No. Time Source Destination Protocol Info 1 0.000000 192.168.2.205 192.168.2.202 TCP 2826 > 3306 [SYN] Seq=0 Len=0 MSS=1460 Frame 1 (62 bytes on wire, 62 bytes captured) Arrival Time: Nov 8, 2007 13:13:55.834967000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 62 bytes Capture Length: 62 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: QuantaCo_b9:45:ab (00:16:36:b9:45:ab), Dst: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Destination: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.205 (192.168.2.205), Dst: 192.168.2.202 (192.168.2.202) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0xcd69 (52585) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0xa676] [Good: False] [Bad : True] Source: 192.168.2.205 (192.168.2.205) Destination: 192.168.2.202 (192.168.2.202) Transmission Control Protocol, Src Port: 2826 (2826), Dst Port: 3306 (3306), Seq: 0, Len: 0 Source port: 2826 (2826) Destination port: 3306 (3306) Sequence number: 0 (relative sequence number) Header length: 28 bytes Flags: 0x02 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgment: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 16384 Checksum: 0x8cc2 [correct] [Good Checksum: True] [Bad Checksum: False] Options: (8 bytes) Maximum segment size: 1460 bytes NOP NOP SACK permitted No. Time Source Destination Protocol Info 2 0.000268 192.168.2.202 192.168.2.205 TCP 3306 > 2826 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 Frame 2 (62 bytes on wire, 62 bytes captured) Arrival Time: Nov 8, 2007 13:13:55.835235000 [Time delta from previous captured frame: 0.000268000 seconds] [Time delta from previous displayed frame: 0.000268000 seconds] [Time since reference or first frame: 0.000268000 seconds] Frame Number: 2 Frame Length: 62 bytes Capture Length: 62 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Internet_1f:35:3e (00:e0:4d:1f:35:3e), Dst: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Destination: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.202 (192.168.2.202), Dst: 192.168.2.205 (192.168.2.205) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 48 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb3e0 [correct] [Good: True] [Bad : False] Source: 192.168.2.202 (192.168.2.202) Destination: 192.168.2.205 (192.168.2.205) Transmission Control Protocol, Src Port: 3306 (3306), Dst Port: 2826 (2826), Seq: 0, Ack: 1, Len: 0 Source port: 3306 (3306) Destination port: 2826 (2826) Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 28 bytes Flags: 0x12 (SYN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set .... ...0 = Fin: Not set Window size: 5840 Checksum: 0xfd51 [correct] [Good Checksum: True] [Bad Checksum: False] Options: (8 bytes) Maximum segment size: 1460 bytes NOP NOP SACK permitted [SEQ/ACK analysis] [This is an ACK to the segment in frame: 1] [The RTT to ACK the segment was: 0.000268000 seconds] No. Time Source Destination Protocol Info 3 0.000295 192.168.2.205 192.168.2.202 TCP 2826 > 3306 [ACK] Seq=1 Ack=1 Win=17520 [TCP CHECKSUM INCORRECT] Len=0 Frame 3 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 8, 2007 13:13:55.835262000 [Time delta from previous captured frame: 0.000027000 seconds] [Time delta from previous displayed frame: 0.000027000 seconds] [Time since reference or first frame: 0.000295000 seconds] Frame Number: 3 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: QuantaCo_b9:45:ab (00:16:36:b9:45:ab), Dst: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Destination: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.205 (192.168.2.205), Dst: 192.168.2.202 (192.168.2.202) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xcd6a (52586) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0xa67d] [Good: False] [Bad : True] Source: 192.168.2.205 (192.168.2.205) Destination: 192.168.2.202 (192.168.2.202) Transmission Control Protocol, Src Port: 2826 (2826), Dst Port: 3306 (3306), Seq: 1, Ack: 1, Len: 0 Source port: 2826 (2826) Destination port: 3306 (3306) Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17520 Checksum: 0x8702 [incorrect, should be 0xfc75 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2] [The RTT to ACK the segment was: 0.000027000 seconds] No. Time Source Destination Protocol Info 4 6.498167 192.168.2.202 192.168.2.205 MySQL Server Greeting proto=10 version=5.0.45-Debian_1ubuntu3-log Frame 4 (130 bytes on wire, 130 bytes captured) Arrival Time: Nov 8, 2007 13:14:02.333134000 [Time delta from previous captured frame: 6.497872000 seconds] [Time delta from previous displayed frame: 6.497872000 seconds] [Time since reference or first frame: 6.498167000 seconds] Frame Number: 4 Frame Length: 130 bytes Capture Length: 130 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:mysql] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Internet_1f:35:3e (00:e0:4d:1f:35:3e), Dst: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Destination: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.202 (192.168.2.202), Dst: 192.168.2.205 (192.168.2.205) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x08 (DSCP 0x02: Unknown DSCP; ECN: 0x00) 0000 10.. = Differentiated Services Codepoint: Unknown (0x02) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 116 Identification: 0x3519 (13593) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7e7b [correct] [Good: True] [Bad : False] Source: 192.168.2.202 (192.168.2.202) Destination: 192.168.2.205 (192.168.2.205) Transmission Control Protocol, Src Port: 3306 (3306), Dst Port: 2826 (2826), Seq: 1, Ack: 1, Len: 76 Source port: 3306 (3306) Destination port: 2826 (2826) Sequence number: 1 (relative sequence number) [Next sequence number: 77 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 20 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 5840 Checksum: 0xd5d4 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 3] [The RTT to ACK the segment was: 6.497872000 seconds] [PDU Size: 76] MySQL Protocol Packet Length: 72 Packet Number: 0 Server Greeting Protocol: 10 Version: 5.0.45-Debian_1ubuntu3-log Thread ID: 2293 Salt: Sao)|Vy! Server Capabilities: 0xA22C .... .... .... ...0 = Long Password: Not set .... .... .... ..0. = Found Rows: Not set .... .... .... .1.. = Long Column Flags: Set .... .... .... 1... = Connect With Database: Set .... .... ...0 .... = Dont Allow database.table.column: Not set .... .... ..1. .... = Can use compression protocol: Set .... .... .0.. .... = ODBC Client: Not set .... .... 0... .... = Can Use LOAD DATA LOCAL: Not set .... ...0 .... .... = Ignore Spaces before '(': Not set .... ..1. .... .... = Speaks 4.1 protocol (new flag): Set .... .0.. .... .... = Interactive Client: Not set .... 0... .... .... = Switch to SSL after handshake: Not set ...0 .... .... .... = Ignore sigpipes: Not set ..1. .... .... .... = Knows about transactions: Set .0.. .... .... .... = Speaks 4.1 protocol (old flag): Not set 1... .... .... .... = Can do 4.1 authentication: Set Charset: latin1 COLLATE latin1_swedish_ci (8) Server Status: 0x0002 .... .... .... ...0 = In transaction: Not set .... .... .... ..1. = AUTO_COMMIT: Set .... .... .... .0.. = More results: Not set .... .... .... 0... = Multi query - more resultsets: Not set .... .... ...0 .... = Bad index used: Not set .... .... ..0. .... = No index used: Not set .... .... .0.. .... = Cursor exists: Not set .... .... 0... .... = Last row sebd: Not set .... ...0 .... .... = database dropped: Not set .... ..0. .... .... = No backslash escapes: Not set Unused: Salt: 3}Af^(J{MP)z No. Time Source Destination Protocol Info 5 6.632091 192.168.2.205 192.168.2.202 TCP 2826 > 3306 [ACK] Seq=1 Ack=77 Win=17444 [TCP CHECKSUM INCORRECT] Len=0 Frame 5 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 8, 2007 13:14:02.467058000 [Time delta from previous captured frame: 0.133924000 seconds] [Time delta from previous displayed frame: 0.133924000 seconds] [Time since reference or first frame: 6.632091000 seconds] Frame Number: 5 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: QuantaCo_b9:45:ab (00:16:36:b9:45:ab), Dst: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Destination: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.205 (192.168.2.205), Dst: 192.168.2.202 (192.168.2.202) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xcd82 (52610) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0xa665] [Good: False] [Bad : True] Source: 192.168.2.205 (192.168.2.205) Destination: 192.168.2.202 (192.168.2.202) Transmission Control Protocol, Src Port: 2826 (2826), Dst Port: 3306 (3306), Seq: 1, Ack: 77, Len: 0 Source port: 2826 (2826) Destination port: 3306 (3306) Sequence number: 1 (relative sequence number) Acknowledgement number: 77 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17444 Checksum: 0x8702 [incorrect, should be 0xfc75 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 4] [The RTT to ACK the segment was: 0.133924000 seconds] No. Time Source Destination Protocol Info 6 8.431148 192.168.2.205 192.168.2.202 TCP 2826 > 3306 [FIN, ACK] Seq=1 Ack=77 Win=17444 [TCP CHECKSUM INCORRECT] Len=0 Frame 6 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 8, 2007 13:14:04.266115000 [Time delta from previous captured frame: 1.799057000 seconds] [Time delta from previous displayed frame: 1.799057000 seconds] [Time since reference or first frame: 8.431148000 seconds] Frame Number: 6 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: QuantaCo_b9:45:ab (00:16:36:b9:45:ab), Dst: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Destination: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.205 (192.168.2.205), Dst: 192.168.2.202 (192.168.2.202) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xcd83 (52611) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0xa664] [Good: False] [Bad : True] Source: 192.168.2.205 (192.168.2.205) Destination: 192.168.2.202 (192.168.2.202) Transmission Control Protocol, Src Port: 2826 (2826), Dst Port: 3306 (3306), Seq: 1, Ack: 77, Len: 0 Source port: 2826 (2826) Destination port: 3306 (3306) Sequence number: 1 (relative sequence number) Acknowledgement number: 77 (relative ack number) Header length: 20 bytes Flags: 0x11 (FIN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...1 = Fin: Set Window size: 17444 Checksum: 0x8702 [incorrect, should be 0xfc74 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] No. Time Source Destination Protocol Info 7 8.431438 192.168.2.202 192.168.2.205 TCP 3306 > 2826 [FIN, ACK] Seq=77 Ack=2 Win=5840 Len=0 Frame 7 (60 bytes on wire, 60 bytes captured) Arrival Time: Nov 8, 2007 13:14:04.266405000 [Time delta from previous captured frame: 0.000290000 seconds] [Time delta from previous displayed frame: 0.000290000 seconds] [Time since reference or first frame: 8.431438000 seconds] Frame Number: 7 Frame Length: 60 bytes Capture Length: 60 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Internet_1f:35:3e (00:e0:4d:1f:35:3e), Dst: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Destination: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Trailer: 000000000000 Internet Protocol, Src: 192.168.2.202 (192.168.2.202), Dst: 192.168.2.205 (192.168.2.205) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x08 (DSCP 0x02: Unknown DSCP; ECN: 0x00) 0000 10.. = Differentiated Services Codepoint: Unknown (0x02) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x351a (13594) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x7ec6 [correct] [Good: True] [Bad : False] Source: 192.168.2.202 (192.168.2.202) Destination: 192.168.2.205 (192.168.2.205) Transmission Control Protocol, Src Port: 3306 (3306), Dst Port: 2826 (2826), Seq: 77, Ack: 2, Len: 0 Source port: 3306 (3306) Destination port: 2826 (2826) Sequence number: 77 (relative sequence number) Acknowledgement number: 2 (relative ack number) Header length: 20 bytes Flags: 0x11 (FIN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...1 = Fin: Set Window size: 5840 Checksum: 0x29c8 [correct] [Good Checksum: True] [Bad Checksum: False] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 6] [The RTT to ACK the segment was: 0.000290000 seconds] No. Time Source Destination Protocol Info 8 8.431464 192.168.2.205 192.168.2.202 TCP 2826 > 3306 [ACK] Seq=2 Ack=78 Win=17444 [TCP CHECKSUM INCORRECT] Len=0 Frame 8 (54 bytes on wire, 54 bytes captured) Arrival Time: Nov 8, 2007 13:14:04.266431000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 8.431464000 seconds] Frame Number: 8 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: QuantaCo_b9:45:ab (00:16:36:b9:45:ab), Dst: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Destination: Internet_1f:35:3e (00:e0:4d:1f:35:3e) Address: Internet_1f:35:3e (00:e0:4d:1f:35:3e) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) Address: QuantaCo_b9:45:ab (00:16:36:b9:45:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.2.205 (192.168.2.205), Dst: 192.168.2.202 (192.168.2.202) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0xcd84 (52612) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 128 Protocol: TCP (0x06) Header checksum: 0x0000 [incorrect, should be 0xa663] [Good: False] [Bad : True] Source: 192.168.2.205 (192.168.2.205) Destination: 192.168.2.202 (192.168.2.202) Transmission Control Protocol, Src Port: 2826 (2826), Dst Port: 3306 (3306), Seq: 2, Ack: 78, Len: 0 Source port: 2826 (2826) Destination port: 3306 (3306) Sequence number: 2 (relative sequence number) Acknowledgement number: 78 (relative ack number) Header length: 20 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgment: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17444 Checksum: 0x8702 [incorrect, should be 0xfc73 (maybe caused by "TCP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] [SEQ/ACK analysis] [This is an ACK to the segment in frame: 7] [The RTT to ACK the segment was: 0.000026000 seconds]