L.Vm... 0630 31 cc a1 f2 91 bb 29 d5 8a 9f d6 97 8e da 9f 36 1.....)........6 0640 0e 3b ee 20 f3 05 f9 6d 94 eb 9c 85 46 94 e9 55 .;. ...m....F..U 0650 6b 4b fb 33 88 54 de 27 68 ba 66 2a 1a 40 d5 12 kK.3.T.'h.f*.@.. 0660 9c 50 5a cb 76 0e 5a 3c 87 e4 99 cb 2c 00 0f 70 .PZ.v.Z<....,..p 0670 93 e1 d8 64 fa 3b c4 31 73 fc 69 b9 b0 9c 6b ee ...d.;.1s.i...k. 0680 b4 40 e1 6f 20 ec fb fe 2d 1b 69 06 0a 79 1b c2 .@.o ...-.i..y.. 0690 8b ec 33 5b d4 27 61 f0 48 3f c2 db 8f 27 f1 f8 ..3[.'a.H?...'.. 06a0 ad 2d 82 c6 24 70 d8 cb f5 b5 cc 9d 0b 05 d4 77 .-..$p.........w 06b0 0e ac 88 22 c5 ee 29 c0 43 a4 89 b2 a8 7f 4a e5 ..."..).C.....J. 06c0 4c cf ea bb 2b a8 2a 4d e5 3a 4f 9d eb 10 9e 30 L...+.*M.:O....0 06d0 e9 a2 10 c6 89 b9 c3 44 ea 6b 09 86 69 02 ec 25 .......D.k..i..% 06e0 ab c6 95 08 06 16 4f e2 94 f2 9b c0 90 9c 0b 14 ......O......... 06f0 f5 49 f1 91 8f 86 53 22 89 77 d7 88 05 58 b0 e9 .I....S".w...X.. 0700 55 97 01 be 34 fc da 4a a4 07 de 7c ee 02 26 8b U...4..J...|..&. 0710 85 6d f2 c3 ff 1e 09 ff 31 d7 3a 5d 0d 6d 81 eb .m......1.:].m.. 0720 be ec dc a5 ae be ea b5 41 8f ae 1a a5 4e 6b 40 ........A....Nk@ 0730 65 4d 80 c1 d4 07 42 68 21 dd e8 88 b6 ca 38 a8 eM....Bh!.....8. 0740 93 61 96 8c 29 f8 c3 61 c2 7c 60 0e 8b 64 1c 84 .a..)..a.|`..d.. 0750 b8 26 5a e8 48 a1 d2 4f 68 93 e5 87 64 6f 5c 31 .&Z.H..Oh...do\1 0760 97 5f bb 34 78 e2 14 0e b8 ad 32 5e 51 72 4a d7 ._.4x.....2^QrJ. 0770 c2 44 cb 3a 6a 20 9b 62 7b 8a 2f 10 d5 0a 95 72 .D.:j .b{./....r 0780 e2 f9 4b e6 99 ef 7c 33 f0 cc c7 aa f8 88 77 7d ..K...|3......w} 0790 f1 69 37 14 dd 48 b9 11 aa af fc 33 22 84 fc 18 .i7..H.....3"... 07a0 f9 71 d4 80 31 5b a9 7d b7 19 08 01 75 22 89 19 .q..1[.}....u".. 07b0 f4 01 fe 1b 63 19 42 e5 af 18 a0 f4 95 a2 15 de ....c.B......... 07c0 48 4f 69 89 45 31 82 02 c9 ce 4c bb 06 a3 a9 55 HOi.E1....L....U 07d0 89 11 6e 5d 6a ab 86 69 e5 4a bd 1a 09 e7 49 9a ..n]j..i.J....I. 07e0 39 f5 4c 70 7f 64 ec aa 0f f1 cf 8a 4c f2 5f a0 9.Lp.d......L._. 07f0 41 f2 a5 cf dd 80 6b 86 59 a3 8c 3d 65 c0 fe d5 A.....k.Y..=e... 0800 4f 73 bc 97 c2 db 26 69 8f cc ff 5a 7d 4f 16 52 Os....&i...Z}O.R 0810 86 8d 22 18 ac 83 b5 65 32 c0 86 f3 6b ba 4f d0 .."....e2...k.O. 0820 e9 ae ea e1 ff 53 a7 ea e1 8c cf 31 76 7e ae 32 .....S.....1v~.2 0830 3e af 32 82 0d 9e bc 88 c7 4b 76 c5 f1 e7 48 2a >.2......Kv...H* 0840 56 22 0e 7f 64 5e 5d 93 5a 58 4d 18 a8 1e d3 83 V"..d^].ZXM..... 0850 a3 0e 87 1a 28 21 56 43 e8 cd 13 b0 cd 60 e1 7a ....(!VC.....`.z 0860 c5 82 cf 0d af c7 31 33 e9 ac de 66 8d 7f c6 d2 ......13...f.... 0870 78 b9 79 2a 37 ad fd 51 c5 9b 98 d7 68 af 16 64 x.y*7..Q....h..d 0880 e6 e7 f7 ea 73 80 ec 3c d0 ff b2 1e a5 de 70 41 ....s..<......pA 0890 fe 0b 42 9a 96 8b 4c 7c 1b 1c fd e0 d9 7e 76 51 ..B...L|.....~vQ 08a0 ab cc 94 1d 18 62 9a 63 fa bc 7d 12 e9 dc 76 84 .....b.c..}...v. 08b0 a6 6a 0f 04 a8 1c 91 62 ba 1a 9b d9 f3 d3 aa 5d .j.....b.......] 08c0 ee 75 34 d5 91 77 e6 eb 2a f2 cd ab 9a fa c7 fc .u4..w..*....... 08d0 b5 76 a0 31 44 d8 c0 f4 0b dd ad b2 77 c4 53 39 .v.1D.......w.S9 08e0 f9 88 54 64 2f 0b 65 70 72 3b c6 86 a4 ab e0 43 ..Td/.epr;.....C 08f0 5a 13 80 f5 64 c4 13 fe 5a 5e e7 d3 ab cc f5 39 Z...d...Z^.....9 0900 93 54 fb 04 fe e4 02 2b 52 62 f7 2f 00 8a 46 7b .T.....+Rb./..F{ 0910 97 47 f6 31 3a 96 04 8b ae 89 02 b9 48 80 14 30 .G.1:.......H..0 0920 93 a2 54 74 b0 9a 17 4a 9d ea 1b 1f f6 20 16 fa ..Tt...J..... .. 0930 e7 5b af fd 63 64 18 48 88 b8 72 f5 fc 0c 80 00 .[..cd.H..r..... 0940 d9 0a 80 c3 54 0a af e7 a4 fe c3 85 16 5b d9 4a ....T........[.J 0950 c2 fc 0e 83 a0 e7 ed b2 f7 01 6c bd 42 45 c9 64 ..........l.BE.d 0960 5a 46 2d 68 8b c3 7d 56 f9 3f 0f b3 fa 2c 45 4d ZF-h..}V.?...,EM 0970 15 48 c3 6d e4 4f dc 1e c1 c1 3c d9 71 be 91 05 .H.m.O....<.q... 0980 9f 95 9a 4a f0 e2 d3 9c dc eb 6e 3f c0 8c 5e f1 ...J......n?..^. 0990 2f ab 38 43 37 44 92 79 f9 9c ea 2c bc 46 85 b5 /.8C7D.y...,.F.. 09a0 ab cb 8a 2e 11 52 59 8f 24 07 32 88 58 2a 88 15 .....RY.$.2.X*.. 09b0 3c 4b dd 18 0d 51 57 25 b5 26 d3 90 b1 89 a1 cc ldap [ACK] Seq=8833 Ack=44142 Win=64240 Len=0 Frame 226 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8833, Ack: 44142, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 39 40 00 80 06 bf 8a ac 1f 01 68 ac 1f .(.9@........h.. 0020 01 65 07 f0 01 85 d3 1c 29 51 0b 68 ff eb 50 10 .e......)Q.h..P. 0030 fa f0 48 a1 00 00 ac 1f 01 65 c5 d5 ..H......e.. No. Time Source Destination Protocol Info 227 67.739702 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 227 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8833, Ack: 44142, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF54DBB9A42FCBF5CE06772BB237C715D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F54DBB9A42FCBF5C krb5_sgn_cksum: E06772BB237C715D krb5_confounder: F4C282BE08CEA8F8 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 3a 40 00 80 06 be f6 ac 1f 01 68 ac 1f ...:@........h.. 0020 01 65 07 f0 01 85 d3 1c 29 51 0b 68 ff eb 50 18 .e......)Q.h..P. 0030 fa f0 a5 ec 00 00 00 00 00 8f 60 81 8c 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 f5 4d bb 9a 42 fc bf 5c e0 67 72 bb 23 7c 71 5d .M..B..\.gr.#|q] 0060 f4 c2 82 be 08 ce a8 f8 8f fe fa 86 6d 56 6d e6 ............mVm. 0070 44 9e 7d f3 3d 9b 8c 79 04 92 4a eb f3 84 14 f4 D.}.=..y..J..... 0080 5d a3 7a 38 d2 01 bf 98 ae 88 c5 06 17 aa ec fd ].z8............ 0090 38 bf 92 4c 21 be 50 20 3d 8d 3f 83 cb ba 01 18 8..L!.P =.?..... 00a0 20 01 1b d3 d8 4b de 6d e1 a4 79 71 65 64 31 7d ....K.m..yqed1} 00b0 c2 b1 09 93 05 8a a1 9f ea 7f 4e 7a f0 b6 62 b5 ..........Nz..b. 00c0 7b 00 3d 6e 1e ae 2d bb 07 {.=n..-.. No. Time Source Destination Protocol Info 228 67.740437 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 228 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 44142, Ack: 8980, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4DFE53F32F8E7812E865698F40FAE55C... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4DFE53F32F8E7812 krb5_sgn_cksum: E865698F40FAE55C krb5_confounder: F034700E8DA77DA3 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 24 40 00 80 06 70 ee ac 1f 01 65 ac 1f ...$@...p....e.. 0020 01 68 01 85 07 f0 0b 68 ff eb d3 1c 29 e4 50 18 .h.....h....).P. 0030 f6 67 86 39 00 00 00 00 00 ae 60 81 ab 06 09 2a .g.9......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 4d fe 53 f3 2f 8e 78 12 e8 65 69 8f 40 fa e5 5c M.S./.x..ei.@..\ 0060 f0 34 70 0e 8d a7 7d a3 4f ab b0 40 9e 49 4b aa .4p...}.O..@.IK. 0070 41 b7 1c b1 5f 21 4b 6c a7 5e de 16 5e 44 0c 70 A..._!Kl.^..^D.p 0080 00 5b 8b 6f 0e 2e fe fe f4 6d 0c 14 d9 f0 91 c9 .[.o.....m...... 0090 2d 42 37 e5 94 70 7b 35 ac fa e7 e3 8c d8 6d 9f -B7..p{5......m. 00a0 52 d9 db f3 c9 e4 da 1f 75 f2 ca 00 b9 07 00 39 R.......u......9 00b0 f1 73 32 07 e6 eb 81 b1 45 b7 57 07 96 eb 52 a8 .s2.....E.W...R. 00c0 3e 50 10 f9 5e 8d 05 d2 d2 8b 17 02 4b 4c 67 8c >P..^.......KLg. 00d0 96 6b f6 b3 5e 97 4e f3 ad 37 46 2c 92 7b a1 16 .k..^.N..7F,.{.. 00e0 e8 d8 44 12 d0 47 c4 e6 ..D..G.. No. Time Source Destination Protocol Info 229 67.751591 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (112 bytes) Frame 229 (216 bytes on wire, 216 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 8980, Ack: 44320, Len: 162 Lightweight Directory Access Protocol SASL Buffer Length: 158 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9B6FA7D52C2A84BBCC2240D76DF0D31D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9B6FA7D52C2A84BB krb5_sgn_cksum: CC2240D76DF0D31D krb5_confounder: AA60FC19FDC7A71D GSS-API Encrypted payload (112 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 ca e0 3b 40 00 80 06 be e6 ac 1f 01 68 ac 1f ...;@........h.. 0020 01 65 07 f0 01 85 d3 1c 29 e4 0b 69 00 9d 50 18 .e......)..i..P. 0030 fa 3e fd 29 00 00 00 00 00 9e 60 81 9b 06 09 2a .>.)......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 9b 6f a7 d5 2c 2a 84 bb cc 22 40 d7 6d f0 d3 1d .o..,*..."@.m... 0060 aa 60 fc 19 fd c7 a7 1d bc 93 eb e5 bc 30 e7 74 .`...........0.t 0070 5c 85 61 ea 84 ef 75 d3 4d a8 25 c3 a0 dc b8 98 \.a...u.M.%..... 0080 37 cf 0e e1 e2 55 17 17 f5 0c 91 f1 60 9e 7f 20 7....U......`.. 0090 ba ff af b3 f4 43 79 dd c0 ef 44 05 a0 c5 1c 41 .....Cy...D....A 00a0 5c 03 26 7a b6 47 8d 8c cb 77 e5 5a 29 b8 9d 4d \.&z.G...w.Z)..M 00b0 a1 f5 38 59 50 a2 ec c7 4d 64 cd b2 5c 4d 92 1f ..8YP...Md..\M.. 00c0 82 cc b4 37 2a 49 c5 bd ad fa 25 44 ad 95 01 82 ...7*I....%D.... 00d0 bc b8 50 5b 35 d0 13 87 ..P[5... No. Time Source Destination Protocol Info 230 67.752533 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (94 bytes) Frame 230 (198 bytes on wire, 198 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 44320, Ack: 9142, Len: 144 Lightweight Directory Access Protocol SASL Buffer Length: 140 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFD5CD246218666D657D39F585344C0E3D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: D5CD246218666D65 krb5_sgn_cksum: 7D39F585344C0E3D krb5_confounder: 4A6940A86451785A GSS-API Encrypted payload (94 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 b8 2e 25 40 00 80 06 71 0f ac 1f 01 65 ac 1f ...%@...q....e.. 0020 01 68 01 85 07 f0 0b 69 00 9d d3 1c 2a 86 50 18 .h.....i....*.P. 0030 f5 c5 00 0d 00 00 00 00 00 8c 60 81 89 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 d5 cd 24 62 18 66 6d 65 7d 39 f5 85 34 4c 0e 3d ..$b.fme}9..4L.= 0060 4a 69 40 a8 64 51 78 5a 20 b4 a2 47 bd a2 30 cf Ji@.dQxZ ..G..0. 0070 44 88 15 fe 9f 3c 15 08 cb 23 0d 8b ef 08 e3 24 D....<...#.....$ 0080 c6 75 ee 9a 60 ee 25 50 1e d4 57 5e e0 56 2a 91 .u..`.%P..W^.V*. 0090 15 d6 e8 ff 9c 91 aa a0 bb 92 e6 ee b9 05 0f ca ................ 00a0 bf 66 7b 8b 7e 4d d6 de ca a6 b6 f9 ac 9d 02 4b .f{.~M.........K 00b0 4e 54 e8 bc d0 90 93 fd e0 74 c4 61 44 06 0d cd NT.......t.aD... 00c0 08 5b 7f e7 c2 af .[.... No. Time Source Destination Protocol Info 231 67.754383 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 231 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9142, Ack: 44464, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFD2C71ABD08270F8E0936A78837ACC76D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: D2C71ABD08270F8E krb5_sgn_cksum: 0936A78837ACC76D krb5_confounder: F22476533DDA1F05 GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 3c 40 00 80 06 bf 21 ac 1f 01 68 ac 1f ...<@....!...h.. 0020 01 65 07 f0 01 85 d3 1c 2a 86 0b 69 01 2d 50 18 .e......*..i.-P. 0030 f9 ae 7f 35 00 00 00 00 00 62 60 60 06 09 2a 86 ...5.....b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff d2 H............... 0050 c7 1a bd 08 27 0f 8e 09 36 a7 88 37 ac c7 6d f2 ....'...6..7..m. 0060 24 76 53 3d da 1f 05 b3 70 45 3e 42 56 ec 6d c3 $vS=....pE>BV.m. 0070 8a d8 41 ca 68 a5 11 d1 59 81 bd 16 3d a6 f7 eb ..A.h...Y...=... 0080 60 61 06 06 0a cc 6a 8e 92 86 1d 84 59 a1 e4 98 `a....j.....Y... 0090 93 e5 ad 40 49 7a a9 6b ef 79 93 83 ...@Iz.k.y.. No. Time Source Destination Protocol Info 232 67.755422 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 232 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 44464, Ack: 9244, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 26 40 00 80 06 6b ea ac 1f 01 65 ac 1f ...&@...k....e.. 0020 01 68 01 85 07 f0 0b 69 01 2d d3 1c 2a ec 50 10 .h.....i.-..*.P. 0030 f5 5f 59 17 00 00 00 00 09 dd 60 82 09 d9 06 09 ._Y.......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff b0 2d 91 e2 3c 2a 6e 5b fe c0 ed 8e c1 4c 23 ..-..<*n[.....L# 0060 0d bc 50 47 80 65 f0 4a cf db 1d b8 f4 cd bd b7 ..PG.e.J........ 0070 63 84 7f a2 3f a1 d4 ae aa c8 20 1f b8 ae 72 55 c...?..... ...rU 0080 1c 4b d2 bb 3d 17 b4 78 36 32 16 35 21 78 d9 84 .K..=..x62.5!x.. 0090 89 4f e0 40 82 e8 ff 5c 15 a0 31 8e 52 a7 14 c6 .O.@...\..1.R... 00a0 49 a4 b6 cc 26 16 17 15 66 8c 5a 0c 4c c5 fe a1 I...&...f.Z.L... 00b0 1f 38 8f f3 28 c1 87 0d 69 50 62 a9 0b 25 a9 a0 .8..(...iPb..%.. 00c0 4f 7b 76 bf 88 6f c2 dd fb b1 04 98 11 54 29 48 O{v..o.......T)H 00d0 72 d6 ed 45 81 b8 e9 4d c2 c9 59 8d 42 8c 59 04 r..E...M..Y.B.Y. 00e0 fa 6b e5 ef ae 09 3f 74 56 10 1c d4 90 6c 13 aa .k....?tV....l.. 00f0 9b 1d 7f 7d 24 d3 d2 a0 7b 42 d0 54 59 ee d3 78 ...}$...{B.TY..x 0100 ac 45 73 55 5b 58 0b 77 70 b0 d7 1e ab 44 aa 1a .EsU[X.wp....D.. 0110 0b 87 37 f3 9c 5c f3 52 4d 96 89 dd 80 3e 50 e1 ..7..\.RM....>P. 0120 d1 d8 49 55 18 70 62 2f c5 93 bc 75 44 05 11 f1 ..IU.pb/...uD... 0130 85 ab 31 23 fb 6f 9c a0 f6 24 a6 30 da 8c 51 d8 ..1#.o...$.0..Q. 0140 38 30 ab 2e b1 e6 fb f9 9d ec b8 5c ee 0d 5a 07 80.........\..Z. 0150 86 b7 47 29 38 75 cf be 9c c3 ea 70 98 f7 92 fa ..G)8u.....p.... 0160 e6 38 d9 db bf a9 a6 07 09 49 76 40 01 94 51 99 .8.......Iv@..Q. 0170 e4 56 bb 60 0c f2 e6 85 fc 1b 02 05 2c b9 c1 c9 .V.`........,... 0180 aa 2c ed 09 2c 6b 08 14 7a 9b f1 20 27 f6 43 9a .,..,k..z.. '.C. 0190 7a b0 8e bd 62 1e 74 86 17 67 65 69 d4 1a 47 74 z...b.t..gei..Gt 01a0 62 d4 ef 01 20 79 6f 25 66 22 75 e5 d4 c2 f3 41 b... yo%f"u....A 01b0 a3 db ef 9d 73 08 96 2b 46 4c 1a 96 eb 16 28 56 ....s..+FL....(V 01c0 5e f1 63 90 d1 7d 5d 0c 59 8f ca 26 07 95 ee 73 ^.c..}].Y..&...s 01d0 ce 3e 6f 63 89 df d6 7b 9d 9e 2f 0e 99 30 a9 09 .>oc...{../..0.. 01e0 93 38 7b 21 ff 12 42 c8 8a b3 f1 aa aa c2 15 57 .8{!..B........W 01f0 06 98 af e2 a9 d2 c8 42 e4 0c 0c b7 2c 1f 20 9d .......B....,. . 0200 da 79 4b a2 25 ce ec b5 77 9c 1a 44 f1 f0 23 e3 .yK.%...w..D..#. 0210 8e 3f f7 55 fc 9c 00 76 99 ce 4e 35 11 47 45 81 .?.U...v..N5.GE. 0220 e8 74 35 1d e0 15 bd b7 5c 82 54 71 16 d3 8f ce .t5.....\.Tq.... 0230 2f 2d fa 51 82 5f 8f b0 95 7e 14 30 86 47 e8 2a /-.Q._...~.0.G.* 0240 23 2b 61 17 0b c7 80 57 a4 42 e1 ba a3 ca a0 f6 #+a....W.B...... 0250 90 ad c3 48 af 42 d9 af c8 50 31 48 42 40 5e 4e ...H.B...P1HB@^N 0260 a5 6f bb 37 55 65 a1 99 ac ed 4e 0d 06 18 a3 f4 .o.7Ue....N..... 0270 23 05 76 6a a4 f4 22 02 dc b8 78 58 81 53 e3 62 #.vj.."...xX.S.b 0280 d5 8b 1c d2 b9 f1 61 8e 98 1e d0 84 22 d3 e5 10 ......a....."... 0290 6f 94 70 be 84 73 d4 44 27 58 0e 05 8c b3 bf 15 o.p..s.D'X...... 02a0 0d 82 00 e9 33 ac 09 45 2d fb fa 21 da ab d0 e8 ....3..E-..!.... 02b0 ee e5 8d 8b 90 b7 c0 07 4b f4 fa 0b 59 64 6a 4f ........K...YdjO 02c0 47 e6 eb c7 60 7d bf 91 71 35 53 c2 ba 7f ec 0c G...`}..q5S..... 02d0 97 1a 7f ff fd 56 ad 46 38 c6 8b 01 26 73 09 3d .....V.F8...&s.= 02e0 ae 4f d4 e9 6c 18 fa 93 17 c7 9f de ff 95 6d 95 .O..l.........m. 02f0 08 f5 50 b7 04 cc d0 9f 2a 29 ab e7 0f 0c 7b 52 ..P.....*)....{R 0300 9e f3 af b7 38 1e 16 d1 cf f0 b8 2d d0 17 aa b1 ....8......-.... 0310 8b bc 85 91 f2 e9 06 2c f2 6a e9 45 de ff 65 e4 .......,.j.E..e. 0320 f4 0f 12 58 df 8f ce 32 1d 14 da b5 7f 62 d7 cd ...X...2.....b.. 0330 b0 6e 8d bc 7a a4 ec 59 60 53 31 da ba 99 c6 f6 .n..z..Y`S1..... 0340 ad 54 20 65 5c 6b 18 36 10 b3 39 30 3c e1 1c f9 .T e\k.6..90<... 0350 6a 98 4f 2a b4 6a ff 2c 98 2a 92 b5 9e 9a e7 a8 j.O*.j.,.*...... 0360 5e 25 2a 9d 13 94 f3 62 28 ef a6 f4 99 05 14 50 ^%*....b(......P 0370 6b ae 4e 37 e4 36 f0 ed 79 d7 99 a5 44 3b 02 26 k.N7.6..y...D;.& 0380 39 fb 66 da 55 0e 16 dd 5e 67 ba 23 c0 9a ad a3 9.f.U...^g.#.... 0390 8e f7 86 e6 b5 df 7c 82 9b ae e6 49 28 fa 09 89 ......|....I(... 03a0 8e 28 4c 4f 4e ce 8e 10 b8 f1 b0 21 6b 5d 02 80 .(LON......!k].. 03b0 b5 25 a7 48 5e 55 00 57 92 db b6 13 9e 91 02 88 .%.H^U.W........ 03c0 2d c0 b5 b1 34 e1 c6 8a 30 03 57 f7 e3 f6 72 ae -...4...0.W...r. 03d0 d1 53 dc 0c dd 87 db 69 28 93 c9 9b 5c 4b 0c 87 .S.....i(...\K.. 03e0 89 fc bc 4e 03 4c 1d 10 7b 83 18 68 91 b7 ab 3c ...N.L..{..h...< 03f0 8e 84 d4 95 67 e8 8d e3 cf f6 83 5e 9d 41 97 50 ....g......^.A.P 0400 e8 76 cc ef 6a 04 8c 81 5b 9b a5 b1 a9 37 a0 43 .v..j...[....7.C 0410 71 ae 57 cc bd 27 a3 5d d6 b8 7d 3a 0d de 37 48 q.W..'.]..}:..7H 0420 b3 b5 0c e7 4f ef eb 4c be e3 93 4f 45 12 cd f2 ....O..L...OE... 0430 82 00 c3 c4 17 61 f9 9a df 38 8b b5 d1 d5 ae 0c .....a...8...... 0440 a1 85 26 cb 9d 73 f9 22 37 24 b0 e1 99 9e 6e 77 ..&..s."7$....nw 0450 e8 6d c3 27 85 ec 0d b9 cd e4 6d fe ed ec 45 5b .m.'......m...E[ 0460 c5 88 7b b4 85 de 4a 7a 00 58 f2 82 7e e5 2c 68 ..{...Jz.X..~.,h 0470 3b e1 72 14 68 d3 bb 09 8e 78 3c d0 1a f9 f7 68 ;.r.h....x<....h 0480 4e 9c db f3 8f 84 4b 2b de f0 2e ca 8c 1d 9e ad N.....K+........ 0490 83 a0 c4 f6 54 4d 29 1e 34 e4 fa 71 31 5f fe 60 ....TM).4..q1_.` 04a0 57 e7 56 3d 4b 41 38 9d 42 21 53 6d 5a 2a 6e 7b W.V=KA8.B!SmZ*n{ 04b0 27 07 2c 0f 53 7e db c7 95 14 18 66 73 ba 5b fe '.,.S~.....fs.[. 04c0 30 d4 4b 8f fa 8f c5 58 73 af cc 42 b8 c2 2a 81 0.K....Xs..B..*. 04d0 a1 f4 8e 4e 18 09 40 44 cf dc 68 b4 76 c4 f0 1f ...N..@D..h.v... 04e0 2f 11 39 24 ba 0b 98 e2 3c 6e 61 0b 2b 03 ff a9 /.9$......<.. 02b0 af 10 97 99 5b aa cc 30 9a 11 a9 9e 86 02 88 79 ....[..0.......y 02c0 0b 54 5b 81 eb 2c 37 51 b0 0f 8c 51 3b 4f c9 6d .T[..,7Q...Q;O.m 02d0 d4 16 34 24 29 a9 83 31 c6 2e e5 c1 f9 84 4b b8 ..4$)..1......K. 02e0 fd 1e d1 a9 c6 37 d8 75 31 47 4f b1 24 1d a9 2a .....7.u1GO.$..* 02f0 47 14 fb 87 c5 c9 87 a1 79 f9 e6 c0 13 98 3f 3c G.......y.....?< 0300 62 10 eb 2e 4a 39 71 b4 41 3b 8f 7a 77 b2 fc ae b...J9q.A;.zw... 0310 2c 27 b8 5a 8e 86 95 63 c6 9d 70 59 a4 24 55 27 ,'.Z...c..pY.$U' 0320 72 2a 19 73 41 9a fb f2 93 ac 6c 89 7c cb 4d 4c r*.sA.....l.|.ML 0330 ea 48 91 86 b8 47 54 83 77 13 51 58 6f a9 70 66 .H...GT.w.QXo.pf 0340 0e f5 20 4e 85 d1 1d 15 70 d0 8d 11 e6 6b e6 91 .. N....p....k.. 0350 02 b2 55 dd 3a c5 86 7d 8d 1e ed 9b 94 2d 89 af ..U.:..}.....-.. 0360 21 03 fa cd fb a2 db b1 60 10 68 fb 87 f8 1e e8 !.......`.h..... 0370 c1 c7 7b 54 42 bc 9e 6b 1d ab 8b f0 68 da f3 d8 ..{TB..k....h... 0380 08 66 54 5e ad 48 7b ee 89 76 03 25 84 1d 29 7d .fT^.H{..v.%..)} 0390 6f 1a cd 06 00 41 d7 69 0f 53 cb 86 96 c0 51 13 o....A.i.S....Q. 03a0 a3 ad bf f7 87 f8 c0 21 3d 1e bc cb ba 50 9d c2 .......!=....P.. 03b0 ea 8c 39 3c f0 7b 0f 46 f4 d8 e2 87 c9 b0 de 21 ..9<.{.F.......! 03c0 b2 25 84 51 68 b4 41 7b 54 fd ef 66 07 dc 22 b5 .%.Qh.A{T..f..". 03d0 b9 df ca dd 71 df ff b2 5a 5f 61 e1 ca 49 bd 92 ....q...Z_a..I.. 03e0 f0 6b d9 98 9f f9 5a 8d a8 bb 3d b5 b6 75 9c 4c .k....Z...=..u.L 03f0 96 27 b4 41 35 72 e2 36 4a 54 c8 3b 77 c7 19 0c .'.A5r.6JT.;w... 0400 a5 c0 d3 13 02 7f 23 7c 9f 84 ce 55 e3 5a da b9 ......#|...U.Z.. 0410 8f e3 69 ed 98 b9 4a 11 52 fe 18 df 6f 99 f5 9c ..i...J.R...o... 0420 8e 73 1d 23 b8 2a fc 86 0a ce b3 44 42 94 62 bf .s.#.*.....DB.b. 0430 34 bc f5 99 46 b1 d5 74 c3 40 c7 79 14 33 19 b4 4...F..t.@.y.3.. 0440 f7 db 4f d4 6c b8 e6 4a df 88 ed 04 cf 1a 90 4b ..O.l..J.......K 0450 4a 96 96 ca 74 ab 7e 35 7c 3b 6b 31 2f a3 cc 0a J...t.~5|;k1/... 0460 c5 79 f4 .y. Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff b0 2d 91 e2 3c ............-..< 0020 2a 6e 5b fe c0 ed 8e c1 4c 23 0d bc 50 47 80 65 *n[.....L#..PG.e 0030 f0 4a cf db 1d b8 f4 cd bd b7 63 84 7f a2 3f a1 .J........c...?. 0040 d4 ae aa c8 20 1f b8 ae 72 55 1c 4b d2 bb 3d 17 .... ...rU.K..=. 0050 b4 78 36 32 16 35 21 78 d9 84 89 4f e0 40 82 e8 .x62.5!x...O.@.. 0060 ff 5c 15 a0 31 8e 52 a7 14 c6 49 a4 b6 cc 26 16 .\..1.R...I...&. 0070 17 15 66 8c 5a 0c 4c c5 fe a1 1f 38 8f f3 28 c1 ..f.Z.L....8..(. 0080 87 0d 69 50 62 a9 0b 25 a9 a0 4f 7b 76 bf 88 6f ..iPb..%..O{v..o 0090 c2 dd fb b1 04 98 11 54 29 48 72 d6 ed 45 81 b8 .......T)Hr..E.. 00a0 e9 4d c2 c9 59 8d 42 8c 59 04 fa 6b e5 ef ae 09 .M..Y.B.Y..k.... 00b0 3f 74 56 10 1c d4 90 6c 13 aa 9b 1d 7f 7d 24 d3 ?tV....l.....}$. 00c0 d2 a0 7b 42 d0 54 59 ee d3 78 ac 45 73 55 5b 58 ..{B.TY..x.EsU[X 00d0 0b 77 70 b0 d7 1e ab 44 aa 1a 0b 87 37 f3 9c 5c .wp....D....7..\ 00e0 f3 52 4d 96 89 dd 80 3e 50 e1 d1 d8 49 55 18 70 .RM....>P...IU.p 00f0 62 2f c5 93 bc 75 44 05 11 f1 85 ab 31 23 fb 6f b/...uD.....1#.o 0100 9c a0 f6 24 a6 30 da 8c 51 d8 38 30 ab 2e b1 e6 ...$.0..Q.80.... 0110 fb f9 9d ec b8 5c ee 0d 5a 07 86 b7 47 29 38 75 .....\..Z...G)8u 0120 cf be 9c c3 ea 70 98 f7 92 fa e6 38 d9 db bf a9 .....p.....8.... 0130 a6 07 09 49 76 40 01 94 51 99 e4 56 bb 60 0c f2 ...Iv@..Q..V.`.. 0140 e6 85 fc 1b 02 05 2c b9 c1 c9 aa 2c ed 09 2c 6b ......,....,..,k 0150 08 14 7a 9b f1 20 27 f6 43 9a 7a b0 8e bd 62 1e ..z.. '.C.z...b. 0160 74 86 17 67 65 69 d4 1a 47 74 62 d4 ef 01 20 79 t..gei..Gtb... y 0170 6f 25 66 22 75 e5 d4 c2 f3 41 a3 db ef 9d 73 08 o%f"u....A....s. 0180 96 2b 46 4c 1a 96 eb 16 28 56 5e f1 63 90 d1 7d .+FL....(V^.c..} 0190 5d 0c 59 8f ca 26 07 95 ee 73 ce 3e 6f 63 89 df ].Y..&...s.>oc.. 01a0 d6 7b 9d 9e 2f 0e 99 30 a9 09 93 38 7b 21 ff 12 .{../..0...8{!.. 01b0 42 c8 8a b3 f1 aa aa c2 15 57 06 98 af e2 a9 d2 B........W...... 01c0 c8 42 e4 0c 0c b7 2c 1f 20 9d da 79 4b a2 25 ce .B....,. ..yK.%. 01d0 ec b5 77 9c 1a 44 f1 f0 23 e3 8e 3f f7 55 fc 9c ..w..D..#..?.U.. 01e0 00 76 99 ce 4e 35 11 47 45 81 e8 74 35 1d e0 15 .v..N5.GE..t5... 01f0 bd b7 5c 82 54 71 16 d3 8f ce 2f 2d fa 51 82 5f ..\.Tq..../-.Q._ 0200 8f b0 95 7e 14 30 86 47 e8 2a 23 2b 61 17 0b c7 ...~.0.G.*#+a... 0210 80 57 a4 42 e1 ba a3 ca a0 f6 90 ad c3 48 af 42 .W.B.........H.B 0220 d9 af c8 50 31 48 42 40 5e 4e a5 6f bb 37 55 65 ...P1HB@^N.o.7Ue 0230 a1 99 ac ed 4e 0d 06 18 a3 f4 23 05 76 6a a4 f4 ....N.....#.vj.. 0240 22 02 dc b8 78 58 81 53 e3 62 d5 8b 1c d2 b9 f1 "...xX.S.b...... 0250 61 8e 98 1e d0 84 22 d3 e5 10 6f 94 70 be 84 73 a....."...o.p..s 0260 d4 44 27 58 0e 05 8c b3 bf 15 0d 82 00 e9 33 ac .D'X..........3. 0270 09 45 2d fb fa 21 da ab d0 e8 ee e5 8d 8b 90 b7 .E-..!.......... 0280 c0 07 4b f4 fa 0b 59 64 6a 4f 47 e6 eb c7 60 7d ..K...YdjOG...`} 0290 bf 91 71 35 53 c2 ba 7f ec 0c 97 1a 7f ff fd 56 ..q5S..........V 02a0 ad 46 38 c6 8b 01 26 73 09 3d ae 4f d4 e9 6c 18 .F8...&s.=.O..l. 02b0 fa 93 17 c7 9f de ff 95 6d 95 08 f5 50 b7 04 cc ........m...P... 02c0 d0 9f 2a 29 ab e7 0f 0c 7b 52 9e f3 af b7 38 1e ..*)....{R....8. 02d0 16 d1 cf f0 b8 2d d0 17 aa b1 8b bc 85 91 f2 e9 .....-.......... 02e0 06 2c f2 6a e9 45 de ff 65 e4 f4 0f 12 58 df 8f .,.j.E..e....X.. 02f0 ce 32 1d 14 da b5 7f 62 d7 cd b0 6e 8d bc 7a a4 .2.....b...n..z. 0300 ec 59 60 53 31 da ba 99 c6 f6 ad 54 20 65 5c 6b .Y`S1......T e\k 0310 18 36 10 b3 39 30 3c e1 1c f9 6a 98 4f 2a b4 6a .6..90<...j.O*.j 0320 ff 2c 98 2a 92 b5 9e 9a e7 a8 5e 25 2a 9d 13 94 .,.*......^%*... 0330 f3 62 28 ef a6 f4 99 05 14 50 6b ae 4e 37 e4 36 .b(......Pk.N7.6 0340 f0 ed 79 d7 99 a5 44 3b 02 26 39 fb 66 da 55 0e ..y...D;.&9.f.U. 0350 16 dd 5e 67 ba 23 c0 9a ad a3 8e f7 86 e6 b5 df ..^g.#.......... 0360 7c 82 9b ae e6 49 28 fa 09 89 8e 28 4c 4f 4e ce |....I(....(LON. 0370 8e 10 b8 f1 b0 21 6b 5d 02 80 b5 25 a7 48 5e 55 .....!k]...%.H^U 0380 00 57 92 db b6 13 9e 91 02 88 2d c0 b5 b1 34 e1 .W........-...4. 0390 c6 8a 30 03 57 f7 e3 f6 72 ae d1 53 dc 0c dd 87 ..0.W...r..S.... 03a0 db 69 28 93 c9 9b 5c 4b 0c 87 89 fc bc 4e 03 4c .i(...\K.....N.L 03b0 1d 10 7b 83 18 68 91 b7 ab 3c 8e 84 d4 95 67 e8 ..{..h...<....g. 03c0 8d e3 cf f6 83 5e 9d 41 97 50 e8 76 cc ef 6a 04 .....^.A.P.v..j. 03d0 8c 81 5b 9b a5 b1 a9 37 a0 43 71 ae 57 cc bd 27 ..[....7.Cq.W..' 03e0 a3 5d d6 b8 7d 3a 0d de 37 48 b3 b5 0c e7 4f ef .]..}:..7H....O. 03f0 eb 4c be e3 93 4f 45 12 cd f2 82 00 c3 c4 17 61 .L...OE........a 0400 f9 9a df 38 8b b5 d1 d5 ae 0c a1 85 26 cb 9d 73 ...8........&..s 0410 f9 22 37 24 b0 e1 99 9e 6e 77 e8 6d c3 27 85 ec ."7$....nw.m.'.. 0420 0d b9 cd e4 6d fe ed ec 45 5b c5 88 7b b4 85 de ....m...E[..{... 0430 4a 7a 00 58 f2 82 7e e5 2c 68 3b e1 72 14 68 d3 Jz.X..~.,h;.r.h. 0440 bb 09 8e 78 3c d0 1a f9 f7 68 4e 9c db f3 8f 84 ...x<....hN..... 0450 4b 2b de f0 2e ca 8c 1d 9e ad 83 a0 c4 f6 54 4d K+............TM 0460 29 1e 34 e4 fa 71 31 5f fe 60 57 e7 56 3d 4b 41 ).4..q1_.`W.V=KA 0470 38 9d 42 21 53 6d 5a 2a 6e 7b 27 07 2c 0f 53 7e 8.B!SmZ*n{'.,.S~ 0480 db c7 95 14 18 66 73 ba 5b fe 30 d4 4b 8f fa 8f .....fs.[.0.K... 0490 c5 58 73 af cc 42 b8 c2 2a 81 a1 f4 8e 4e 18 09 .Xs..B..*....N.. 04a0 40 44 cf dc 68 b4 76 c4 f0 1f 2f 11 39 24 ba 0b @D..h.v.../.9$.. 04b0 98 e2 3c 6e 61 0b 2b 03 ff a9 3c 28 eb 79 aa 8d ....<.... 0830 97 99 5b aa cc 30 9a 11 a9 9e 86 02 88 79 0b 54 ..[..0.......y.T 0840 5b 81 eb 2c 37 51 b0 0f 8c 51 3b 4f c9 6d d4 16 [..,7Q...Q;O.m.. 0850 34 24 29 a9 83 31 c6 2e e5 c1 f9 84 4b b8 fd 1e 4$)..1......K... 0860 d1 a9 c6 37 d8 75 31 47 4f b1 24 1d a9 2a 47 14 ...7.u1GO.$..*G. 0870 fb 87 c5 c9 87 a1 79 f9 e6 c0 13 98 3f 3c 62 10 ......y.....? ldap [ACK] Seq=9244 Ack=46993 Win=64240 Len=0 Frame 234 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9244, Ack: 46993, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 3d 40 00 80 06 bf 86 ac 1f 01 68 ac 1f .(.=@........h.. 0020 01 65 07 f0 01 85 d3 1c 2a ec 0b 69 0b 0e 50 10 .e......*..i..P. 0030 fa f0 3b e3 00 00 02 04 05 b4 01 01 ..;......... No. Time Source Destination Protocol Info 235 67.758702 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (161 bytes) Frame 235 (265 bytes on wire, 265 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9244, Ack: 46993, Len: 211 Lightweight Directory Access Protocol SASL Buffer Length: 207 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF712521E2FF081499B547913268A3F2D5... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 712521E2FF081499 krb5_sgn_cksum: B547913268A3F2D5 krb5_confounder: 98BC072F95460871 GSS-API Encrypted payload (161 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fb e0 3e 40 00 80 06 be b2 ac 1f 01 68 ac 1f ...>@........h.. 0020 01 65 07 f0 01 85 d3 1c 2a ec 0b 69 0b 0e 50 18 .e......*..i..P. 0030 fa f0 3f 5f 00 00 00 00 00 cf 60 81 cc 06 09 2a ..?_......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 71 25 21 e2 ff 08 14 99 b5 47 91 32 68 a3 f2 d5 q%!......G.2h... 0060 98 bc 07 2f 95 46 08 71 d5 2f d1 ea f0 69 b3 95 .../.F.q./...i.. 0070 bf 46 a3 fa 90 2a 74 bc 96 92 7d c4 19 2c fe 5a .F...*t...}..,.Z 0080 fd e7 54 f9 9f 2b 35 ba 15 d0 be 79 de f6 2c b6 ..T..+5....y..,. 0090 e6 7a 0a 98 46 7f f1 66 8c 62 8b 81 d4 33 8c 8c .z..F..f.b...3.. 00a0 11 a4 3e 05 fb 29 bf 33 78 e3 d7 c5 33 64 16 0b ..>..).3x...3d.. 00b0 75 27 d1 7d ab e3 9a fe d6 89 37 34 f5 7a 86 58 u'.}......74.z.X 00c0 b0 9e c1 fb 4b 33 09 5f 8d cc 6f 0f cb c3 66 14 ....K3._..o...f. 00d0 40 cf c9 8d 74 65 b4 0d 9b 3f 8c c7 cc e9 8f 7d @...te...?.....} 00e0 0d bb b7 e8 fc 11 89 96 d0 7b fa b6 b6 ae 6f 75 .........{....ou 00f0 95 d7 66 f7 3d 8a ac 52 1d db 72 c2 b6 d7 c9 53 ..f.=..R..r....S 0100 6b ad 33 30 19 c6 2d 11 f0 k.30..-.. No. Time Source Destination Protocol Info 236 67.759759 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (268 bytes) Frame 236 (373 bytes on wire, 373 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 46993, Ack: 9455, Len: 319 Lightweight Directory Access Protocol SASL Buffer Length: 315 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF9A4F27C9F572206D02F1FE6598B8D536... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 9A4F27C9F572206D krb5_sgn_cksum: 02F1FE6598B8D536 krb5_confounder: F6D221CAD46DFD0F GSS-API Encrypted payload (268 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 67 2e 28 40 00 80 06 70 5d ac 1f 01 65 ac 1f .g.(@...p]...e.. 0020 01 68 01 85 07 f0 0b 69 0b 0e d3 1c 2b bf 50 18 .h.....i....+.P. 0030 fa f0 57 41 00 00 00 00 01 3b 60 82 01 37 06 09 ..WA.....;`..7.. 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 9a 4f 27 c9 f5 72 20 6d 02 f1 fe 65 98 b8 d5 ..O'..r m...e... 0060 36 f6 d2 21 ca d4 6d fd 0f b4 b9 9c 5a ea d1 e8 6..!..m.....Z... 0070 ca 70 88 6b 0b 8b 5b 65 4b 03 ad 93 ef 0d 55 74 .p.k..[eK.....Ut 0080 ee 38 cd 62 1a 55 8b 0a 94 eb a3 ca 19 6e 89 41 .8.b.U.......n.A 0090 80 c9 59 cb f1 93 76 3f fd fe c9 43 02 5c 80 46 ..Y...v?...C.\.F 00a0 b6 e8 f8 69 45 d4 b5 84 1b dd ce cf eb fb 5b b3 ...iE.........[. 00b0 7b f9 69 e5 82 1c 96 9a 81 bd 19 1e 61 dd e4 2b {.i.........a..+ 00c0 a0 c9 92 90 1c d8 ee d3 e7 3b ff 18 b8 48 f2 d8 .........;...H.. 00d0 e6 35 bc 88 42 1d 7d 01 aa 09 91 82 de ff 1a 93 .5..B.}......... 00e0 9b 63 75 63 df db dc 7a 07 ad 58 ba a0 b7 4d 5f .cuc...z..X...M_ 00f0 5f 7e 2d 65 0c ce 39 29 f1 d5 66 fc c4 b0 c0 2c _~-e..9)..f...., 0100 99 83 4a 12 6f 9a 0b 67 47 ab 5d ad 1a 51 1b 6e ..J.o..gG.]..Q.n 0110 f3 8e d9 4b 26 e3 08 a0 cb a7 b7 1c 99 ff 1b 8f ...K&........... 0120 a2 cc 1e 44 db 99 04 59 64 f4 1f 6f d0 98 33 92 ...D...Yd..o..3. 0130 e2 c3 2c 2d bf 14 c1 34 fc e6 0a e4 bd ad f8 60 ..,-...4.......` 0140 3d 9f 20 c7 a9 01 37 15 5b 80 bf f0 dd 15 d6 96 =. ...7.[....... 0150 ce 0e 28 0e b1 cc 44 45 65 6f 9b 47 fe ed 25 82 ..(...DEeo.G..%. 0160 21 95 e7 10 82 9b 1a d8 01 34 cf f7 18 e6 f9 3b !........4.....; 0170 cd 70 e4 67 db .p.g. No. Time Source Destination Protocol Info 237 67.761234 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (161 bytes) Frame 237 (265 bytes on wire, 265 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9455, Ack: 47312, Len: 211 Lightweight Directory Access Protocol SASL Buffer Length: 207 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF27B4A6E7A0C8C8E9B77FF576052077E0... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 27B4A6E7A0C8C8E9 krb5_sgn_cksum: B77FF576052077E0 krb5_confounder: 8581E301BFD18097 GSS-API Encrypted payload (161 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 fb e0 3f 40 00 80 06 be b1 ac 1f 01 68 ac 1f ...?@........h.. 0020 01 65 07 f0 01 85 d3 1c 2b bf 0b 69 0c 4d 50 18 .e......+..i.MP. 0030 f9 b1 05 0f 00 00 00 00 00 cf 60 81 cc 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 27 b4 a6 e7 a0 c8 c8 e9 b7 7f f5 76 05 20 77 e0 '..........v. w. 0060 85 81 e3 01 bf d1 80 97 42 04 1c a0 2c 40 2c a1 ........B...,@,. 0070 dd 81 97 ea 82 43 76 be ee 9b 0d 47 c9 8b a6 4b .....Cv....G...K 0080 51 1d 40 04 d3 10 8f 67 dd 33 57 c4 d4 26 12 f1 Q.@....g.3W..&.. 0090 52 d3 fd b6 c7 96 83 93 6e 2c f1 d5 8e ea 82 45 R.......n,.....E 00a0 05 05 db 41 5e b9 cc 60 29 27 d9 7a 6c c8 37 9e ...A^..`)'.zl.7. 00b0 cf 72 1e 99 53 b9 52 95 c0 03 21 8f 95 1a 1a d6 .r..S.R...!..... 00c0 54 c7 61 9a 2b b2 23 2d 5b 6f 6b d0 d2 b3 04 e3 T.a.+.#-[ok..... 00d0 8c a4 34 c4 ac f2 a6 8d 8c 78 c8 fa c5 27 ab 6d ..4......x...'.m 00e0 bb 2b 56 f8 d2 f9 6c 74 d6 cb 71 1e 74 cb 83 4a .+V...lt..q.t..J 00f0 9e a4 00 71 2a 2b a6 2e 44 3e d1 96 1a 2a 55 c5 ...q*+..D>...*U. 0100 77 7c 98 4e 4f f2 f1 18 d2 w|.NO.... No. Time Source Destination Protocol Info 238 67.762086 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (191 bytes) Frame 238 (295 bytes on wire, 295 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 47312, Ack: 9666, Len: 241 Lightweight Directory Access Protocol SASL Buffer Length: 237 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF4DBEF6D322F785B264BFEA687C16A7AC... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 4DBEF6D322F785B2 krb5_sgn_cksum: 64BFEA687C16A7AC krb5_confounder: B6E690B8DDBD2A88 GSS-API Encrypted payload (191 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 01 19 2e 29 40 00 80 06 70 aa ac 1f 01 65 ac 1f ...)@...p....e.. 0020 01 68 01 85 07 f0 0b 69 0c 4d d3 1c 2c 92 50 18 .h.....i.M..,.P. 0030 fa 1d 1d 6d 00 00 00 00 00 ed 60 81 ea 06 09 2a ...m......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 4d be f6 d3 22 f7 85 b2 64 bf ea 68 7c 16 a7 ac M..."...d..h|... 0060 b6 e6 90 b8 dd bd 2a 88 cf 9f 3d 7f b4 d7 a1 12 ......*...=..... 0070 4e 36 52 cb 78 0c ba 48 e8 73 3a 48 9d 55 3d fe N6R.x..H.s:H.U=. 0080 2f 3f 8c c2 26 82 fe 2e 89 5f 20 a5 16 57 b3 08 /?..&...._ ..W.. 0090 10 4c 25 72 db 89 17 16 71 eb 4f 8b 09 bb 81 24 .L%r....q.O....$ 00a0 3b ce c6 a0 94 82 c1 5b 2b 9f 21 5c 24 ef a4 b3 ;......[+.!\$... 00b0 f8 35 37 bd 56 7e 5e bd e9 db de 65 02 b1 0d 02 .57.V~^....e.... 00c0 87 51 8f b4 18 8e 88 91 91 d4 95 62 b7 a4 cb a7 .Q.........b.... 00d0 82 08 66 6b c9 bc f7 f5 6b ff 46 4a 03 cc 6c eb ..fk....k.FJ..l. 00e0 58 63 bb b4 82 05 9f cd f7 e3 a9 e7 d3 d3 54 c4 Xc............T. 00f0 27 87 fa ac a5 b0 63 57 60 e9 77 84 4e 61 2c a2 '.....cW`.w.Na,. 0100 cf 2a 93 91 0b bc 5e 51 26 df 85 75 d1 1f 27 5b .*....^Q&..u..'[ 0110 0a 2c e3 17 92 40 70 0b bf 32 d5 bb 04 bf 09 ef .,...@p..2...... 0120 22 d6 d6 14 9e b0 5e ".....^ No. Time Source Destination Protocol Info 239 67.762899 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (195 bytes) Frame 239 (299 bytes on wire, 299 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9666, Ack: 47553, Len: 245 Lightweight Directory Access Protocol SASL Buffer Length: 241 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF30DE6CE9AA85EFC94164C5A4F3A28052... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 30DE6CE9AA85EFC9 krb5_sgn_cksum: 4164C5A4F3A28052 krb5_confounder: 602749913A9E29EC GSS-API Encrypted payload (195 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 01 1d e0 40 40 00 80 06 be 8e ac 1f 01 68 ac 1f ...@@........h.. 0020 01 65 07 f0 01 85 d3 1c 2c 92 0b 69 0d 3e 50 18 .e......,..i.>P. 0030 f8 c0 25 c9 00 00 00 00 00 f1 60 81 ee 06 09 2a ..%.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 30 de 6c e9 aa 85 ef c9 41 64 c5 a4 f3 a2 80 52 0.l.....Ad.....R 0060 60 27 49 91 3a 9e 29 ec 53 c3 dc 12 c6 40 a3 98 `'I.:.).S....@.. 0070 83 7c 58 4d 57 80 a8 5f e7 39 df ae da 08 33 6b .|XMW.._.9....3k 0080 66 1a f1 d7 3a 68 14 4f fb b0 1e 32 4c ef c7 d0 f...:h.O...2L... 0090 23 3c a6 5e 16 59 ad 4f e7 d1 7e 24 82 f6 af bc #<.^.Y.O..~$.... 00a0 d8 a1 d7 24 a8 e8 fb bd 31 21 c7 6b b4 db 58 49 ...$....1!.k..XI 00b0 61 cb 91 fc 23 36 7c b0 95 ef 85 52 08 19 8e da a...#6|....R.... 00c0 50 a4 a7 c1 5f 23 62 e2 22 c6 88 e3 e8 87 f2 f8 P..._#b."....... 00d0 b7 2e 4b db 70 d9 16 f6 db e9 bc ec 87 2f 7f 8e ..K.p......../.. 00e0 b0 12 d3 13 4d 4a 52 02 9e 2d 7c 38 b2 50 92 66 ....MJR..-|8.P.f 00f0 0d c6 97 78 a5 bf 3e 3e f4 8b d4 5c e9 f1 8f 25 ...x..>>...\...% 0100 14 92 fa 64 88 80 37 54 d9 63 ed 8f 30 fc 3f 12 ...d..7T.c..0.?. 0110 bf 69 b9 d4 77 12 44 ce 48 2e 62 a5 9d c1 68 42 .i..w.D.H.b...hB 0120 6e d9 ad c8 90 56 bd df 66 d3 5a n....V..f.Z No. Time Source Destination Protocol Info 240 67.764032 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 240 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 47553, Ack: 9911, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 2a 40 00 80 06 6b e6 ac 1f 01 65 ac 1f ...*@...k....e.. 0020 01 68 01 85 07 f0 0b 69 0d 3e d3 1c 2d 87 50 10 .h.....i.>..-.P. 0030 f9 28 54 f3 00 00 00 00 09 21 60 82 09 1d 06 09 .(T......!`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 61 5f 59 4f 99 10 61 82 03 b4 4b 7a 41 e1 60 .a_YO..a...KzA.` 0060 27 17 ce c7 1c a8 d1 f6 1f a3 af e3 e8 fc 07 e9 '............... 0070 b2 bf 97 d8 02 42 dc 51 8b 8c de 37 81 a7 ab 29 .....B.Q...7...) 0080 55 29 78 3a 41 c5 a4 05 bd 94 fd 8b 6c 36 0f 9f U)x:A.......l6.. 0090 e0 4f 11 60 ce 83 61 34 73 ed 7e 43 0a a3 a6 31 .O.`..a4s.~C...1 00a0 88 6b f2 43 8e e2 1e c4 18 04 91 c5 82 15 8e 17 .k.C............ 00b0 10 2e d8 f0 17 bf 16 c3 e7 38 b6 a8 1b c0 04 b6 .........8...... 00c0 d8 12 79 15 23 d0 e4 86 ef c4 1d 5b 46 04 f0 9f ..y.#......[F... 00d0 ad b8 6c 79 dc d8 9c bd a5 e1 91 71 45 bf ba 2a ..ly.......qE..* 00e0 cb f7 53 3c f2 6b 5c 22 57 9a df 6a a6 20 bf 63 ..S<.k\"W..j. .c 00f0 69 cf b4 b3 e0 28 95 37 b4 12 c8 65 6d ff 85 95 i....(.7...em... 0100 32 e6 4a 02 1c 7f e9 81 a0 07 a8 7e 7f 1e 86 b3 2.J........~.... 0110 f0 15 4f 2e d8 39 47 bd e2 fc df dd e6 a3 c3 cb ..O..9G......... 0120 89 7f 02 15 2f 5f ce 48 fd 25 6b f5 0e a1 53 53 ..../_.H.%k...SS 0130 38 63 56 b3 50 ab 57 bd 7b 69 09 93 bd 90 0c 1c 8cV.P.W.{i...... 0140 b1 c7 65 2f 7d 85 1f 37 7a 90 fb c5 da e7 f9 23 ..e/}..7z......# 0150 b4 5b 65 8e 93 7b b1 f3 d0 a4 52 4d 54 51 27 ff .[e..{....RMTQ'. 0160 1e a1 e1 8d ab 74 2d c2 09 24 96 06 24 99 37 14 .....t-..$..$.7. 0170 eb 54 7c 13 2c 9a 09 39 22 24 ba 8a 1d 12 d6 cc .T|.,..9"$...... 0180 89 43 58 68 86 fb b6 83 30 7c f9 bb 3b f2 01 74 .CXh....0|..;..t 0190 90 eb f9 ca 8f e5 6c 55 92 68 9c bf ee df 41 41 ......lU.h....AA 01a0 cf 78 e3 7b 9e 12 33 8f e8 f5 8a 5d b5 e7 79 3f .x.{..3....]..y? 01b0 c9 14 28 16 0a ea b6 de 45 fe d0 11 13 f9 89 bd ..(.....E....... 01c0 e8 91 e8 84 00 07 b6 8d 02 31 16 69 ff aa da ef .........1.i.... 01d0 6f 84 b7 22 74 2e 22 d6 f8 0e 08 ac f0 78 c6 75 o.."t."......x.u 01e0 87 55 cf 9c 4f 57 ff d7 7b 1d 72 d5 54 ee 9b d2 .U..OW..{.r.T... 01f0 37 1a a0 32 b7 88 e5 d1 60 f7 b6 0d 97 e8 9f 25 7..2....`......% 0200 e7 58 b2 97 07 59 f0 f3 c4 e7 03 b7 0a 1d 28 7a .X...Y........(z 0210 db b4 a0 e8 dc 0f 09 61 49 f7 0f ac 84 95 a0 bf .......aI....... 0220 9b 9e a9 1e 5b d1 cf 76 44 db be d8 1d 81 b0 9d ....[..vD....... 0230 df b6 fe 4a 8e 5a 0a ab 7f 20 b7 1c 29 30 3a cf ...J.Z... ..)0:. 0240 8d 91 4b 63 d5 a4 38 f6 48 81 9e 7a 6a a5 4f cb ..Kc..8.H..zj.O. 0250 9e 47 9c 66 ba 81 0b 33 28 84 ec 58 f8 49 2c 45 .G.f...3(..X.I,E 0260 e3 f9 ba 22 ed de 34 ba 6d 20 94 c3 b0 f5 71 1a ..."..4.m ....q. 0270 6e 17 76 f6 22 57 f7 2e ad 21 4a 7d 71 8a cf 13 n.v."W...!J}q... 0280 18 58 25 5e 2c 5a ad 48 42 9f 2c 6c 73 d1 ff 02 .X%^,Z.HB.,ls... 0290 34 73 9d 6f ad 19 68 c3 2c fa 0f eb 7b 14 83 9d 4s.o..h.,...{... 02a0 8c 5c a6 e9 e4 89 d3 28 35 3b c5 3d a1 e8 00 e1 .\.....(5;.=.... 02b0 ed 33 d5 52 17 d1 77 bc 9c 6e 84 5c 91 44 8f 98 .3.R..w..n.\.D.. 02c0 cc 8e bb c9 45 9c db 45 54 b8 54 e6 53 01 c2 30 ....E..ET.T.S..0 02d0 a1 8b 50 1f 44 99 d5 c0 a0 1c bb 25 ce 0b 2a 0b ..P.D......%..*. 02e0 43 9e 2c a2 18 01 f6 92 83 56 95 6b c4 e1 3b c7 C.,......V.k..;. 02f0 2a fa b0 c2 55 d8 c0 44 00 bc 94 84 0a 58 1a ae *...U..D.....X.. 0300 39 69 e5 09 1a a7 17 94 1f ea ed c9 2e a7 e0 51 9i.............Q 0310 75 f2 3b db fb c3 71 15 95 73 13 d2 d9 94 40 39 u.;...q..s....@9 0320 14 93 37 80 3f f1 d1 94 0e ad c1 0b 57 62 92 09 ..7.?.......Wb.. 0330 25 c8 38 90 ab a6 7c 52 b2 4d 56 75 cf b9 ec 17 %.8...|R.MVu.... 0340 07 10 dd fb c9 36 60 ae 75 14 8b cf 8c 2a 7a c9 .....6`.u....*z. 0350 2a d3 ed 51 98 b8 a4 cd 4f 80 3b ce 84 93 cf 5d *..Q....O.;....] 0360 9f 63 07 cf ec 26 0e c6 3c a5 dd 2a 12 e1 7a ae .c...&..<..*..z. 0370 02 49 a4 51 2a 0d 5a 54 36 cc d7 9c 91 d1 9e 3b .I.Q*.ZT6......; 0380 54 42 f0 43 fb dc 3c a7 0d df 3e e7 39 60 52 7f TB.C..<...>.9`R. 0390 a7 f3 3f a6 4f ad 9d 4f d4 89 e0 64 e1 a7 0b 36 ..?.O..O...d...6 03a0 98 1d 57 18 92 02 12 de 00 0f f0 5f 0f bf 23 f6 ..W........_..#. 03b0 b6 b9 3b 0d 87 09 69 43 83 24 10 66 9d 55 ad e9 ..;...iC.$.f.U.. 03c0 c1 84 58 6a 34 5f 39 71 05 2c 24 2f 27 97 10 7f ..Xj4_9q.,$/'... 03d0 33 48 07 8d 13 3c 8a 47 d3 89 9b 1f 7b 34 14 73 3H...<.G....{4.s 03e0 c9 15 3b 9d 2e 57 5a 5c 51 7b 52 10 96 c9 99 5d ..;..WZ\Q{R....] 03f0 4d 57 a0 5f a2 57 c7 f3 6f 21 d0 b6 c8 e7 df 25 MW._.W..o!.....% 0400 a4 14 35 a1 b8 f8 5e 9b 87 97 32 5e 73 04 77 2d ..5...^...2^s.w- 0410 28 7d 6e 95 29 fa 70 c1 35 a3 d7 8d 1e 22 9e 44 (}n.).p.5....".D 0420 fb 9e a3 c6 83 b3 c9 9f 5f 8d 11 76 f0 bd a9 30 ........_..v...0 0430 52 da c9 85 92 54 d8 b5 4c 08 d5 4e 8e a0 b4 47 R....T..L..N...G 0440 b2 73 0f a5 f1 5a 69 39 85 3a 48 ac 9a 5a 6a 17 .s...Zi9.:H..Zj. 0450 2c b8 94 e7 67 c7 3f 76 8d 70 fb e3 92 3b f1 e2 ,...g.?v.p...;.. 0460 0a 2e 8b 51 52 8a 8c 8f 66 b2 b8 bf 48 e4 06 26 ...QR...f...H..& 0470 ac ac 36 84 de 5b ce 79 f6 80 ce bb 01 46 fd df ..6..[.y.....F.. 0480 d7 85 f6 7c d5 7a c4 8c 8a 9c 99 06 0c 51 9b 08 ...|.z.......Q.. 0490 6e 3c 94 de 0c 8b 73 21 af 6b 67 1a 04 09 29 e8 n<....s!.kg...). 04a0 aa 7c cf b1 ab 77 a5 5c 1c 90 d4 dd b0 fd 2f 60 .|...w.\....../` 04b0 46 fe 9b 75 e7 b6 7e cd 11 f2 b9 43 22 5c 5c 7c F..u..~....C"\\| 04c0 0b 81 0c 6a f4 95 c1 6a c5 62 f0 0d 3b 0d 01 6e ...j...j.b..;..n 04d0 76 2b e5 71 a7 95 9b 52 b8 6e 8a b8 cd 80 08 fc v+.q...R.n...... 04e0 bc 29 7b 6a 31 1b 98 99 ed 74 ff e5 66 9e 3f cf .){j1....t..f.?. 04f0 62 26 6d 1e de 68 84 62 c8 47 a7 ab 06 c7 a7 b3 b&m..h.b.G...... 0500 7a c9 b3 6a c5 2a 47 23 f7 a9 48 b5 e0 77 f4 29 z..j.*G#..H..w.) 0510 8b 34 d0 c5 16 1a 0d f7 14 42 f8 29 a7 1d 47 67 .4.......B.)..Gg 0520 e2 e9 50 d3 90 d9 61 84 01 4d c8 db 7b 0a 38 c8 ..P...a..M..{.8. 0530 7d 22 1c a0 59 f5 1f c1 f9 66 92 b7 95 34 84 33 }"..Y....f...4.3 0540 09 06 fb b1 00 d4 95 77 56 c8 6c f0 98 f8 df 3a .......wV.l....: 0550 00 d9 ef 9f 55 34 53 7a 7e c2 a5 06 51 5c 28 95 ....U4Sz~...Q\(. 0560 0f ef 1d 27 fc b1 47 d3 2b ca ed 3c bb 89 5d ef ...'..G.+..<..]. 0570 dc 6b a5 e7 01 4f 8e ac 6b 03 29 df 68 42 15 2c .k...O..k.).hB., 0580 87 f2 fa f9 05 41 58 bb d4 aa 8e 51 fd 30 32 97 .....AX....Q.02. 0590 aa c4 be b6 18 53 5b 64 39 26 92 1a 00 f1 4c 3b .....S[d9&....L; 05a0 76 b2 b6 e6 57 6b f5 e2 3b 2c c2 ea e4 06 0f 90 v...Wk..;,...... 05b0 15 e4 63 90 a4 e3 e5 35 ee b5 fb e0 26 78 f4 cc ..c....5....&x.. 05c0 0b 2e b2 85 e7 a5 75 9c 10 fd f4 ee 9e 0f 00 85 ......u......... 05d0 c2 1f 47 d7 a8 44 3d 12 a7 65 82 42 c2 cf 75 c2 ..G..D=..e.B..u. 05e0 56 ce 81 f7 36 0c 5e 7e 4b e5 V...6.^~K. No. Time Source Destination Protocol Info 241 67.764132 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (2290 bytes) Frame 241 (935 bytes on wire, 935 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 49013, Ack: 9911, Len: 881 Lightweight Directory Access Protocol SASL Buffer Length: 2337 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF615F594F9910618203B44B7A41E16027... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 615F594F99106182 krb5_sgn_cksum: 03B44B7A41E16027 krb5_confounder: 17CEC71CA8D1F61F GSS-API Encrypted payload (2290 bytes) Frame (935 bytes): 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 03 99 2e 2b 40 00 80 06 6e 28 ac 1f 01 65 ac 1f ...+@...n(...e.. 0020 01 68 01 85 07 f0 0b 69 12 f2 d3 1c 2d 87 50 18 .h.....i....-.P. 0030 f9 28 ce 8c 00 00 67 3f 7c 7d 24 47 d6 38 6c 4e .(....g?|}$G.8lN 0040 2d e4 3a b8 eb 56 a4 e3 8f 94 50 96 c2 99 6b d6 -.:..V....P...k. 0050 9a d9 e7 fd ed 7a 57 76 0a 41 28 9f e9 9f 50 f9 .....zWv.A(...P. 0060 16 6f 61 05 45 ba 3c 8e 77 62 6d 1d ea 46 fb 75 .oa.E.<.wbm..F.u 0070 87 5a 29 0f 10 66 35 42 97 6f fd 26 6c f3 55 42 .Z)..f5B.o.&l.UB 0080 7b 25 d2 2b 8a aa e2 42 70 26 38 84 7d 9c 0c 5e {%.+...Bp&8.}..^ 0090 2c be 7a 96 05 48 93 85 af ef 42 ce d7 79 b6 a8 ,.z..H....B..y.. 00a0 06 8c 98 42 a0 47 ee d5 88 b0 84 95 5a f1 43 dc ...B.G......Z.C. 00b0 f8 69 ac 0f 37 cc 9e aa 12 1b 27 b4 ae ef f1 26 .i..7.....'....& 00c0 42 eb b3 ce 4d 3f c1 5e 66 06 30 62 25 ea 12 c4 B...M?.^f.0b%... 00d0 94 11 5c 83 b6 70 93 d9 a9 13 53 9a e4 1d cf c9 ..\..p....S..... 00e0 6b 81 fd e2 b8 74 1e 31 44 8c db 09 f6 58 74 e9 k....t.1D....Xt. 00f0 bf 08 d1 d4 39 db f0 b5 de 68 d1 e5 e6 cf b9 ed ....9....h...... 0100 ce a1 3b 64 c8 6e c2 76 da 3e 20 fa 26 c6 1a 9c ..;d.n.v.> .&... 0110 4e 8d 68 31 35 81 ef 4d 9f 1c d6 c7 22 40 06 e8 N.h15..M...."@.. 0120 1d 9d 53 61 d6 02 27 0d e3 34 b0 25 60 98 da b0 ..Sa..'..4.%`... 0130 a1 df f8 9e f3 a6 2b 19 45 88 26 0f d2 fb 16 aa ......+.E.&..... 0140 df 34 9e c4 de 3d be f3 50 ad 25 dc 32 cf fb 09 .4...=..P.%.2... 0150 db da e2 58 c1 de 0e f6 61 aa 63 1f b8 72 a3 84 ...X....a.c..r.. 0160 b2 ff b9 01 b5 9d 37 a4 23 cd 2b c9 3f e0 d1 e4 ......7.#.+.?... 0170 4f a1 1a 96 6c dd 89 99 09 10 d9 7b ee 4d 65 b9 O...l......{.Me. 0180 32 e3 f4 a6 f1 b6 87 3d c1 a1 ff b9 c5 26 c9 34 2......=.....&.4 0190 42 58 15 10 b7 82 b1 26 1b 19 13 89 95 77 bc c8 BX.....&.....w.. 01a0 67 ca cf 09 23 a4 70 91 d1 c8 2d f1 f9 14 26 f5 g...#.p...-...&. 01b0 5c 3e 00 88 30 36 ec f8 e5 c8 9a e2 5a fe e0 36 \>..06......Z..6 01c0 b0 ad 4b 39 6c 66 0e 5b d3 78 7d fe 9c bb 0f 8a ..K9lf.[.x}..... 01d0 2c 78 a4 81 64 28 2c a6 3a 2d 29 4d a5 bc 1a 92 ,x..d(,.:-)M.... 01e0 0d 96 20 35 73 5f d6 66 61 91 eb 95 b0 c6 1b 0c .. 5s_.fa....... 01f0 48 c8 e2 08 d6 25 18 b4 0d d4 cd c0 a8 f4 f5 92 H....%.......... 0200 0a 31 3c e3 d6 3e 6e e3 ed 49 47 9d 0e 6c f4 5f .1<..>n..IG..l._ 0210 f3 60 79 b2 5a f2 cc 57 e0 6f 8c cf 67 cd 9e 3f .`y.Z..W.o..g..? 0220 86 0c f7 13 9a bc f1 0a 34 0f 15 a8 66 e3 3c 0b ........4...f.<. 0230 9f 75 04 ef ca 44 2d 00 e8 dd f3 ba f9 38 1f 50 .u...D-......8.P 0240 97 3e 03 aa 84 7a 9d 99 c9 9e d5 55 fc 16 b1 bb .>...z.....U.... 0250 2b 9a 5a e5 09 07 f8 73 b7 ef 20 35 0b b6 fa 25 +.Z....s.. 5...% 0260 30 59 d1 d3 1d bd fd ec bf c0 d2 8a df 20 87 a7 0Y........... .. 0270 9d 15 82 eb bc b8 7e 57 72 93 9b 31 91 be 9b 38 ......~Wr..1...8 0280 c2 43 72 78 85 a4 a8 1f 31 cb 9d 54 1b 75 30 04 .Crx....1..T.u0. 0290 b9 6c ba ad 19 fd 5c f8 fe 67 4c ff dc 4a 73 ac .l....\..gL..Js. 02a0 0c 94 ae 2c 00 10 c6 c6 0b 14 f9 1d d2 27 00 16 ...,.........'.. 02b0 b0 4f 43 0f f9 eb 4c bc d5 09 28 e8 56 97 ec 66 .OC...L...(.V..f 02c0 57 fe aa 2d e7 ac d0 55 e2 4a da 09 8b d9 05 b1 W..-...U.J...... 02d0 68 ad 9f fa e2 7b 8e f5 55 ff ad 55 63 ea 21 f8 h....{..U..Uc.!. 02e0 b0 11 f9 33 75 cd e1 42 4d d3 92 e7 bc 6a 43 7a ...3u..BM....jCz 02f0 fc 91 3c 44 56 68 cc 24 e6 4b 48 c1 83 ac 5b ca ....`.l 0350 b6 f3 30 67 b1 bb 29 aa ae e1 21 27 9e 2f a5 d5 ..0g..)...!'./.. 0360 ba f1 4b 1f 74 66 7d c2 1a 78 03 78 2b 5c d4 34 ..K.tf}..x.x+\.4 0370 96 fa 4b 7a 2b b5 44 fc 89 1f 9e 5f de 7a 7d 0e ..Kz+.D...._.z}. 0380 fb 54 ca d1 af 08 43 84 d1 28 9d 4c 14 da b5 79 .T....C..(.L...y 0390 38 c5 6a 40 ea 82 92 c5 2d 5b 55 7e 6b 3b 05 ff 8.j@....-[U~k;.. 03a0 e1 c6 4f f9 14 e7 08 ..O.... Reassembled TCP (2341 bytes): 0000 00 00 09 21 60 82 09 1d 06 09 2a 86 48 86 f7 12 ...!`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 61 5f 59 4f 99 ...........a_YO. 0020 10 61 82 03 b4 4b 7a 41 e1 60 27 17 ce c7 1c a8 .a...KzA.`'..... 0030 d1 f6 1f a3 af e3 e8 fc 07 e9 b2 bf 97 d8 02 42 ...............B 0040 dc 51 8b 8c de 37 81 a7 ab 29 55 29 78 3a 41 c5 .Q...7...)U)x:A. 0050 a4 05 bd 94 fd 8b 6c 36 0f 9f e0 4f 11 60 ce 83 ......l6...O.`.. 0060 61 34 73 ed 7e 43 0a a3 a6 31 88 6b f2 43 8e e2 a4s.~C...1.k.C.. 0070 1e c4 18 04 91 c5 82 15 8e 17 10 2e d8 f0 17 bf ................ 0080 16 c3 e7 38 b6 a8 1b c0 04 b6 d8 12 79 15 23 d0 ...8........y.#. 0090 e4 86 ef c4 1d 5b 46 04 f0 9f ad b8 6c 79 dc d8 .....[F.....ly.. 00a0 9c bd a5 e1 91 71 45 bf ba 2a cb f7 53 3c f2 6b .....qE..*..S<.k 00b0 5c 22 57 9a df 6a a6 20 bf 63 69 cf b4 b3 e0 28 \"W..j. .ci....( 00c0 95 37 b4 12 c8 65 6d ff 85 95 32 e6 4a 02 1c 7f .7...em...2.J... 00d0 e9 81 a0 07 a8 7e 7f 1e 86 b3 f0 15 4f 2e d8 39 .....~......O..9 00e0 47 bd e2 fc df dd e6 a3 c3 cb 89 7f 02 15 2f 5f G............./_ 00f0 ce 48 fd 25 6b f5 0e a1 53 53 38 63 56 b3 50 ab .H.%k...SS8cV.P. 0100 57 bd 7b 69 09 93 bd 90 0c 1c b1 c7 65 2f 7d 85 W.{i........e/}. 0110 1f 37 7a 90 fb c5 da e7 f9 23 b4 5b 65 8e 93 7b .7z......#.[e..{ 0120 b1 f3 d0 a4 52 4d 54 51 27 ff 1e a1 e1 8d ab 74 ....RMTQ'......t 0130 2d c2 09 24 96 06 24 99 37 14 eb 54 7c 13 2c 9a -..$..$.7..T|.,. 0140 09 39 22 24 ba 8a 1d 12 d6 cc 89 43 58 68 86 fb .9"$.......CXh.. 0150 b6 83 30 7c f9 bb 3b f2 01 74 90 eb f9 ca 8f e5 ..0|..;..t...... 0160 6c 55 92 68 9c bf ee df 41 41 cf 78 e3 7b 9e 12 lU.h....AA.x.{.. 0170 33 8f e8 f5 8a 5d b5 e7 79 3f c9 14 28 16 0a ea 3....]..y?..(... 0180 b6 de 45 fe d0 11 13 f9 89 bd e8 91 e8 84 00 07 ..E............. 0190 b6 8d 02 31 16 69 ff aa da ef 6f 84 b7 22 74 2e ...1.i....o.."t. 01a0 22 d6 f8 0e 08 ac f0 78 c6 75 87 55 cf 9c 4f 57 "......x.u.U..OW 01b0 ff d7 7b 1d 72 d5 54 ee 9b d2 37 1a a0 32 b7 88 ..{.r.T...7..2.. 01c0 e5 d1 60 f7 b6 0d 97 e8 9f 25 e7 58 b2 97 07 59 ..`......%.X...Y 01d0 f0 f3 c4 e7 03 b7 0a 1d 28 7a db b4 a0 e8 dc 0f ........(z...... 01e0 09 61 49 f7 0f ac 84 95 a0 bf 9b 9e a9 1e 5b d1 .aI...........[. 01f0 cf 76 44 db be d8 1d 81 b0 9d df b6 fe 4a 8e 5a .vD..........J.Z 0200 0a ab 7f 20 b7 1c 29 30 3a cf 8d 91 4b 63 d5 a4 ... ..)0:...Kc.. 0210 38 f6 48 81 9e 7a 6a a5 4f cb 9e 47 9c 66 ba 81 8.H..zj.O..G.f.. 0220 0b 33 28 84 ec 58 f8 49 2c 45 e3 f9 ba 22 ed de .3(..X.I,E...".. 0230 34 ba 6d 20 94 c3 b0 f5 71 1a 6e 17 76 f6 22 57 4.m ....q.n.v."W 0240 f7 2e ad 21 4a 7d 71 8a cf 13 18 58 25 5e 2c 5a ...!J}q....X%^,Z 0250 ad 48 42 9f 2c 6c 73 d1 ff 02 34 73 9d 6f ad 19 .HB.,ls...4s.o.. 0260 68 c3 2c fa 0f eb 7b 14 83 9d 8c 5c a6 e9 e4 89 h.,...{....\.... 0270 d3 28 35 3b c5 3d a1 e8 00 e1 ed 33 d5 52 17 d1 .(5;.=.....3.R.. 0280 77 bc 9c 6e 84 5c 91 44 8f 98 cc 8e bb c9 45 9c w..n.\.D......E. 0290 db 45 54 b8 54 e6 53 01 c2 30 a1 8b 50 1f 44 99 .ET.T.S..0..P.D. 02a0 d5 c0 a0 1c bb 25 ce 0b 2a 0b 43 9e 2c a2 18 01 .....%..*.C.,... 02b0 f6 92 83 56 95 6b c4 e1 3b c7 2a fa b0 c2 55 d8 ...V.k..;.*...U. 02c0 c0 44 00 bc 94 84 0a 58 1a ae 39 69 e5 09 1a a7 .D.....X..9i.... 02d0 17 94 1f ea ed c9 2e a7 e0 51 75 f2 3b db fb c3 .........Qu.;... 02e0 71 15 95 73 13 d2 d9 94 40 39 14 93 37 80 3f f1 q..s....@9..7.?. 02f0 d1 94 0e ad c1 0b 57 62 92 09 25 c8 38 90 ab a6 ......Wb..%.8... 0300 7c 52 b2 4d 56 75 cf b9 ec 17 07 10 dd fb c9 36 |R.MVu.........6 0310 60 ae 75 14 8b cf 8c 2a 7a c9 2a d3 ed 51 98 b8 `.u....*z.*..Q.. 0320 a4 cd 4f 80 3b ce 84 93 cf 5d 9f 63 07 cf ec 26 ..O.;....].c...& 0330 0e c6 3c a5 dd 2a 12 e1 7a ae 02 49 a4 51 2a 0d ..<..*..z..I.Q*. 0340 5a 54 36 cc d7 9c 91 d1 9e 3b 54 42 f0 43 fb dc ZT6......;TB.C.. 0350 3c a7 0d df 3e e7 39 60 52 7f a7 f3 3f a6 4f ad <...>.9`R...?.O. 0360 9d 4f d4 89 e0 64 e1 a7 0b 36 98 1d 57 18 92 02 .O...d...6..W... 0370 12 de 00 0f f0 5f 0f bf 23 f6 b6 b9 3b 0d 87 09 ....._..#...;... 0380 69 43 83 24 10 66 9d 55 ad e9 c1 84 58 6a 34 5f iC.$.f.U....Xj4_ 0390 39 71 05 2c 24 2f 27 97 10 7f 33 48 07 8d 13 3c 9q.,$/'...3H...< 03a0 8a 47 d3 89 9b 1f 7b 34 14 73 c9 15 3b 9d 2e 57 .G....{4.s..;..W 03b0 5a 5c 51 7b 52 10 96 c9 99 5d 4d 57 a0 5f a2 57 Z\Q{R....]MW._.W 03c0 c7 f3 6f 21 d0 b6 c8 e7 df 25 a4 14 35 a1 b8 f8 ..o!.....%..5... 03d0 5e 9b 87 97 32 5e 73 04 77 2d 28 7d 6e 95 29 fa ^...2^s.w-(}n.). 03e0 70 c1 35 a3 d7 8d 1e 22 9e 44 fb 9e a3 c6 83 b3 p.5....".D...... 03f0 c9 9f 5f 8d 11 76 f0 bd a9 30 52 da c9 85 92 54 .._..v...0R....T 0400 d8 b5 4c 08 d5 4e 8e a0 b4 47 b2 73 0f a5 f1 5a ..L..N...G.s...Z 0410 69 39 85 3a 48 ac 9a 5a 6a 17 2c b8 94 e7 67 c7 i9.:H..Zj.,...g. 0420 3f 76 8d 70 fb e3 92 3b f1 e2 0a 2e 8b 51 52 8a ?v.p...;.....QR. 0430 8c 8f 66 b2 b8 bf 48 e4 06 26 ac ac 36 84 de 5b ..f...H..&..6..[ 0440 ce 79 f6 80 ce bb 01 46 fd df d7 85 f6 7c d5 7a .y.....F.....|.z 0450 c4 8c 8a 9c 99 06 0c 51 9b 08 6e 3c 94 de 0c 8b .......Q..n<.... 0460 73 21 af 6b 67 1a 04 09 29 e8 aa 7c cf b1 ab 77 s!.kg...)..|...w 0470 a5 5c 1c 90 d4 dd b0 fd 2f 60 46 fe 9b 75 e7 b6 .\....../`F..u.. 0480 7e cd 11 f2 b9 43 22 5c 5c 7c 0b 81 0c 6a f4 95 ~....C"\\|...j.. 0490 c1 6a c5 62 f0 0d 3b 0d 01 6e 76 2b e5 71 a7 95 .j.b..;..nv+.q.. 04a0 9b 52 b8 6e 8a b8 cd 80 08 fc bc 29 7b 6a 31 1b .R.n.......){j1. 04b0 98 99 ed 74 ff e5 66 9e 3f cf 62 26 6d 1e de 68 ...t..f.?.b&m..h 04c0 84 62 c8 47 a7 ab 06 c7 a7 b3 7a c9 b3 6a c5 2a .b.G......z..j.* 04d0 47 23 f7 a9 48 b5 e0 77 f4 29 8b 34 d0 c5 16 1a G#..H..w.).4.... 04e0 0d f7 14 42 f8 29 a7 1d 47 67 e2 e9 50 d3 90 d9 ...B.)..Gg..P... 04f0 61 84 01 4d c8 db 7b 0a 38 c8 7d 22 1c a0 59 f5 a..M..{.8.}"..Y. 0500 1f c1 f9 66 92 b7 95 34 84 33 09 06 fb b1 00 d4 ...f...4.3...... 0510 95 77 56 c8 6c f0 98 f8 df 3a 00 d9 ef 9f 55 34 .wV.l....:....U4 0520 53 7a 7e c2 a5 06 51 5c 28 95 0f ef 1d 27 fc b1 Sz~...Q\(....'.. 0530 47 d3 2b ca ed 3c bb 89 5d ef dc 6b a5 e7 01 4f G.+..<..]..k...O 0540 8e ac 6b 03 29 df 68 42 15 2c 87 f2 fa f9 05 41 ..k.).hB.,.....A 0550 58 bb d4 aa 8e 51 fd 30 32 97 aa c4 be b6 18 53 X....Q.02......S 0560 5b 64 39 26 92 1a 00 f1 4c 3b 76 b2 b6 e6 57 6b [d9&....L;v...Wk 0570 f5 e2 3b 2c c2 ea e4 06 0f 90 15 e4 63 90 a4 e3 ..;,........c... 0580 e5 35 ee b5 fb e0 26 78 f4 cc 0b 2e b2 85 e7 a5 .5....&x........ 0590 75 9c 10 fd f4 ee 9e 0f 00 85 c2 1f 47 d7 a8 44 u...........G..D 05a0 3d 12 a7 65 82 42 c2 cf 75 c2 56 ce 81 f7 36 0c =..e.B..u.V...6. 05b0 5e 7e 4b e5 67 3f 7c 7d 24 47 d6 38 6c 4e 2d e4 ^~K.g?|}$G.8lN-. 05c0 3a b8 eb 56 a4 e3 8f 94 50 96 c2 99 6b d6 9a d9 :..V....P...k... 05d0 e7 fd ed 7a 57 76 0a 41 28 9f e9 9f 50 f9 16 6f ...zWv.A(...P..o 05e0 61 05 45 ba 3c 8e 77 62 6d 1d ea 46 fb 75 87 5a a.E.<.wbm..F.u.Z 05f0 29 0f 10 66 35 42 97 6f fd 26 6c f3 55 42 7b 25 )..f5B.o.&l.UB{% 0600 d2 2b 8a aa e2 42 70 26 38 84 7d 9c 0c 5e 2c be .+...Bp&8.}..^,. 0610 7a 96 05 48 93 85 af ef 42 ce d7 79 b6 a8 06 8c z..H....B..y.... 0620 98 42 a0 47 ee d5 88 b0 84 95 5a f1 43 dc f8 69 .B.G......Z.C..i 0630 ac 0f 37 cc 9e aa 12 1b 27 b4 ae ef f1 26 42 eb ..7.....'....&B. 0640 b3 ce 4d 3f c1 5e 66 06 30 62 25 ea 12 c4 94 11 ..M?.^f.0b%..... 0650 5c 83 b6 70 93 d9 a9 13 53 9a e4 1d cf c9 6b 81 \..p....S.....k. 0660 fd e2 b8 74 1e 31 44 8c db 09 f6 58 74 e9 bf 08 ...t.1D....Xt... 0670 d1 d4 39 db f0 b5 de 68 d1 e5 e6 cf b9 ed ce a1 ..9....h........ 0680 3b 64 c8 6e c2 76 da 3e 20 fa 26 c6 1a 9c 4e 8d ;d.n.v.> .&...N. 0690 68 31 35 81 ef 4d 9f 1c d6 c7 22 40 06 e8 1d 9d h15..M...."@.... 06a0 53 61 d6 02 27 0d e3 34 b0 25 60 98 da b0 a1 df Sa..'..4.%`..... 06b0 f8 9e f3 a6 2b 19 45 88 26 0f d2 fb 16 aa df 34 ....+.E.&......4 06c0 9e c4 de 3d be f3 50 ad 25 dc 32 cf fb 09 db da ...=..P.%.2..... 06d0 e2 58 c1 de 0e f6 61 aa 63 1f b8 72 a3 84 b2 ff .X....a.c..r.... 06e0 b9 01 b5 9d 37 a4 23 cd 2b c9 3f e0 d1 e4 4f a1 ....7.#.+.?...O. 06f0 1a 96 6c dd 89 99 09 10 d9 7b ee 4d 65 b9 32 e3 ..l......{.Me.2. 0700 f4 a6 f1 b6 87 3d c1 a1 ff b9 c5 26 c9 34 42 58 .....=.....&.4BX 0710 15 10 b7 82 b1 26 1b 19 13 89 95 77 bc c8 67 ca .....&.....w..g. 0720 cf 09 23 a4 70 91 d1 c8 2d f1 f9 14 26 f5 5c 3e ..#.p...-...&.\> 0730 00 88 30 36 ec f8 e5 c8 9a e2 5a fe e0 36 b0 ad ..06......Z..6.. 0740 4b 39 6c 66 0e 5b d3 78 7d fe 9c bb 0f 8a 2c 78 K9lf.[.x}.....,x 0750 a4 81 64 28 2c a6 3a 2d 29 4d a5 bc 1a 92 0d 96 ..d(,.:-)M...... 0760 20 35 73 5f d6 66 61 91 eb 95 b0 c6 1b 0c 48 c8 5s_.fa.......H. 0770 e2 08 d6 25 18 b4 0d d4 cd c0 a8 f4 f5 92 0a 31 ...%...........1 0780 3c e3 d6 3e 6e e3 ed 49 47 9d 0e 6c f4 5f f3 60 <..>n..IG..l._.` 0790 79 b2 5a f2 cc 57 e0 6f 8c cf 67 cd 9e 3f 86 0c y.Z..W.o..g..?.. 07a0 f7 13 9a bc f1 0a 34 0f 15 a8 66 e3 3c 0b 9f 75 ......4...f.<..u 07b0 04 ef ca 44 2d 00 e8 dd f3 ba f9 38 1f 50 97 3e ...D-......8.P.> 07c0 03 aa 84 7a 9d 99 c9 9e d5 55 fc 16 b1 bb 2b 9a ...z.....U....+. 07d0 5a e5 09 07 f8 73 b7 ef 20 35 0b b6 fa 25 30 59 Z....s.. 5...%0Y 07e0 d1 d3 1d bd fd ec bf c0 d2 8a df 20 87 a7 9d 15 ........... .... 07f0 82 eb bc b8 7e 57 72 93 9b 31 91 be 9b 38 c2 43 ....~Wr..1...8.C 0800 72 78 85 a4 a8 1f 31 cb 9d 54 1b 75 30 04 b9 6c rx....1..T.u0..l 0810 ba ad 19 fd 5c f8 fe 67 4c ff dc 4a 73 ac 0c 94 ....\..gL..Js... 0820 ae 2c 00 10 c6 c6 0b 14 f9 1d d2 27 00 16 b0 4f .,.........'...O 0830 43 0f f9 eb 4c bc d5 09 28 e8 56 97 ec 66 57 fe C...L...(.V..fW. 0840 aa 2d e7 ac d0 55 e2 4a da 09 8b d9 05 b1 68 ad .-...U.J......h. 0850 9f fa e2 7b 8e f5 55 ff ad 55 63 ea 21 f8 b0 11 ...{..U..Uc.!... 0860 f9 33 75 cd e1 42 4d d3 92 e7 bc 6a 43 7a fc 91 .3u..BM....jCz.. 0870 3c 44 56 68 cc 24 e6 4b 48 c1 83 ac 5b ca 31 53 ..`.l.. 08d0 30 67 b1 bb 29 aa ae e1 21 27 9e 2f a5 d5 ba f1 0g..)...!'./.... 08e0 4b 1f 74 66 7d c2 1a 78 03 78 2b 5c d4 34 96 fa K.tf}..x.x+\.4.. 08f0 4b 7a 2b b5 44 fc 89 1f 9e 5f de 7a 7d 0e fb 54 Kz+.D...._.z}..T 0900 ca d1 af 08 43 84 d1 28 9d 4c 14 da b5 79 38 c5 ....C..(.L...y8. 0910 6a 40 ea 82 92 c5 2d 5b 55 7e 6b 3b 05 ff e1 c6 j@....-[U~k;.... 0920 4f f9 14 e7 08 O.... No. Time Source Destination Protocol Info 242 67.764439 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=9911 Ack=49894 Win=64240 Len=0 Frame 242 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9911, Ack: 49894, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 41 40 00 80 06 bf 82 ac 1f 01 68 ac 1f .(.A@........h.. 0020 01 65 07 f0 01 85 d3 1c 2d 87 0b 69 16 63 50 10 .e......-..i.cP. 0030 fa f0 2d f3 00 00 00 00 01 34 60 82 ..-......4`. No. Time Source Destination Protocol Info 243 67.766000 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (53 bytes) Frame 243 (156 bytes on wire, 156 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 9911, Ack: 49894, Len: 102 Lightweight Directory Access Protocol SASL Buffer Length: 98 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF484812BDEE74A069E9F9FB4C1A3B0D6D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 484812BDEE74A069 krb5_sgn_cksum: E9F9FB4C1A3B0D6D krb5_confounder: ADB9BE13AF2DD456 GSS-API Encrypted payload (53 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 8e e0 42 40 00 80 06 bf 1b ac 1f 01 68 ac 1f ...B@........h.. 0020 01 65 07 f0 01 85 d3 1c 2d 87 0b 69 16 63 50 18 .e......-..i.cP. 0030 fa f0 df 27 00 00 00 00 00 62 60 60 06 09 2a 86 ...'.....b``..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff 48 H..............H 0050 48 12 bd ee 74 a0 69 e9 f9 fb 4c 1a 3b 0d 6d ad H...t.i...L.;.m. 0060 b9 be 13 af 2d d4 56 39 32 dd 03 1a 06 72 85 4e ....-.V92....r.N 0070 64 d5 cc f6 ed 9c f8 e5 aa 2a 8b ea 6d e2 fa 34 d........*..m..4 0080 14 be f7 d8 08 48 b9 39 00 30 e0 84 16 20 95 ff .....H.9.0... .. 0090 28 36 0f 99 10 94 81 89 a0 4e 16 d2 (6.......N.. No. Time Source Destination Protocol Info 244 67.766907 172.31.1.101 172.31.1.104 TCP [TCP segment of a reassembled PDU] Frame 244 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 49894, Ack: 10013, Len: 1460 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 05 dc 2e 2c 40 00 80 06 6b e4 ac 1f 01 65 ac 1f ...,@...k....e.. 0020 01 68 01 85 07 f0 0b 69 16 63 d3 1c 2d ed 50 10 .h.....i.c..-.P. 0030 f8 c2 52 f5 00 00 00 00 09 dd 60 82 09 d9 06 09 ..R.......`..... 0040 2a 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff *.H............. 0050 ff 72 2f 97 6b 24 5a 40 a2 3b 81 79 d3 e1 f8 32 .r/.k$Z@.;.y...2 0060 98 ca b7 08 fe 83 59 61 aa 52 51 99 0d 8b f8 7a ......Ya.RQ....z 0070 1e a0 bc fa 9d 41 16 0d b8 be d1 f9 4b 17 3a 7f .....A......K.:. 0080 94 12 66 fd 5b 61 c5 f2 cd 00 dc 30 66 40 97 f6 ..f.[a.....0f@.. 0090 c6 dd a1 aa 88 34 bd aa 5a ce 11 6d 0c 3a 4e 3e .....4..Z..m.:N> 00a0 c8 1d 43 23 36 a7 8d 41 f8 86 02 17 14 0d a7 e2 ..C#6..A........ 00b0 96 0c d1 f0 d5 73 d3 83 3b 8a 0f 26 08 43 b8 32 .....s..;..&.C.2 00c0 8c 04 39 78 86 8a 15 b9 5a 71 15 76 41 7c e6 d5 ..9x....Zq.vA|.. 00d0 07 64 05 64 7b f1 71 58 3c 6f 0a 22 ca e6 37 91 .d.d{.qX....Z, 01b0 5a b6 08 eb 13 2c f6 a9 15 9d db f7 f1 61 ec bc Z....,.......a.. 01c0 5e 11 07 b3 f3 32 cc 98 ac 12 92 41 9e 17 63 72 ^....2.....A..cr 01d0 1b cd 4d 76 98 f7 e7 71 7d 9b 64 6b ca 3f eb 3e ..Mv...q}.dk.?.> 01e0 df a1 8b 78 c1 31 02 c1 42 65 b5 d3 ba f3 e9 78 ...x.1..Be.....x 01f0 26 2a eb 83 fd 01 db 24 ba a2 fa 60 84 3f 37 ce &*.....$...`.?7. 0200 0e 7d 44 cc ac 16 83 f4 9e 69 32 90 af c6 7b 5a .}D......i2...{Z 0210 01 6a f8 9e 25 3a b0 91 53 f8 5f 1e ab 25 77 40 .j..%:..S._..%w@ 0220 f3 d7 65 fe 80 74 48 a6 86 0b 05 83 bd d0 70 cc ..e..tH.......p. 0230 3d ad 1c 53 51 b4 35 37 db 13 42 45 be b6 fc e6 =..SQ.57..BE.... 0240 34 e2 07 64 9e a3 32 ea 8e 0a 4d 79 0a 67 64 cf 4..d..2...My.gd. 0250 41 21 4e 81 ce 88 06 7c c8 a9 26 4d 12 6b ad cd A!N....|..&M.k.. 0260 99 ba 98 95 e1 04 db 8d a2 dc ff ee 1f 73 51 d4 .............sQ. 0270 48 04 ba 06 f8 1c 5d 56 73 7f fd 35 79 41 e0 b6 H.....]Vs..5yA.. 0280 0b ca d3 6e 0a 6d 7c f2 ae 65 a4 4c bd d3 74 7c ...n.m|..e.L..t| 0290 1a 06 b6 2a dd 68 63 6c f5 28 0d 9c 03 72 90 eb ...*.hcl.(...r.. 02a0 07 b6 5b 84 b7 63 ef de 35 e7 96 97 0f f6 ed 35 ..[..c..5......5 02b0 ca a6 32 48 1e c1 2f 23 2c e4 9e 76 77 41 7a 59 ..2H../#,..vwAzY 02c0 8a b7 f9 49 f3 66 b6 28 81 41 d6 ec d1 72 d4 93 ...I.f.(.A...r.. 02d0 8b ca 4b 82 7c 3f 84 44 20 41 8d 61 58 9d ab d8 ..K.|?.D A.aX... 02e0 00 67 19 ef f5 3e 3a 33 00 3d 63 09 ae fd 99 a1 .g...>:3.=c..... 02f0 da 90 c2 2e 94 a3 a5 7d cc 55 2c 11 e6 a3 8d 69 .......}.U,....i 0300 47 b4 ff 4b 6b 59 bb 66 ca 70 f3 9a ba 36 ed 65 G..KkY.f.p...6.e 0310 33 11 25 4f bc c6 37 52 f9 e5 11 0d b4 1d 8f e2 3.%O..7R........ 0320 86 59 6c bb d0 cd a1 7e 9a c0 e6 54 71 d7 b0 76 .Yl....~...Tq..v 0330 86 25 b9 df 99 46 cd a7 df fb da 27 54 dc 88 cd .%...F.....'T... 0340 96 30 b4 ca d9 e5 01 eb b8 c1 36 9e cc bb 3a 7f .0........6...:. 0350 da ea 8b 30 fd c2 0a 4a 6b 0e ce 45 dd 4d 53 d0 ...0...Jk..E.MS. 0360 54 fd 0d d0 b1 ae 2c 3e 9c 73 1f 5d dd 47 f5 0f T.....,>.s.].G.. 0370 7f 26 de d8 5b ec 47 6f 99 00 47 24 cf 2c 36 0a .&..[.Go..G$.,6. 0380 e5 25 0d a9 5e 05 51 da 3f 58 a1 50 7c e9 83 06 .%..^.Q.?X.P|... 0390 0d d3 cb bc 1c 42 1d 6a f6 8e 8b 38 78 9b f2 8a .....B.j...8x... 03a0 7d d2 83 44 37 18 6c 88 e5 44 65 d3 d4 fe 48 a7 }..D7.l..De...H. 03b0 5a 85 c0 eb b5 9d fe fe b2 b4 6f 0d 25 a7 a9 fa Z.........o.%... 03c0 d2 90 f4 63 f4 24 fe 06 ff 2a c1 77 e8 41 d3 63 ...c.$...*.w.A.c 03d0 c1 f8 1a 74 e2 bf 19 4b 1f d5 14 48 91 8c ba 55 ...t...K...H...U 03e0 b5 0b cb 24 7b dc 05 0e 48 e5 a1 61 ea 92 e9 fc ...${...H..a.... 03f0 41 d9 a2 f5 7c 67 c8 d3 e1 14 3d a6 c1 91 f5 d1 A...|g....=..... 0400 1c 96 ce 54 f4 e0 0f da 86 1e 2e 43 b9 29 57 ac ...T.......C.)W. 0410 84 b4 53 e5 04 93 ea cc 30 20 c5 17 83 fa 2b 8a ..S.....0 ....+. 0420 27 77 58 3c 86 5c 09 1a 2d fb 3f a7 f1 90 48 4d 'wX<.\..-.?...HM 0430 79 64 06 3f 7e 85 cc ea 85 fb 50 6e bc d9 bc a1 yd.?~.....Pn.... 0440 44 d1 20 22 f1 48 56 8e 73 3c e9 f1 9c e9 74 4b D. ".HV.s<....tK 0450 90 4d 6e dd d9 c2 a5 6d 59 1d 31 24 6b 5e 58 7d .Mn....mY.1$k^X} 0460 1f 07 1c 04 a7 35 9e 56 ab f2 d6 c0 ef c2 4c 0e .....5.V......L. 0470 56 d7 35 0d d9 b0 cf 89 ed 45 0d d5 48 f4 14 b0 V.5......E..H... 0480 5b cc 71 9b b7 d7 aa aa 11 d3 77 f7 1c aa df 8b [.q.......w..... 0490 c2 be 6b b3 45 54 90 26 60 f7 00 1e d2 3b d2 8c ..k.ET.&`....;.. 04a0 a2 21 e8 07 bd 3b c1 c7 60 7e c7 80 1d c7 b5 ee .!...;..`~...... 04b0 e3 12 14 bc 09 89 28 bd b8 84 74 4f e1 47 d4 51 ......(...tO.G.Q 04c0 31 3a bc 9b ce 5b 49 07 bf ec e4 cd bf 60 db 8c 1:...[I......`.. 04d0 fb d5 61 06 a8 70 40 09 47 bc c5 69 4b 7f 30 39 ..a..p@.G..iK.09 04e0 e5 c2 b9 49 f3 4a 3b d6 25 2d 45 d7 a8 6c c9 0c ...I.J;.%-E..l.. 04f0 2b 15 b0 d0 84 70 69 f0 39 c3 07 91 21 08 4f 54 +....pi.9...!.OT 0500 5a d7 44 dc 2f d2 92 60 54 18 6e 51 98 62 92 09 Z.D./..`T.nQ.b.. 0510 f5 e2 6a 29 31 67 1e a5 f6 8a 3b 54 b7 fc 3f ff ..j)1g....;T..?. 0520 b3 4a d1 5c e9 c3 79 4c fe c2 41 c7 15 2f 77 df .J.\..yL..A../w. 0530 f3 aa e3 de 4e d9 3e 4b e0 e2 0b 88 61 89 6e f0 ....N.>K....a.n. 0540 3a 2d 54 b1 12 bf 09 26 b8 0e 3a 71 d3 aa f5 ef :-T....&..:q.... 0550 37 00 55 69 21 c4 9d bf 70 79 e0 bc c3 f8 37 e5 7.Ui!...py....7. 0560 76 b9 b9 1e c1 e1 37 c6 b3 6c 5a e3 04 80 b4 01 v.....7..lZ..... 0570 9a f7 21 9d 03 71 0d 73 53 05 0f e3 ab 43 84 1f ..!..q.sS....C.. 0580 93 5b 9f 88 08 1a 3c 21 cc 2e 7f aa 72 5e aa 75 .[....P..HK....7.@ 00b0 74 37 67 57 b5 67 a6 f4 0e 2d 0a 64 6f de 22 e8 t7gW.g...-.do.". 00c0 0c d1 78 72 37 57 4e d9 5d e8 1d 30 68 b7 74 6f ..xr7WN.]..0h.to 00d0 c0 ce b2 3e 83 11 9f 2f ea 4d 7c 41 cb 91 d2 54 ...>.../.M|A...T 00e0 f0 67 fe c0 44 16 21 ae 64 92 29 39 9e 70 87 63 .g..D.!.d.)9.p.c 00f0 3c d6 a5 c2 f6 57 2b 71 55 47 77 00 2e cc 02 79 <....W+qUGw....y 0100 cf b1 8b 5d 81 bf 34 30 75 dd ce f9 2f 20 69 28 ...]..40u.../ i( 0110 b5 e3 fc 8c dd dd 84 d2 61 cb 12 ad f2 1f 0a dc ........a....... 0120 66 dc 5d af 48 b5 c3 e2 a3 d6 a5 94 4b 95 dc 44 f.].H.......K..D 0130 c2 bf bd dd 87 e3 7d 90 c4 a3 15 c6 d4 fe 1b 4f ......}........O 0140 f5 3c b3 a8 e5 b6 e5 97 d6 98 cf 56 31 6c e5 63 .<.........V1l.c 0150 7e 18 50 97 4a 16 8b 59 f2 b0 65 60 c0 d7 61 38 ~.P.J..Y..e`..a8 0160 27 5f 83 33 79 72 cb 45 1d 2c 10 40 06 6c c7 d1 '_.3yr.E.,.@.l.. 0170 0a 98 ff ec 23 fe c6 47 b1 c6 d1 3c a7 cc 1b 11 ....#..G...<.... 0180 6c 01 fc ab 23 c4 6d 66 02 1d b5 79 7c 93 1e 0e l...#.mf...y|... 0190 ff 1f 29 21 ba 86 8c 60 02 52 9f cf 9f 98 b1 82 ..)!...`.R...... 01a0 aa d7 65 b8 cd bc cb b4 f3 13 4a f2 96 0f 75 f7 ..e.......J...u. 01b0 45 77 78 46 24 c9 53 73 4b 3e 10 5d 3a b0 14 26 EwxF$.SsK>.]:..& 01c0 1f 8c 0a 6c 2d fa fd 2d e2 f8 d5 c1 ba f1 6c 39 ...l-..-......l9 01d0 7d 90 68 b7 ca 3a 97 ac 17 82 1a f3 dd e5 c8 de }.h..:.......... 01e0 55 a0 81 ae f9 cd b3 53 1a eb d0 76 af 52 2d 36 U......S...v.R-6 01f0 8a 80 f2 72 48 21 03 a8 45 85 6b 5f 2c c4 65 ce ...rH!..E.k_,.e. 0200 49 2c cc 5f ae 35 f9 8b c1 16 65 8e 51 01 18 1c I,._.5....e.Q... 0210 55 75 30 24 c2 c7 23 b6 21 8b b3 af cf 93 e8 2e Uu0$..#.!....... 0220 e5 07 31 00 94 92 55 2f 66 14 68 48 df 33 6c 32 ..1...U/f.hH.3l2 0230 37 45 fb 43 c5 4e 7a 1f 73 7c d2 31 07 63 63 75 7E.C.Nz.s|.1.ccu 0240 d0 cc 52 3d 7c ff 4e ea 33 b5 bf 8d ae f8 cb bd ..R=|.N.3....... 0250 42 fc 30 6d 51 e6 db 7c 79 ca ba 0f 77 5a f7 a4 B.0mQ..|y...wZ.. 0260 91 11 64 a5 73 c6 a8 0f a5 f5 15 43 21 3b f7 a0 ..d.s......C!;.. 0270 72 56 93 1e c9 30 f1 a5 7a 5b 9e 0b ef 4d 0b 7f rV...0..z[...M.. 0280 e3 a7 9a 72 1b 70 6c 59 6d 9d 9a 79 d9 e4 6d 0d ...r.plYm..y..m. 0290 e9 31 31 24 f0 f6 b0 73 7b 8e 33 ee 5c c1 b7 03 .11$...s{.3.\... 02a0 1f c0 bc 1a bc 97 98 9a 85 a3 45 b0 b9 ae 4b a2 ..........E...K. 02b0 76 e8 2a 85 f4 dc 15 91 5c 91 4e 8c 76 e7 19 44 v.*.....\.N.v..D 02c0 f3 66 e8 5f 66 86 8f 03 28 f8 30 ef ec 92 38 fa .f._f...(.0...8. 02d0 8b 55 23 62 a4 13 08 60 94 7b 75 b9 b0 3f 8a b9 .U#b...`.{u..?.. 02e0 cb 78 24 04 6d 11 5d 3d ae 7a d3 96 6b 08 84 45 .x$.m.]=.z..k..E 02f0 90 d8 d1 9e 05 d3 e3 0e 07 ba 13 b8 f3 7a 45 bc .............zE. 0300 d6 a4 7f bb 11 70 96 f2 72 05 2a c9 b5 c2 3f 69 .....p..r.*...?i 0310 68 d4 e8 8e bc 16 99 60 d8 95 ab f2 38 f6 d4 aa h......`....8... 0320 d1 d8 0e dc 08 9a 7e 44 b6 4a 2a ab 52 1c b7 d4 ......~D.J*.R... 0330 0b c5 a5 ec 79 80 da 3b 5c 91 a7 73 f0 b2 10 dc ....y..;\..s.... 0340 66 11 82 2f 74 80 9c 80 b9 31 b0 27 25 d9 ef f7 f../t....1.'%... 0350 60 a3 ef e0 a4 b8 85 b9 36 b0 1e 15 f1 a2 bc ab `.......6....... 0360 df 21 8f ff ea d0 48 16 7b fc 7c 89 c6 76 ea ff .!....H.{.|..v.. 0370 cd fb a7 ee 8b 44 ab 1d 59 c7 96 dd f9 2b 61 73 .....D..Y....+as 0380 03 58 39 83 76 d1 59 71 13 3c c9 36 6b 87 e1 6a .X9.v.Yq.<.6k..j 0390 b2 15 da 7d a9 54 6b 9e 7b b8 45 28 f5 41 2c 28 ...}.Tk.{.E(.A,( 03a0 4d 21 d3 42 4d af fa ca 8a 50 a6 ef 46 70 b6 07 M!.BM....P..Fp.. 03b0 85 84 79 fb 5a c7 1a f0 d7 03 04 64 46 66 5c d3 ..y.Z......dFf\. 03c0 ef 9a 7e 64 31 a6 50 e7 fb 5b 15 f1 3c 8f 7a 32 ..~d1.P..[..<.z2 03d0 7f f0 55 a6 33 4a 68 e8 96 2b e4 7e 59 3e 26 48 ..U.3Jh..+.~Y>&H 03e0 84 44 a9 e5 78 4a 00 be 81 3a 26 60 41 24 d3 dd .D..xJ...:&`A$.. 03f0 b7 aa 04 f3 d1 ff b2 53 35 d5 b4 60 95 0c 12 88 .......S5..`.... 0400 16 0c 93 19 78 0b 37 a9 45 e5 b0 1c 3d 02 13 8b ....x.7.E...=... 0410 06 bc db fc 58 61 0f a6 3b 4d 22 e5 20 f7 a3 d2 ....Xa..;M". ... 0420 86 44 a6 0c f3 2b 39 57 90 bc b2 20 89 ce 75 10 .D...+9W... ..u. 0430 4d 8d bf 81 c5 91 a5 9f e9 52 b9 7b 0e 91 94 f9 M........R.{.... 0440 95 9d 64 28 6d 0f 55 f3 3b 2e 8e 2f 3d 86 9b b9 ..d(m.U.;../=... 0450 ca 71 2f e6 b9 83 00 d9 c4 13 a8 54 2f b5 e2 97 .q/........T/... 0460 c5 22 67 ."g Reassembled TCP (2529 bytes): 0000 00 00 09 dd 60 82 09 d9 06 09 2a 86 48 86 f7 12 ....`.....*.H... 0010 01 02 02 02 01 11 00 10 00 ff ff 72 2f 97 6b 24 ...........r/.k$ 0020 5a 40 a2 3b 81 79 d3 e1 f8 32 98 ca b7 08 fe 83 Z@.;.y...2...... 0030 59 61 aa 52 51 99 0d 8b f8 7a 1e a0 bc fa 9d 41 Ya.RQ....z.....A 0040 16 0d b8 be d1 f9 4b 17 3a 7f 94 12 66 fd 5b 61 ......K.:...f.[a 0050 c5 f2 cd 00 dc 30 66 40 97 f6 c6 dd a1 aa 88 34 .....0f@.......4 0060 bd aa 5a ce 11 6d 0c 3a 4e 3e c8 1d 43 23 36 a7 ..Z..m.:N>..C#6. 0070 8d 41 f8 86 02 17 14 0d a7 e2 96 0c d1 f0 d5 73 .A.............s 0080 d3 83 3b 8a 0f 26 08 43 b8 32 8c 04 39 78 86 8a ..;..&.C.2..9x.. 0090 15 b9 5a 71 15 76 41 7c e6 d5 07 64 05 64 7b f1 ..Zq.vA|...d.d{. 00a0 71 58 3c 6f 0a 22 ca e6 37 91 00 d4 9d e8 70 83 qX....Z,Z...., 0180 f6 a9 15 9d db f7 f1 61 ec bc 5e 11 07 b3 f3 32 .......a..^....2 0190 cc 98 ac 12 92 41 9e 17 63 72 1b cd 4d 76 98 f7 .....A..cr..Mv.. 01a0 e7 71 7d 9b 64 6b ca 3f eb 3e df a1 8b 78 c1 31 .q}.dk.?.>...x.1 01b0 02 c1 42 65 b5 d3 ba f3 e9 78 26 2a eb 83 fd 01 ..Be.....x&*.... 01c0 db 24 ba a2 fa 60 84 3f 37 ce 0e 7d 44 cc ac 16 .$...`.?7..}D... 01d0 83 f4 9e 69 32 90 af c6 7b 5a 01 6a f8 9e 25 3a ...i2...{Z.j..%: 01e0 b0 91 53 f8 5f 1e ab 25 77 40 f3 d7 65 fe 80 74 ..S._..%w@..e..t 01f0 48 a6 86 0b 05 83 bd d0 70 cc 3d ad 1c 53 51 b4 H.......p.=..SQ. 0200 35 37 db 13 42 45 be b6 fc e6 34 e2 07 64 9e a3 57..BE....4..d.. 0210 32 ea 8e 0a 4d 79 0a 67 64 cf 41 21 4e 81 ce 88 2...My.gd.A!N... 0220 06 7c c8 a9 26 4d 12 6b ad cd 99 ba 98 95 e1 04 .|..&M.k........ 0230 db 8d a2 dc ff ee 1f 73 51 d4 48 04 ba 06 f8 1c .......sQ.H..... 0240 5d 56 73 7f fd 35 79 41 e0 b6 0b ca d3 6e 0a 6d ]Vs..5yA.....n.m 0250 7c f2 ae 65 a4 4c bd d3 74 7c 1a 06 b6 2a dd 68 |..e.L..t|...*.h 0260 63 6c f5 28 0d 9c 03 72 90 eb 07 b6 5b 84 b7 63 cl.(...r....[..c 0270 ef de 35 e7 96 97 0f f6 ed 35 ca a6 32 48 1e c1 ..5......5..2H.. 0280 2f 23 2c e4 9e 76 77 41 7a 59 8a b7 f9 49 f3 66 /#,..vwAzY...I.f 0290 b6 28 81 41 d6 ec d1 72 d4 93 8b ca 4b 82 7c 3f .(.A...r....K.|? 02a0 84 44 20 41 8d 61 58 9d ab d8 00 67 19 ef f5 3e .D A.aX....g...> 02b0 3a 33 00 3d 63 09 ae fd 99 a1 da 90 c2 2e 94 a3 :3.=c........... 02c0 a5 7d cc 55 2c 11 e6 a3 8d 69 47 b4 ff 4b 6b 59 .}.U,....iG..KkY 02d0 bb 66 ca 70 f3 9a ba 36 ed 65 33 11 25 4f bc c6 .f.p...6.e3.%O.. 02e0 37 52 f9 e5 11 0d b4 1d 8f e2 86 59 6c bb d0 cd 7R.........Yl... 02f0 a1 7e 9a c0 e6 54 71 d7 b0 76 86 25 b9 df 99 46 .~...Tq..v.%...F 0300 cd a7 df fb da 27 54 dc 88 cd 96 30 b4 ca d9 e5 .....'T....0.... 0310 01 eb b8 c1 36 9e cc bb 3a 7f da ea 8b 30 fd c2 ....6...:....0.. 0320 0a 4a 6b 0e ce 45 dd 4d 53 d0 54 fd 0d d0 b1 ae .Jk..E.MS.T..... 0330 2c 3e 9c 73 1f 5d dd 47 f5 0f 7f 26 de d8 5b ec ,>.s.].G...&..[. 0340 47 6f 99 00 47 24 cf 2c 36 0a e5 25 0d a9 5e 05 Go..G$.,6..%..^. 0350 51 da 3f 58 a1 50 7c e9 83 06 0d d3 cb bc 1c 42 Q.?X.P|........B 0360 1d 6a f6 8e 8b 38 78 9b f2 8a 7d d2 83 44 37 18 .j...8x...}..D7. 0370 6c 88 e5 44 65 d3 d4 fe 48 a7 5a 85 c0 eb b5 9d l..De...H.Z..... 0380 fe fe b2 b4 6f 0d 25 a7 a9 fa d2 90 f4 63 f4 24 ....o.%......c.$ 0390 fe 06 ff 2a c1 77 e8 41 d3 63 c1 f8 1a 74 e2 bf ...*.w.A.c...t.. 03a0 19 4b 1f d5 14 48 91 8c ba 55 b5 0b cb 24 7b dc .K...H...U...${. 03b0 05 0e 48 e5 a1 61 ea 92 e9 fc 41 d9 a2 f5 7c 67 ..H..a....A...|g 03c0 c8 d3 e1 14 3d a6 c1 91 f5 d1 1c 96 ce 54 f4 e0 ....=........T.. 03d0 0f da 86 1e 2e 43 b9 29 57 ac 84 b4 53 e5 04 93 .....C.)W...S... 03e0 ea cc 30 20 c5 17 83 fa 2b 8a 27 77 58 3c 86 5c ..0 ....+.'wX<.\ 03f0 09 1a 2d fb 3f a7 f1 90 48 4d 79 64 06 3f 7e 85 ..-.?...HMyd.?~. 0400 cc ea 85 fb 50 6e bc d9 bc a1 44 d1 20 22 f1 48 ....Pn....D. ".H 0410 56 8e 73 3c e9 f1 9c e9 74 4b 90 4d 6e dd d9 c2 V.s<....tK.Mn... 0420 a5 6d 59 1d 31 24 6b 5e 58 7d 1f 07 1c 04 a7 35 .mY.1$k^X}.....5 0430 9e 56 ab f2 d6 c0 ef c2 4c 0e 56 d7 35 0d d9 b0 .V......L.V.5... 0440 cf 89 ed 45 0d d5 48 f4 14 b0 5b cc 71 9b b7 d7 ...E..H...[.q... 0450 aa aa 11 d3 77 f7 1c aa df 8b c2 be 6b b3 45 54 ....w.......k.ET 0460 90 26 60 f7 00 1e d2 3b d2 8c a2 21 e8 07 bd 3b .&`....;...!...; 0470 c1 c7 60 7e c7 80 1d c7 b5 ee e3 12 14 bc 09 89 ..`~............ 0480 28 bd b8 84 74 4f e1 47 d4 51 31 3a bc 9b ce 5b (...tO.G.Q1:...[ 0490 49 07 bf ec e4 cd bf 60 db 8c fb d5 61 06 a8 70 I......`....a..p 04a0 40 09 47 bc c5 69 4b 7f 30 39 e5 c2 b9 49 f3 4a @.G..iK.09...I.J 04b0 3b d6 25 2d 45 d7 a8 6c c9 0c 2b 15 b0 d0 84 70 ;.%-E..l..+....p 04c0 69 f0 39 c3 07 91 21 08 4f 54 5a d7 44 dc 2f d2 i.9...!.OTZ.D./. 04d0 92 60 54 18 6e 51 98 62 92 09 f5 e2 6a 29 31 67 .`T.nQ.b....j)1g 04e0 1e a5 f6 8a 3b 54 b7 fc 3f ff b3 4a d1 5c e9 c3 ....;T..?..J.\.. 04f0 79 4c fe c2 41 c7 15 2f 77 df f3 aa e3 de 4e d9 yL..A../w.....N. 0500 3e 4b e0 e2 0b 88 61 89 6e f0 3a 2d 54 b1 12 bf >K....a.n.:-T... 0510 09 26 b8 0e 3a 71 d3 aa f5 ef 37 00 55 69 21 c4 .&..:q....7.Ui!. 0520 9d bf 70 79 e0 bc c3 f8 37 e5 76 b9 b9 1e c1 e1 ..py....7.v..... 0530 37 c6 b3 6c 5a e3 04 80 b4 01 9a f7 21 9d 03 71 7..lZ.......!..q 0540 0d 73 53 05 0f e3 ab 43 84 1f 93 5b 9f 88 08 1a .sS....C...[.... 0550 3c 21 cc 2e 7f aa 72 5e aa 75 b6 c6 61 2d 99 1d P..HK....7.@t7 0630 67 57 b5 67 a6 f4 0e 2d 0a 64 6f de 22 e8 0c d1 gW.g...-.do."... 0640 78 72 37 57 4e d9 5d e8 1d 30 68 b7 74 6f c0 ce xr7WN.]..0h.to.. 0650 b2 3e 83 11 9f 2f ea 4d 7c 41 cb 91 d2 54 f0 67 .>.../.M|A...T.g 0660 fe c0 44 16 21 ae 64 92 29 39 9e 70 87 63 3c d6 ..D.!.d.)9.p.c<. 0670 a5 c2 f6 57 2b 71 55 47 77 00 2e cc 02 79 cf b1 ...W+qUGw....y.. 0680 8b 5d 81 bf 34 30 75 dd ce f9 2f 20 69 28 b5 e3 .]..40u.../ i(.. 0690 fc 8c dd dd 84 d2 61 cb 12 ad f2 1f 0a dc 66 dc ......a.......f. 06a0 5d af 48 b5 c3 e2 a3 d6 a5 94 4b 95 dc 44 c2 bf ].H.......K..D.. 06b0 bd dd 87 e3 7d 90 c4 a3 15 c6 d4 fe 1b 4f f5 3c ....}........O.< 06c0 b3 a8 e5 b6 e5 97 d6 98 cf 56 31 6c e5 63 7e 18 .........V1l.c~. 06d0 50 97 4a 16 8b 59 f2 b0 65 60 c0 d7 61 38 27 5f P.J..Y..e`..a8'_ 06e0 83 33 79 72 cb 45 1d 2c 10 40 06 6c c7 d1 0a 98 .3yr.E.,.@.l.... 06f0 ff ec 23 fe c6 47 b1 c6 d1 3c a7 cc 1b 11 6c 01 ..#..G...<....l. 0700 fc ab 23 c4 6d 66 02 1d b5 79 7c 93 1e 0e ff 1f ..#.mf...y|..... 0710 29 21 ba 86 8c 60 02 52 9f cf 9f 98 b1 82 aa d7 )!...`.R........ 0720 65 b8 cd bc cb b4 f3 13 4a f2 96 0f 75 f7 45 77 e.......J...u.Ew 0730 78 46 24 c9 53 73 4b 3e 10 5d 3a b0 14 26 1f 8c xF$.SsK>.]:..&.. 0740 0a 6c 2d fa fd 2d e2 f8 d5 c1 ba f1 6c 39 7d 90 .l-..-......l9}. 0750 68 b7 ca 3a 97 ac 17 82 1a f3 dd e5 c8 de 55 a0 h..:..........U. 0760 81 ae f9 cd b3 53 1a eb d0 76 af 52 2d 36 8a 80 .....S...v.R-6.. 0770 f2 72 48 21 03 a8 45 85 6b 5f 2c c4 65 ce 49 2c .rH!..E.k_,.e.I, 0780 cc 5f ae 35 f9 8b c1 16 65 8e 51 01 18 1c 55 75 ._.5....e.Q...Uu 0790 30 24 c2 c7 23 b6 21 8b b3 af cf 93 e8 2e e5 07 0$..#.!......... 07a0 31 00 94 92 55 2f 66 14 68 48 df 33 6c 32 37 45 1...U/f.hH.3l27E 07b0 fb 43 c5 4e 7a 1f 73 7c d2 31 07 63 63 75 d0 cc .C.Nz.s|.1.ccu.. 07c0 52 3d 7c ff 4e ea 33 b5 bf 8d ae f8 cb bd 42 fc R=|.N.3.......B. 07d0 30 6d 51 e6 db 7c 79 ca ba 0f 77 5a f7 a4 91 11 0mQ..|y...wZ.... 07e0 64 a5 73 c6 a8 0f a5 f5 15 43 21 3b f7 a0 72 56 d.s......C!;..rV 07f0 93 1e c9 30 f1 a5 7a 5b 9e 0b ef 4d 0b 7f e3 a7 ...0..z[...M.... 0800 9a 72 1b 70 6c 59 6d 9d 9a 79 d9 e4 6d 0d e9 31 .r.plYm..y..m..1 0810 31 24 f0 f6 b0 73 7b 8e 33 ee 5c c1 b7 03 1f c0 1$...s{.3.\..... 0820 bc 1a bc 97 98 9a 85 a3 45 b0 b9 ae 4b a2 76 e8 ........E...K.v. 0830 2a 85 f4 dc 15 91 5c 91 4e 8c 76 e7 19 44 f3 66 *.....\.N.v..D.f 0840 e8 5f 66 86 8f 03 28 f8 30 ef ec 92 38 fa 8b 55 ._f...(.0...8..U 0850 23 62 a4 13 08 60 94 7b 75 b9 b0 3f 8a b9 cb 78 #b...`.{u..?...x 0860 24 04 6d 11 5d 3d ae 7a d3 96 6b 08 84 45 90 d8 $.m.]=.z..k..E.. 0870 d1 9e 05 d3 e3 0e 07 ba 13 b8 f3 7a 45 bc d6 a4 ...........zE... 0880 7f bb 11 70 96 f2 72 05 2a c9 b5 c2 3f 69 68 d4 ...p..r.*...?ih. 0890 e8 8e bc 16 99 60 d8 95 ab f2 38 f6 d4 aa d1 d8 .....`....8..... 08a0 0e dc 08 9a 7e 44 b6 4a 2a ab 52 1c b7 d4 0b c5 ....~D.J*.R..... 08b0 a5 ec 79 80 da 3b 5c 91 a7 73 f0 b2 10 dc 66 11 ..y..;\..s....f. 08c0 82 2f 74 80 9c 80 b9 31 b0 27 25 d9 ef f7 60 a3 ./t....1.'%...`. 08d0 ef e0 a4 b8 85 b9 36 b0 1e 15 f1 a2 bc ab df 21 ......6........! 08e0 8f ff ea d0 48 16 7b fc 7c 89 c6 76 ea ff cd fb ....H.{.|..v.... 08f0 a7 ee 8b 44 ab 1d 59 c7 96 dd f9 2b 61 73 03 58 ...D..Y....+as.X 0900 39 83 76 d1 59 71 13 3c c9 36 6b 87 e1 6a b2 15 9.v.Yq.<.6k..j.. 0910 da 7d a9 54 6b 9e 7b b8 45 28 f5 41 2c 28 4d 21 .}.Tk.{.E(.A,(M! 0920 d3 42 4d af fa ca 8a 50 a6 ef 46 70 b6 07 85 84 .BM....P..Fp.... 0930 79 fb 5a c7 1a f0 d7 03 04 64 46 66 5c d3 ef 9a y.Z......dFf\... 0940 7e 64 31 a6 50 e7 fb 5b 15 f1 3c 8f 7a 32 7f f0 ~d1.P..[..<.z2.. 0950 55 a6 33 4a 68 e8 96 2b e4 7e 59 3e 26 48 84 44 U.3Jh..+.~Y>&H.D 0960 a9 e5 78 4a 00 be 81 3a 26 60 41 24 d3 dd b7 aa ..xJ...:&`A$.... 0970 04 f3 d1 ff b2 53 35 d5 b4 60 95 0c 12 88 16 0c .....S5..`...... 0980 93 19 78 0b 37 a9 45 e5 b0 1c 3d 02 13 8b 06 bc ..x.7.E...=..... 0990 db fc 58 61 0f a6 3b 4d 22 e5 20 f7 a3 d2 86 44 ..Xa..;M". ....D 09a0 a6 0c f3 2b 39 57 90 bc b2 20 89 ce 75 10 4d 8d ...+9W... ..u.M. 09b0 bf 81 c5 91 a5 9f e9 52 b9 7b 0e 91 94 f9 95 9d .......R.{...... 09c0 64 28 6d 0f 55 f3 3b 2e 8e 2f 3d 86 9b b9 ca 71 d(m.U.;../=....q 09d0 2f e6 b9 83 00 d9 c4 13 a8 54 2f b5 e2 97 c5 22 /........T/...." 09e0 67 g No. Time Source Destination Protocol Info 246 67.767278 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=10013 Ack=52423 Win=64240 Len=0 Frame 246 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10013, Ack: 52423, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 43 40 00 80 06 bf 80 ac 1f 01 68 ac 1f .(.C@........h.. 0020 01 65 07 f0 01 85 d3 1c 2d ed 0b 69 20 44 50 10 .e......-..i DP. 0030 fa f0 23 ac 00 00 00 00 01 3f 60 82 ..#......?`. No. Time Source Destination Protocol Info 247 67.768263 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (97 bytes) Frame 247 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10013, Ack: 52423, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF052D230BFC563AD133D3627537529191... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 052D230BFC563AD1 krb5_sgn_cksum: 33D3627537529191 krb5_confounder: 3007CAE2E74C8D14 GSS-API Encrypted payload (97 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 44 40 00 80 06 be ec ac 1f 01 68 ac 1f ...D@........h.. 0020 01 65 07 f0 01 85 d3 1c 2d ed 0b 69 20 44 50 18 .e......-..i DP. 0030 fa f0 a7 7e 00 00 00 00 00 8f 60 81 8c 06 09 2a ...~......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 05 2d 23 0b fc 56 3a d1 33 d3 62 75 37 52 91 91 .-#..V:.3.bu7R.. 0060 30 07 ca e2 e7 4c 8d 14 e5 9e 46 46 26 e3 96 5a 0....L....FF&..Z 0070 cb cb f9 fe 82 61 f7 5b f4 cd 32 65 a1 18 2d a6 .....a.[..2e..-. 0080 bf 65 37 8e 5a 75 c7 e3 20 4f 8b 63 39 05 3a 05 .e7.Zu.. O.c9.:. 0090 0b 29 a1 9c b8 0d bb 1b 97 7e bf 07 e0 ca 0a 23 .).......~.....# 00a0 70 30 0a ed 18 6b df 8d 44 95 08 c8 12 19 76 0f p0...k..D.....v. 00b0 af 8b 9d 35 cf 54 e2 66 f6 28 c7 72 a3 26 22 e6 ...5.T.f.(.r.&". 00c0 08 e9 71 3a 1a df 5c 65 9f ..q:..\e. No. Time Source Destination Protocol Info 248 67.768949 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 248 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 52423, Ack: 10160, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF6F6546CA8DC8038742ED6711E6042CBD... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 6F6546CA8DC80387 krb5_sgn_cksum: 42ED6711E6042CBD krb5_confounder: 5CDB675AE8DDF549 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 2e 40 00 80 06 70 e4 ac 1f 01 65 ac 1f ....@...p....e.. 0020 01 68 01 85 07 f0 0b 69 20 44 d3 1c 2e 80 50 18 .h.....i D....P. 0030 f8 2f 6f 36 00 00 00 00 00 ae 60 81 ab 06 09 2a ./o6......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 6f 65 46 ca 8d c8 03 87 42 ed 67 11 e6 04 2c bd oeF.....B.g...,. 0060 5c db 67 5a e8 dd f5 49 84 53 96 e8 29 68 e2 38 \.gZ...I.S..)h.8 0070 ee fd dc 55 49 49 b8 d6 c0 ca ff 05 5b 9e f5 ae ...UII......[... 0080 5a 18 4b ef a9 82 cf fd 0e f8 75 50 c9 43 6f 87 Z.K.......uP.Co. 0090 d8 c7 82 dc 55 59 51 1a 4f 52 76 dd 34 74 d5 ca ....UYQ.ORv.4t.. 00a0 42 a0 69 be 3a 99 10 50 ad 3e e9 f4 e0 7f a3 9c B.i.:..P.>...... 00b0 0e b3 7c ac 78 5b 23 29 c2 ea 66 b9 3d 7e c4 c7 ..|.x[#)..f.=~.. 00c0 de 34 66 aa 74 58 e3 fc e6 52 03 0a 05 de 46 4a .4f.tX...R....FJ 00d0 3d 33 b5 f3 fc d8 8a 62 61 7d d4 9a 49 f5 53 ec =3.....ba}..I.S. 00e0 06 9c 67 6c 70 7e 9c 12 ..glp~.. No. Time Source Destination Protocol Info 249 67.944200 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=10160 Ack=52601 Win=64062 Len=0 Frame 249 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10160, Ack: 52601, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 45 40 00 80 06 bf 7e ac 1f 01 68 ac 1f .(.E@....~...h.. 0020 01 65 07 f0 01 85 d3 1c 2e 80 0b 69 20 f6 50 10 .e.........i .P. 0030 fa 3e 23 19 00 00 02 04 05 b4 01 01 .>#......... No. Time Source Destination Protocol Info 250 72.754065 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 250 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10160, Ack: 52601, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFC74495B3C479D93DBEC2FEA92EF36A34... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: C74495B3C479D93D krb5_sgn_cksum: BEC2FEA92EF36A34 krb5_confounder: 7E241EC287F71AC8 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 58 40 00 80 06 be d8 ac 1f 01 68 ac 1f ...X@........h.. 0020 01 65 07 f0 01 85 d3 1c 2e 80 0b 69 20 f6 50 18 .e.........i .P. 0030 fa 3e e5 32 00 00 00 00 00 8f 60 81 8c 06 09 2a .>.2......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 c7 44 95 b3 c4 79 d9 3d be c2 fe a9 2e f3 6a 34 .D...y.=......j4 0060 7e 24 1e c2 87 f7 1a c8 45 e9 17 36 1e c9 69 7f ~$......E..6..i. 0070 d4 25 ab 67 df d8 c8 60 c4 2c 0c 4b 46 23 da 77 .%.g...`.,.KF#.w 0080 bf 8c 9b d2 94 50 cb 2f 55 8d d3 bf 0a 55 fc 51 .....P./U....U.Q 0090 f8 ae 10 60 ee f4 51 4d fa 33 86 0b 1c 90 59 21 ...`..QM.3....Y! 00a0 e8 fe 43 77 36 01 66 ed fc 6d 70 43 aa d4 8e 43 ..Cw6.f..mpC...C 00b0 40 b2 5d 48 6a bf 88 74 66 6b 15 f9 dc c1 8e 21 @.]Hj..tfk.....! 00c0 5d 5e 51 05 80 7b 80 fe b2 ]^Q..{... No. Time Source Destination Protocol Info 251 72.755354 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 251 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 52601, Ack: 10307, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFA7D7FBC3613847240BFB20DE452956FA... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: A7D7FBC361384724 krb5_sgn_cksum: 0BFB20DE452956FA krb5_confounder: CE555DC3250794B0 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 53 40 00 80 06 70 bf ac 1f 01 65 ac 1f ...S@...p....e.. 0020 01 68 01 85 07 f0 0b 69 20 f6 d3 1c 2f 13 50 18 .h.....i .../.P. 0030 f7 9c 5e a6 00 00 00 00 00 ae 60 81 ab 06 09 2a ..^.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 a7 d7 fb c3 61 38 47 24 0b fb 20 de 45 29 56 fa ....a8G$.. .E)V. 0060 ce 55 5d c3 25 07 94 b0 cc f2 fb 76 d3 1f c4 7d .U].%......v...} 0070 0e 81 b2 ba f0 29 79 c8 9a c5 4d a2 c3 54 39 25 .....)y...M..T9% 0080 00 e4 5f 60 a4 8e e3 a9 c1 bd 43 b7 e0 38 9f 83 .._`......C..8.. 0090 c7 f8 25 a9 27 e0 3d 0d 16 e1 64 6b 50 40 11 0b ..%.'.=...dkP@.. 00a0 b4 8d 74 c1 0b 85 01 92 76 77 40 17 2e 69 e2 77 ..t.....vw@..i.w 00b0 f2 9a c7 70 5d 80 37 21 9d 58 0b d8 4f fa 0f 54 ...p].7!.X..O..T 00c0 8a dc 91 9d 50 23 0a 95 a7 18 63 60 aa 13 f3 16 ....P#....c`.... 00d0 6e 67 0e 30 56 2c 88 8a de a5 83 a1 b1 a9 4a 04 ng.0V,........J. 00e0 f3 01 c1 c1 99 ef e8 a0 ........ No. Time Source Destination Protocol Info 252 72.757092 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (114 bytes) Frame 252 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10307, Ack: 52779, Len: 164 Lightweight Directory Access Protocol SASL Buffer Length: 160 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF362D88CCFD739CFA0E350D6EE07E7D99... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 362D88CCFD739CFA krb5_sgn_cksum: 0E350D6EE07E7D99 krb5_confounder: 0CC493D56C353D49 GSS-API Encrypted payload (114 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cc e0 59 40 00 80 06 be c6 ac 1f 01 68 ac 1f ...Y@........h.. 0020 01 65 07 f0 01 85 d3 1c 2f 13 0b 69 21 a8 50 18 .e....../..i!.P. 0030 f9 8c e1 e9 00 00 00 00 00 a0 60 81 9d 06 09 2a ..........`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 36 2d 88 cc fd 73 9c fa 0e 35 0d 6e e0 7e 7d 99 6-...s...5.n.~}. 0060 0c c4 93 d5 6c 35 3d 49 d6 4c 77 26 08 a7 dd 1c ....l5=I.Lw&.... 0070 73 12 b9 14 69 a0 73 09 90 bb e5 a8 4d ec 18 b0 s...i.s.....M... 0080 69 51 c1 21 c8 e5 79 8e bc 81 0c 2d ce e0 2e 11 iQ.!..y....-.... 0090 a6 5c ed 1e 4b 40 f7 cb 1f e9 c2 5b de 44 fd 23 .\..K@.....[.D.# 00a0 8d 7d cb 2e 55 ce 69 d0 ed 5d f3 2c e1 3a 8e 06 .}..U.i..].,.:.. 00b0 4d aa 4f 5c 63 7d 81 32 81 7e 93 42 69 b5 f6 58 M.O\c}.2.~.Bi..X 00c0 f8 0d c4 40 52 ae 89 ba 81 bf 76 cf c1 b6 81 5b ...@R.....v....[ 00d0 3a a5 81 1b 45 2b a9 8b 19 e9 :...E+.... No. Time Source Destination Protocol Info 253 72.758027 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (79 bytes) Frame 253 (182 bytes on wire, 182 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 52779, Ack: 10471, Len: 128 Lightweight Directory Access Protocol SASL Buffer Length: 124 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF622ABECAEEF9F8643EA8ACDE7F84C35... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F622ABECAEEF9F86 krb5_sgn_cksum: 43EA8ACDE7F84C35 krb5_confounder: CD9CFBF7DF37F2C2 GSS-API Encrypted payload (79 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 a8 2e 54 40 00 80 06 70 f0 ac 1f 01 65 ac 1f ...T@...p....e.. 0020 01 68 01 85 07 f0 0b 69 21 a8 d3 1c 2f b7 50 18 .h.....i!.../.P. 0030 f6 f8 d8 a8 00 00 00 00 00 7c 60 7a 06 09 2a 86 .........|`z..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff f6 H............... 0050 22 ab ec ae ef 9f 86 43 ea 8a cd e7 f8 4c 35 cd "......C.....L5. 0060 9c fb f7 df 37 f2 c2 2b 52 a5 08 78 1f 2c c0 8c ....7..+R..x.,.. 0070 26 5e 68 92 c1 7b f7 b8 90 12 ab 5b a4 bb 9c 45 &^h..{.....[...E 0080 bb fc 26 b2 46 18 0c b3 b0 38 98 5e f4 cd 41 a3 ..&.F....8.^..A. 0090 dd 59 21 ac b9 16 97 f7 ff 81 63 ca d3 c1 9e 75 .Y!.......c....u 00a0 e4 91 29 53 42 2f 4d 74 5e 43 51 32 3f 67 8c e6 ..)SB/Mt^CQ2?g.. 00b0 5f 59 82 ed a5 2e _Y.... No. Time Source Destination Protocol Info 254 72.759140 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 254 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10471, Ack: 52907, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFDB51323A8F86AE09BC3A609FA1EA838D... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: DB51323A8F86AE09 krb5_sgn_cksum: BC3A609FA1EA838D krb5_confounder: 2CCB0BEB50219F22 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 5a 40 00 80 06 be d6 ac 1f 01 68 ac 1f ...Z@........h.. 0020 01 65 07 f0 01 85 d3 1c 2f b7 0b 69 22 28 50 18 .e....../..i"(P. 0030 f9 0c 5a 8a 00 00 00 00 00 8f 60 81 8c 06 09 2a ..Z.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 db 51 32 3a 8f 86 ae 09 bc 3a 60 9f a1 ea 83 8d .Q2:.....:`..... 0060 2c cb 0b eb 50 21 9f 22 93 ef 3a 67 af 95 4a 3b ,...P!."..:g..J; 0070 df 98 d2 8e 33 4b e9 84 ce 37 7b 39 9b 11 42 ad ....3K...7{9..B. 0080 32 4b e4 23 12 e7 7d e7 3f 5e 84 0f 6b 74 09 fb 2K.#..}.?^..kt.. 0090 c8 18 4d 7c 83 0e 99 e2 26 4e 98 de c5 29 20 4d ..M|....&N...) M 00a0 60 eb f6 3c dc 1a f2 73 d8 fd be ea d1 c4 f0 a4 `..<...s........ 00b0 e4 9c 6e ed 32 c0 fd 22 f0 b2 ad 37 ef 62 e6 b5 ..n.2.."...7.b.. 00c0 91 00 4a 81 0d b4 04 89 fc ..J...... No. Time Source Destination Protocol Info 255 72.759766 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 255 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 52907, Ack: 10618, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFAEE0E16A768B24E8B4C57B9E4D2CD5BA... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: AEE0E16A768B24E8 krb5_sgn_cksum: B4C57B9E4D2CD5BA krb5_confounder: B6C4C948179D3961 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 55 40 00 80 06 70 bd ac 1f 01 65 ac 1f ...U@...p....e.. 0020 01 68 01 85 07 f0 0b 69 22 28 d3 1c 30 4a 50 18 .h.....i"(..0JP. 0030 f6 65 3a 94 00 00 00 00 00 ae 60 81 ab 06 09 2a .e:.......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 ae e0 e1 6a 76 8b 24 e8 b4 c5 7b 9e 4d 2c d5 ba ...jv.$...{.M,.. 0060 b6 c4 c9 48 17 9d 39 61 40 0d fa 6b 19 dd 3d 51 ...H..9a@..k..=Q 0070 2e f6 3d 1a fc b4 98 82 d2 8a 3a c2 f5 b5 bf 1f ..=.......:..... 0080 61 91 0d 52 17 f1 5d 60 17 30 ba 7e e2 a1 07 a7 a..R..]`.0.~.... 0090 79 49 72 1e e5 56 d7 60 cc 85 9c 55 2c ce 88 a4 yIr..V.`...U,... 00a0 dc 21 2e c5 ff 7f 01 d2 7a c7 cf 72 d6 ba c3 c8 .!......z..r.... 00b0 0f af 3d 18 3d c4 f1 f9 86 04 6d 83 08 96 08 c0 ..=.=.....m..... 00c0 af 88 90 9d 81 0a ce d7 22 3d bc cd 12 cf 3b 75 ........"=....;u 00d0 31 50 40 06 67 6a a2 4e 56 0a 0f 4a e4 e8 6a 47 1P@.gj.NV..J..jG 00e0 d2 a0 00 be c7 9d 88 fd ........ No. Time Source Destination Protocol Info 256 72.760452 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (114 bytes) Frame 256 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10618, Ack: 53085, Len: 164 Lightweight Directory Access Protocol SASL Buffer Length: 160 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF254BF9D78863497CA267F3FE0ED76AB0... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 254BF9D78863497C krb5_sgn_cksum: A267F3FE0ED76AB0 krb5_confounder: 1AAAB7F0C1D843C5 GSS-API Encrypted payload (114 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cc e0 5b 40 00 80 06 be c4 ac 1f 01 68 ac 1f ...[@........h.. 0020 01 65 07 f0 01 85 d3 1c 30 4a 0b 69 22 da 50 18 .e......0J.i".P. 0030 f8 5a c5 68 00 00 00 00 00 a0 60 81 9d 06 09 2a .Z.h......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 25 4b f9 d7 88 63 49 7c a2 67 f3 fe 0e d7 6a b0 %K...cI|.g....j. 0060 1a aa b7 f0 c1 d8 43 c5 2e 40 22 27 81 8f cb 60 ......C..@"'...` 0070 09 75 bb ac 38 4f d9 c7 d3 a4 57 a8 0b 30 01 ee .u..8O....W..0.. 0080 99 56 c7 0c ce b9 ef f7 26 db 4b 8d 17 42 cb da .V......&.K..B.. 0090 db cb 31 cd 79 5e 29 fb a9 62 b6 69 3f 95 12 af ..1.y^)..b.i?... 00a0 cc 9d 9b ea 11 59 df 6c 2f 2b 0a 69 5e 46 9a 55 .....Y.l/+.i^F.U 00b0 2f 7a e5 ea 18 92 f8 47 cd ea 08 95 15 f7 c7 43 /z.....G.......C 00c0 e6 ff 82 aa fb fc c2 8a 06 b6 c5 fe 3e 76 8c 42 ............>v.B 00d0 fb 01 fa 08 75 29 34 1e ee 75 ....u)4..u No. Time Source Destination Protocol Info 257 72.761354 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (79 bytes) Frame 257 (182 bytes on wire, 182 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 53085, Ack: 10782, Len: 128 Lightweight Directory Access Protocol SASL Buffer Length: 124 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFC1818195A19443A7E3B4DF93CBD78179... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: C1818195A19443A7 krb5_sgn_cksum: E3B4DF93CBD78179 krb5_confounder: E0E315406BC3C9BD GSS-API Encrypted payload (79 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 a8 2e 56 40 00 80 06 70 ee ac 1f 01 65 ac 1f ...V@...p....e.. 0020 01 68 01 85 07 f0 0b 69 22 da d3 1c 30 ee 50 18 .h.....i"...0.P. 0030 f5 c1 29 1b 00 00 00 00 00 7c 60 7a 06 09 2a 86 ..)......|`z..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff c1 H............... 0050 81 81 95 a1 94 43 a7 e3 b4 df 93 cb d7 81 79 e0 .....C........y. 0060 e3 15 40 6b c3 c9 bd 7a 49 d0 0b 77 82 98 27 99 ..@k...zI..w..'. 0070 f8 2e 90 52 d0 e5 0a ff 4f 45 39 2c 2e 05 34 10 ...R....OE9,..4. 0080 c1 44 ed 17 a8 ab e3 a5 0a a6 c9 ea ea 0b 54 e0 .D............T. 0090 d1 9e 62 3a 6e 81 87 17 5d 6e 6b 63 51 9e 24 12 ..b:n...]nkcQ.$. 00a0 57 6f f8 e1 cb 35 4c a7 3b bf 28 f9 cc ba ea c5 Wo...5L.;.(..... 00b0 c6 a6 59 ca e8 1f ..Y... No. Time Source Destination Protocol Info 258 72.762792 172.31.1.104 172.31.1.101 LDAP [Malformed Packet] Frame 258 (201 bytes on wire, 201 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10782, Ack: 53213, Len: 147 Lightweight Directory Access Protocol SASL Buffer Length: 143 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFF744EA0FF3A6EBC60A65E6C2AAB86D920... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: 744EA0FF3A6EBC60 krb5_sgn_cksum: A65E6C2AAB86D920 krb5_confounder: 6060BDC6F2CF5030 [Malformed Packet: LDAP] 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 bb e0 5c 40 00 80 06 be d4 ac 1f 01 68 ac 1f ...\@........h.. 0020 01 65 07 f0 01 85 d3 1c 30 ee 0b 69 23 5a 50 18 .e......0..i#ZP. 0030 f7 da 58 44 00 00 00 00 00 8f 60 81 8c 06 09 2a ..XD......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 74 4e a0 ff 3a 6e bc 60 a6 5e 6c 2a ab 86 d9 20 tN..:n.`.^l*... 0060 60 60 bd c6 f2 cf 50 30 4e fd cc 6f 85 3a 0e 9d ``....P0N..o.:.. 0070 2a e6 2c 11 f9 9b 3a 99 a7 46 98 ab 3a 2b 33 39 *.,...:..F..:+39 0080 07 17 2e 4a 21 85 e4 c6 7e 66 15 f3 7d e4 d8 19 ...J!...~f..}... 0090 a4 a2 d3 0b 1a 3b 8f dc b1 ad c9 5c 78 ee c6 57 .....;.....\x..W 00a0 46 32 79 29 0b 25 1d 43 92 ed 42 62 bd 62 b4 1e F2y).%.C..Bb.b.. 00b0 64 94 78 26 b6 07 fd 95 00 7b d8 ea 1e c5 f2 0f d.x&.....{...... 00c0 81 0c 6f 36 0c f2 71 8f 87 ..o6..q.. No. Time Source Destination Protocol Info 259 72.763609 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (128 bytes) Frame 259 (232 bytes on wire, 232 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 53213, Ack: 10929, Len: 178 Lightweight Directory Access Protocol SASL Buffer Length: 174 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFE71CBB4143C51A81B67A879FE8E3D8D9... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: E71CBB4143C51A81 krb5_sgn_cksum: B67A879FE8E3D8D9 krb5_confounder: 6E07EEC668443479 GSS-API Encrypted payload (128 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 da 2e 57 40 00 80 06 70 bb ac 1f 01 65 ac 1f ...W@...p....e.. 0020 01 68 01 85 07 f0 0b 69 23 5a d3 1c 31 81 50 18 .h.....i#Z..1.P. 0030 fa f0 f3 44 00 00 00 00 00 ae 60 81 ab 06 09 2a ...D......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 e7 1c bb 41 43 c5 1a 81 b6 7a 87 9f e8 e3 d8 d9 ...AC....z...... 0060 6e 07 ee c6 68 44 34 79 ee c6 44 6b 5b 42 7c 55 n...hD4y..Dk[B|U 0070 6d 64 13 86 2c ad 8b 96 46 f7 21 2e 20 df e4 92 md..,...F.!. ... 0080 6a fb d5 c3 61 34 43 07 a1 d5 f5 75 6a 5d db 78 j...a4C....uj].x 0090 2b 7b 5d 4f 7a 26 58 5f a2 0c ae f6 ce 61 0c 83 +{]Oz&X_.....a.. 00a0 75 2a 27 81 56 04 59 90 ed b0 8c 93 a7 93 f6 b6 u*'.V.Y......... 00b0 c4 64 b7 fb f5 e8 35 7d 14 07 29 4a c0 04 4a aa .d....5}..)J..J. 00c0 b4 b5 98 5c 8c 67 f5 a6 23 2d 67 d6 f4 70 e2 62 ...\.g..#-g..p.b 00d0 11 e0 83 fe c8 87 d6 1a a1 af d6 9f 32 12 23 eb ............2.#. 00e0 01 59 80 46 f8 3f d8 34 .Y.F.?.4 No. Time Source Destination Protocol Info 260 72.764442 172.31.1.104 172.31.1.101 LDAP LDAP GSS-API Encrypted payload (114 bytes) Frame 260 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 10929, Ack: 53391, Len: 164 Lightweight Directory Access Protocol SASL Buffer Length: 160 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFF1B42B319E96A384E050913C892E9D95... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: F1B42B319E96A384 krb5_sgn_cksum: E050913C892E9D95 krb5_confounder: 92DCC255B45CD30E GSS-API Encrypted payload (114 bytes) 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 cc e0 5d 40 00 80 06 be c2 ac 1f 01 68 ac 1f ...]@........h.. 0020 01 65 07 f0 01 85 d3 1c 31 81 0b 69 24 0c 50 18 .e......1..i$.P. 0030 f7 28 8a 6b 00 00 00 00 00 a0 60 81 9d 06 09 2a .(.k......`....* 0040 86 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff .H.............. 0050 f1 b4 2b 31 9e 96 a3 84 e0 50 91 3c 89 2e 9d 95 ..+1.....P.<.... 0060 92 dc c2 55 b4 5c d3 0e da 08 09 40 b6 f7 a3 7a ...U.\.....@...z 0070 14 d1 b1 81 7e e4 9e cd a4 c3 5f 2a 9b c3 61 24 ....~....._*..a$ 0080 19 3c d9 7c 46 c1 cd ef 45 53 12 00 af 9f 67 55 .<.|F...ES....gU 0090 c1 59 47 69 25 fe c8 e6 dd 82 54 20 51 fb 97 8d .YGi%.....T Q... 00a0 d7 5d fa 9a 6b f6 2e 2e ee bd 14 b0 08 3e 80 53 .]..k........>.S 00b0 ab 8b ed 79 03 1f 67 e1 45 4d cf aa 13 38 f5 44 ...y..g.EM...8.D 00c0 32 78 e3 16 f1 ae f2 27 e7 e2 c9 63 8d c2 ed 9f 2x.....'...c.... 00d0 69 4d f2 b5 4d ba fb 65 e5 91 iM..M..e.. No. Time Source Destination Protocol Info 261 72.765266 172.31.1.101 172.31.1.104 LDAP LDAP GSS-API Encrypted payload (79 bytes) Frame 261 (182 bytes on wire, 182 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: ldap (389), Dst Port: blackboard (2032), Seq: 53391, Ack: 11093, Len: 128 Lightweight Directory Access Protocol SASL Buffer Length: 124 GSS-API Token GSS-API OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5) krb5_blob: 020111001000FFFFCF597F9CD110C009F1D63BD4131D6BCE... krb5_tok_id: KRB5_GSS_Wrap (0x0102) krb5_sgn_alg: HMAC (0x0011) krb5_seal_alg: RC4 (0x0010) krb5_snd_seq: CF597F9CD110C009 krb5_sgn_cksum: F1D63BD4131D6BCE krb5_confounder: E9DECD9299E02A91 GSS-API Encrypted payload (79 bytes) 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 a8 2e 58 40 00 80 06 70 ec ac 1f 01 65 ac 1f ...X@...p....e.. 0020 01 68 01 85 07 f0 0b 69 24 0c d3 1c 32 25 50 18 .h.....i$...2%P. 0030 fa 4c 88 37 00 00 00 00 00 7c 60 7a 06 09 2a 86 .L.7.....|`z..*. 0040 48 86 f7 12 01 02 02 02 01 11 00 10 00 ff ff cf H............... 0050 59 7f 9c d1 10 c0 09 f1 d6 3b d4 13 1d 6b ce e9 Y........;...k.. 0060 de cd 92 99 e0 2a 91 2b 89 30 3d 94 7c 17 f4 2a .....*.+.0=.|..* 0070 2b d8 42 ed 5e 61 2a 44 09 c3 18 de 92 66 d3 8b +.B.^a*D.....f.. 0080 c7 b8 9b 53 44 93 7a e2 62 0b 50 11 01 f3 37 12 ...SD.z.b.P...7. 0090 76 2e 4b 91 a6 94 f6 3f 53 b2 02 70 53 12 50 c6 v.K....?S..pS.P. 00a0 b8 a3 36 ab 27 e1 b5 2c ed 7d 95 c0 4f 49 bb 50 ..6.'..,.}..OI.P 00b0 10 d0 0b 90 9f 4a .....J No. Time Source Destination Protocol Info 262 73.000479 172.31.1.104 172.31.1.101 TCP blackboard > ldap [ACK] Seq=11093 Ack=53519 Win=63144 Len=0 Frame 262 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: blackboard (2032), Dst Port: ldap (389), Seq: 11093, Ack: 53519, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 5e 40 00 80 06 bf 65 ac 1f 01 68 ac 1f .(.^@....e...h.. 0020 01 65 07 f0 01 85 d3 1c 32 25 0b 69 24 8c 50 10 .e......2%.i$.P. 0030 f6 a8 1f 74 00 00 ac 1f 01 65 c5 d5 ...t.....e.. No. Time Source Destination Protocol Info 263 77.023130 172.31.1.104 172.31.1.101 NTP NTP Frame 263 (110 bytes on wire, 110 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Network Time Protocol 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 60 e0 5f 00 00 80 11 ff 21 ac 1f 01 68 ac 1f .`._.....!...h.. 0020 01 65 00 7b 00 7b 00 4c fd fb 19 02 0a fa 00 00 .e.{.{.L........ 0030 00 00 00 0b 10 12 ac 1f 01 65 c5 d5 46 a7 0b f3 .........e..F... 0040 82 43 c5 d5 47 27 14 00 00 00 c5 d5 47 27 13 fb .C..G'......G'.. 0050 b3 6a c5 d5 47 67 17 fb b3 6a 5b 04 00 00 00 00 .j..Gg...j[..... 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. No. Time Source Destination Protocol Info 264 77.025585 172.31.1.101 172.31.1.104 NTP NTP Frame 264 (110 bytes on wire, 110 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) User Datagram Protocol, Src Port: ntp (123), Dst Port: ntp (123) Network Time Protocol 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 60 2e 59 00 00 80 11 b1 28 ac 1f 01 65 ac 1f .`.Y.....(...e.. 0020 01 68 00 7b 00 7b 00 4c 23 7c 1c 01 06 fa 00 00 .h.{.{.L#|...... 0030 00 00 00 0a fd e7 4c 4f 43 4c c5 d3 fd f1 04 31 ......LOCL.....1 0040 26 e9 c5 d5 47 67 17 fb b3 6a c5 d5 47 67 1c 00 &...Gg...j..Gg.. 0050 00 00 c5 d5 47 67 1c 00 00 00 00 00 00 00 3c 9d ....Gg........<. 0060 c4 85 38 37 9f 25 29 42 f3 c0 62 f4 5c db ..87.%)B..b.\. No. Time Source Destination Protocol Info 265 81.601461 172.31.1.104 172.31.1.101 TCP perf-port > blackjack [FIN, ACK] Seq=1802 Ack=344 Win=63897 Len=0 Frame 265 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1802, Ack: 344, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 60 40 00 80 06 bf 63 ac 1f 01 68 ac 1f .(.`@....c...h.. 0020 01 65 07 cb 04 01 05 7f 63 62 fd 8c 8c f0 50 11 .e......cb....P. 0030 f9 99 5c 03 00 00 00 00 00 e9 60 81 ..\.......`. No. Time Source Destination Protocol Info 266 81.602040 172.31.1.101 172.31.1.104 TCP blackjack > perf-port [ACK] Seq=344 Ack=1803 Win=63955 Len=0 Frame 266 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 344, Ack: 1803, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2e 5a 40 00 80 06 71 6a ac 1f 01 65 ac 1f .(.Z@...qj...e.. 0020 01 68 04 01 07 cb fd 8c 8c f0 05 7f 63 63 50 10 .h..........ccP. 0030 f9 d3 5b c9 00 00 00 00 09 dd 60 82 ..[.......`. No. Time Source Destination Protocol Info 267 81.602418 172.31.1.101 172.31.1.104 TCP blackjack > perf-port [FIN, ACK] Seq=344 Ack=1803 Win=63955 Len=0 Frame 267 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: perf-port (1995), Seq: 344, Ack: 1803, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2e 5b 40 00 80 06 71 69 ac 1f 01 65 ac 1f .(.[@...qi...e.. 0020 01 68 04 01 07 cb fd 8c 8c f0 05 7f 63 63 50 11 .h..........ccP. 0030 f9 d3 5b c8 00 00 f9 6e b4 42 f0 14 ..[....n.B.. No. Time Source Destination Protocol Info 268 81.602599 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [FIN, ACK] Seq=1933 Ack=805 Win=63436 Len=0 Frame 268 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1933, Ack: 805, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 61 40 00 80 06 bf 62 ac 1f 01 68 ac 1f .(.a@....b...h.. 0020 01 65 07 ca 04 01 e7 79 57 af 52 21 b8 a4 50 11 .e.....yW.R!..P. 0030 f7 cc 07 41 00 00 05 00 00 03 10 00 ...A........ No. Time Source Destination Protocol Info 269 81.602928 172.31.1.101 172.31.1.104 TCP blackjack > stun-port [ACK] Seq=805 Ack=1934 Win=63782 Len=0 Frame 269 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 805, Ack: 1934, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2e 5c 40 00 80 06 71 68 ac 1f 01 65 ac 1f .(.\@...qh...e.. 0020 01 68 04 01 07 ca 52 21 b8 a4 e7 79 57 b0 50 10 .h....R!...yW.P. 0030 f9 26 05 e7 00 00 00 00 00 ae 60 81 .&........`. No. Time Source Destination Protocol Info 270 81.603306 172.31.1.104 172.31.1.101 TCP perf-port > blackjack [ACK] Seq=1803 Ack=345 Win=63897 Len=0 Frame 270 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: perf-port (1995), Dst Port: blackjack (1025), Seq: 1803, Ack: 345, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 63 40 00 80 06 bf 60 ac 1f 01 68 ac 1f .(.c@....`...h.. 0020 01 65 07 cb 04 01 05 7f 63 63 fd 8c 8c f1 50 10 .e......cc....P. 0030 f9 99 5c 02 00 00 00 00 00 62 60 60 ..\......b`` No. Time Source Destination Protocol Info 271 81.603964 172.31.1.101 172.31.1.104 TCP blackjack > stun-port [FIN, ACK] Seq=805 Ack=1934 Win=63782 Len=0 Frame 271 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:09:4d:fa, Dst: 00:0c:29:f0:6b:d1 Internet Protocol, Src Addr: 172.31.1.101 (172.31.1.101), Dst Addr: 172.31.1.104 (172.31.1.104) Transmission Control Protocol, Src Port: blackjack (1025), Dst Port: stun-port (1994), Seq: 805, Ack: 1934, Len: 0 0000 00 0c 29 f0 6b d1 00 0c 29 09 4d fa 08 00 45 00 ..).k...).M...E. 0010 00 28 2e 5d 40 00 80 06 71 67 ac 1f 01 65 ac 1f .(.]@...qg...e.. 0020 01 68 04 01 07 ca 52 21 b8 a4 e7 79 57 b0 50 11 .h....R!...yW.P. 0030 f9 26 05 e6 00 00 00 00 00 df 60 81 .&........`. No. Time Source Destination Protocol Info 272 81.605293 172.31.1.104 172.31.1.101 TCP stun-port > blackjack [ACK] Seq=1934 Ack=806 Win=63436 Len=0 Frame 272 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:0c:29:f0:6b:d1, Dst: 00:0c:29:09:4d:fa Internet Protocol, Src Addr: 172.31.1.104 (172.31.1.104), Dst Addr: 172.31.1.101 (172.31.1.101) Transmission Control Protocol, Src Port: stun-port (1994), Dst Port: blackjack (1025), Seq: 1934, Ack: 806, Len: 0 0000 00 0c 29 09 4d fa 00 0c 29 f0 6b d1 08 00 45 00 ..).M...).k...E. 0010 00 28 e0 65 40 00 80 06 bf 5e ac 1f 01 68 ac 1f .(.e@....^...h.. 0020 01 65 07 ca 04 01 e7 79 57 b0 52 21 b8 a5 50 10 .e.....yW.R!..P. 0030 f7 cc 07 40 00 00 05 00 02 03 10 00 ...@........