No. Time Source Destination Protocol Info 1 0.000000 00:e0:4c:78:c2:be ff:ff:ff:ff:ff:ff ARP Who has 10.0.1.12? Tell 10.0.1.11 Frame 1 (42 bytes on wire, 42 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff) Address Resolution Protocol (request) No. Time Source Destination Protocol Info 2 0.000038 00:e0:4c:78:bf:67 00:e0:4c:78:c2:be ARP 10.0.1.12 is at 00:e0:4c:78:bf:67 Frame 2 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Address Resolution Protocol (reply) No. Time Source Destination Protocol Info 3 0.000048 10.0.1.11 10.0.1.12 TCP 49543 > 22 [SYN] Seq=0 Ack=0 Win=5840 Len=0 MSS=1460 TSV=8604056 TSER=0 WS=2 Frame 3 (74 bytes on wire, 74 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 0, Ack: 0, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 0 (relative sequence number) Header length: 40 bytes Flags: 0x0002 (SYN) Window size: 5840 Checksum: 0xbd77 [correct] Options: (20 bytes) No. Time Source Destination Protocol Info 4 0.000272 10.0.1.12 10.0.1.11 TCP 22 > 49543 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=4342186 TSER=8604056 WS=2 Frame 4 (74 bytes on wire, 74 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 0, Ack: 1, Len: 0 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 40 bytes Flags: 0x0012 (SYN, ACK) Window size: 5792 Checksum: 0xe3df [correct] Options: (20 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 5 0.000304 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=8604058 TSER=4342186 Frame 5 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1, Ack: 1, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 5840 (scaled) Checksum: 0x2391 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 6 0.008446 10.0.1.12 10.0.1.11 SSHv2 Server Protocol: SSH-2.0-OpenSSH_3.9p1 Frame 6 (88 bytes on wire, 88 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1, Ack: 1, Len: 22 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1 (relative sequence number) Next sequence number: 23 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 5792 (scaled) Checksum: 0x3761 [correct] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 7 0.008461 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1 Ack=23 Win=5840 Len=0 TSV=8604066 TSER=4342194 Frame 7 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1, Ack: 23, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1 (relative sequence number) Acknowledgement number: 23 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 5840 (scaled) Checksum: 0x236b [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 8 0.020183 10.0.1.11 10.0.1.12 SSHv2 Client Protocol: SSH-2.0-OpenSSH_3.9p1 Frame 8 (88 bytes on wire, 88 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1, Ack: 23, Len: 22 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1 (relative sequence number) Next sequence number: 23 (relative sequence number) Acknowledgement number: 23 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 5840 (scaled) Checksum: 0x1653 [incorrect, should be 0x372b] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 9 0.020394 10.0.1.12 10.0.1.11 TCP 22 > 49543 [ACK] Seq=23 Ack=23 Win=5792 Len=0 TSV=4342206 TSER=8604078 Frame 9 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 23, Ack: 23, Len: 0 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 23 (relative sequence number) Acknowledgement number: 23 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 5792 (scaled) Checksum: 0x2349 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 10 0.020612 10.0.1.11 10.0.1.12 SSHv2 Client: Key Exchange Init Frame 10 (706 bytes on wire, 706 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 23, Ack: 23, Len: 640 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 23 (relative sequence number) Next sequence number: 663 (relative sequence number) Acknowledgement number: 23 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 5840 (scaled) Checksum: 0x18bd [incorrect, should be 0x7599] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 11 0.021332 10.0.1.12 10.0.1.11 TCP 22 > 49543 [ACK] Seq=23 Ack=663 Win=7072 Len=0 TSV=4342207 TSER=8604078 Frame 11 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 23, Ack: 663, Len: 0 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 23 (relative sequence number) Acknowledgement number: 663 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 7072 (scaled) Checksum: 0x1f88 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 12 0.022295 10.0.1.12 10.0.1.11 SSHv2 Server: Key Exchange Init Frame 12 (706 bytes on wire, 706 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 23, Ack: 663, Len: 640 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 23 (relative sequence number) Next sequence number: 663 (relative sequence number) Acknowledgement number: 663 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 7072 (scaled) Checksum: 0xee12 [correct] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 13 0.022459 10.0.1.11 10.0.1.12 SSHv2 Client: Diffie-Hellman GEX Request Frame 13 (90 bytes on wire, 90 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 663, Ack: 663, Len: 24 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 663 (relative sequence number) Next sequence number: 687 (relative sequence number) Acknowledgement number: 663 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 7120 (scaled) Checksum: 0x1655 [incorrect, should be 0xeea3] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 14 0.052026 10.0.1.12 10.0.1.11 SSHv2 Server: Diffie-Hellman Key Exchange Reply Frame 14 (218 bytes on wire, 218 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 663, Ack: 687, Len: 152 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 663 (relative sequence number) Next sequence number: 815 (relative sequence number) Acknowledgement number: 687 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 7072 (scaled) Checksum: 0xb4a3 [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 15 0.055891 10.0.1.11 10.0.1.12 SSHv2 Client: Diffie-Hellman GEX Init Frame 15 (210 bytes on wire, 210 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 687, Ack: 815, Len: 144 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 687 (relative sequence number) Next sequence number: 831 (relative sequence number) Acknowledgement number: 815 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8400 (scaled) Checksum: 0x16cd [incorrect, should be 0x1c22] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 16 0.085608 10.0.1.12 10.0.1.11 SSHv2 Server: Diffie-Hellman GEX Reply Frame 16 (530 bytes on wire, 530 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 815, Ack: 831, Len: 464 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 815 (relative sequence number) Next sequence number: 1279 (relative sequence number) Acknowledgement number: 831 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x079e [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 17 0.125806 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=831 Ack=1279 Win=9680 Len=0 TSV=8604183 TSER=4342271 Frame 17 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 831, Ack: 1279, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 831 (relative sequence number) Acknowledgement number: 1279 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0x16c3 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 18 2.913889 10.0.1.11 10.0.1.12 SSHv2 Client: New Keys Frame 18 (82 bytes on wire, 82 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 831, Ack: 1279, Len: 16 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 831 (relative sequence number) Next sequence number: 847 (relative sequence number) Acknowledgement number: 1279 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x164d [incorrect, should be 0x01a5] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 19 2.953849 10.0.1.12 10.0.1.11 TCP 22 > 49543 [ACK] Seq=1279 Ack=847 Win=8352 Len=0 TSV=4345140 TSER=8606972 Frame 19 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1279, Ack: 847, Len: 0 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1279 (relative sequence number) Acknowledgement number: 847 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 8352 (scaled) Checksum: 0x01e5 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 20 2.953873 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=48 Frame 20 (114 bytes on wire, 114 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 847, Ack: 1279, Len: 48 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 847 (relative sequence number) Next sequence number: 895 (relative sequence number) Acknowledgement number: 1279 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x166d [incorrect, should be 0x2095] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 21 2.954096 10.0.1.12 10.0.1.11 TCP 22 > 49543 [ACK] Seq=1279 Ack=895 Win=8352 Len=0 TSV=4345140 TSER=8607012 Frame 21 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1279, Ack: 895, Len: 0 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1279 (relative sequence number) Acknowledgement number: 895 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 8352 (scaled) Checksum: 0x018d [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 22 2.954251 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=48 Frame 22 (114 bytes on wire, 114 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1279, Ack: 895, Len: 48 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1279 (relative sequence number) Next sequence number: 1327 (relative sequence number) Acknowledgement number: 895 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x3e28 [correct] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 23 2.954260 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=895 Ack=1327 Win=9680 Len=0 TSV=8607012 TSER=4345140 Frame 23 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 895, Ack: 1327, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 895 (relative sequence number) Acknowledgement number: 1327 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0x0011 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 24 2.954740 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=64 Frame 24 (130 bytes on wire, 130 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 895, Ack: 1327, Len: 64 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 895 (relative sequence number) Next sequence number: 959 (relative sequence number) Acknowledgement number: 1327 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x167d [incorrect, should be 0x5349] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 25 2.955348 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=64 Frame 25 (130 bytes on wire, 130 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1327, Ack: 959, Len: 64 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1327 (relative sequence number) Next sequence number: 1391 (relative sequence number) Acknowledgement number: 959 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x90e6 [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 26 2.955464 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=96 Frame 26 (162 bytes on wire, 162 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 959, Ack: 1391, Len: 96 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 959 (relative sequence number) Next sequence number: 1055 (relative sequence number) Acknowledgement number: 1391 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x169d [incorrect, should be 0x1c4b] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 27 2.970358 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=64 Frame 27 (130 bytes on wire, 130 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1391, Ack: 1055, Len: 64 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1391 (relative sequence number) Next sequence number: 1455 (relative sequence number) Acknowledgement number: 1055 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x0eee [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 28 3.010305 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1055 Ack=1455 Win=9680 Len=0 TSV=8607068 TSER=4345156 Frame 28 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1055, Ack: 1455, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1055 (relative sequence number) Acknowledgement number: 1455 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0xfea8 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 29 5.541846 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=80 Frame 29 (146 bytes on wire, 146 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1055, Ack: 1455, Len: 80 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1055 (relative sequence number) Next sequence number: 1135 (relative sequence number) Acknowledgement number: 1455 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x168d [incorrect, should be 0x0fae] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 30 5.544590 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=48 Frame 30 (114 bytes on wire, 114 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1455, Ack: 1135, Len: 48 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1455 (relative sequence number) Next sequence number: 1503 (relative sequence number) Acknowledgement number: 1135 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x77fc [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 31 5.544621 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1135 Ack=1503 Win=9680 Len=0 TSV=8609603 TSER=4347731 Frame 31 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1135, Ack: 1503, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1135 (relative sequence number) Acknowledgement number: 1503 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0xea32 [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 32 5.544949 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=80 Frame 32 (146 bytes on wire, 146 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1135, Ack: 1503, Len: 80 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1135 (relative sequence number) Next sequence number: 1215 (relative sequence number) Acknowledgement number: 1503 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x168d [incorrect, should be 0x87d1] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 33 5.545915 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=32 Frame 33 (98 bytes on wire, 98 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1503, Ack: 1215, Len: 32 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1503 (relative sequence number) Next sequence number: 1535 (relative sequence number) Acknowledgement number: 1215 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0x2db8 [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 34 5.546200 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=64 Frame 34 (130 bytes on wire, 130 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1215, Ack: 1535, Len: 64 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1215 (relative sequence number) Next sequence number: 1279 (relative sequence number) Acknowledgement number: 1535 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x167d [incorrect, should be 0x32b5] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 35 5.547250 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=48 Frame 35 (114 bytes on wire, 114 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1535, Ack: 1279, Len: 48 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1535 (relative sequence number) Next sequence number: 1583 (relative sequence number) Acknowledgement number: 1279 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 8352 (scaled) Checksum: 0xe681 [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 36 5.547490 10.0.1.11 10.0.1.12 SSHv2 Encrypted request packet len=384 Frame 36 (450 bytes on wire, 450 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1279, Ack: 1583, Len: 384 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1279 (relative sequence number) Next sequence number: 1663 (relative sequence number) Acknowledgement number: 1583 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9680 (scaled) Checksum: 0x17bd [incorrect, should be 0x9413] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 37 5.568146 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=48 Frame 37 (114 bytes on wire, 114 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1583, Ack: 1663, Len: 48 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1583 (relative sequence number) Next sequence number: 1631 (relative sequence number) Acknowledgement number: 1663 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9632 (scaled) Checksum: 0xe4a1 [correct] Options: (12 bytes) SEQ/ACK analysis SSH Protocol No. Time Source Destination Protocol Info 38 5.568281 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=80 Frame 38 (146 bytes on wire, 146 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1631, Ack: 1663, Len: 80 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1631 (relative sequence number) Next sequence number: 1711 (relative sequence number) Acknowledgement number: 1663 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9632 (scaled) Checksum: 0xcd16 [correct] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 39 5.607863 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1663 Ack=1711 Win=9680 Len=0 TSV=8609666 TSER=4347754 Frame 39 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1663, Ack: 1711, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1663 (relative sequence number) Acknowledgement number: 1711 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0xe6fc [correct] Options: (12 bytes) SEQ/ACK analysis No. Time Source Destination Protocol Info 40 5.608133 10.0.1.12 10.0.1.11 SSHv2 Encrypted response packet len=80 Frame 40 (146 bytes on wire, 146 bytes captured) Ethernet II, Src: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67), Dst: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be) Internet Protocol, Src: 10.0.1.12 (10.0.1.12), Dst: 10.0.1.11 (10.0.1.11) Transmission Control Protocol, Src Port: 22 (22), Dst Port: 49543 (49543), Seq: 1711, Ack: 1663, Len: 80 Source port: 22 (22) Destination port: 49543 (49543) Sequence number: 1711 (relative sequence number) Next sequence number: 1791 (relative sequence number) Acknowledgement number: 1663 (relative ack number) Header length: 32 bytes Flags: 0x0018 (PSH, ACK) Window size: 9632 (scaled) Checksum: 0xae99 [correct] Options: (12 bytes) SSH Protocol No. Time Source Destination Protocol Info 41 5.608155 10.0.1.11 10.0.1.12 TCP 49543 > 22 [ACK] Seq=1663 Ack=1791 Win=9680 Len=0 TSV=8609666 TSER=4347794 Frame 41 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: 00:e0:4c:78:c2:be (00:e0:4c:78:c2:be), Dst: 00:e0:4c:78:bf:67 (00:e0:4c:78:bf:67) Internet Protocol, Src: 10.0.1.11 (10.0.1.11), Dst: 10.0.1.12 (10.0.1.12) Transmission Control Protocol, Src Port: 49543 (49543), Dst Port: 22 (22), Seq: 1663, Ack: 1791, Len: 0 Source port: 49543 (49543) Destination port: 22 (22) Sequence number: 1663 (relative sequence number) Acknowledgement number: 1791 (relative ack number) Header length: 32 bytes Flags: 0x0010 (ACK) Window size: 9680 (scaled) Checksum: 0xe684 [correct] Options: (12 bytes) SEQ/ACK analysis