Pour les amateurs de sniff (de réseaux), voici ce que l'on peut capturer avec un wireshark lorsque notre serveur DNS récursif effectue lorsqu'il cherche à résoudre www.education.gouv.fr alors qu'il vient juste de démarrer et que son cache est vide. Je vous laisse la joie d'analyser ceci par vous-même. Vous y découvrirez la suite de questions posées aux divers serveurs non récursifs, pour obtenir la réponse finale :
Frame 1 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.525400000
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 198.41.0.4 (198.41.0.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa99a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 198.41.0.4 (198.41.0.4)
User Datagram Protocol, Src Port: 46823 (46823), Dst Port: domain (53)
Source port: 46823 (46823)
Destination port: domain (53)
Length: 58
Checksum: 0x9150 [incorrect, should be 0xf754 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 3]
Transaction ID: 0xad84
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 2 (70 bytes on wire, 70 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.525448000
[Time delta from previous captured frame: 0.000048000 seconds]
[Time delta from previous displayed frame: 0.000048000 seconds]
[Time since reference or first frame: 0.000048000 seconds]
Frame Number: 2
Frame Length: 70 bytes
Capture Length: 70 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 198.41.0.4 (198.41.0.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 56
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa9b0 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 198.41.0.4 (198.41.0.4)
User Datagram Protocol, Src Port: 51086 (51086), Dst Port: domain (53)
Source port: 51086 (51086)
Destination port: domain (53)
Length: 36
Checksum: 0x913a [incorrect, should be 0x0fe8 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 5]
Transaction ID: 0x03ca
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
<Root>: type NS, class IN
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 3 (440 bytes on wire, 440 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.751144000
[Time delta from previous captured frame: 0.225696000 seconds]
[Time delta from previous displayed frame: 0.225696000 seconds]
[Time since reference or first frame: 0.225744000 seconds]
Frame Number: 3
Frame Length: 440 bytes
Capture Length: 440 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 198.41.0.4 (198.41.0.4), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 426
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 52
Protocol: UDP (0x11)
Header checksum: 0xb43e [correct]
[Good: True]
[Bad : False]
Source: 198.41.0.4 (198.41.0.4)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 46823 (46823)
Source port: domain (53)
Destination port: 46823 (46823)
Length: 406
Checksum: 0xaf9f [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 1]
[Time: 0.225744000 seconds]
Transaction ID: 0xad84
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 8
Additional RRs: 12
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
fr: type NS, class IN, ns G.EXT.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 12
Name server: G.EXT.NIC.fr
fr: type NS, class IN, ns A.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: A.NIC.fr
fr: type NS, class IN, ns F.EXT.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: F.EXT.NIC.fr
fr: type NS, class IN, ns C.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: C.NIC.fr
fr: type NS, class IN, ns E.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: E.NIC.fr
fr: type NS, class IN, ns B.EXT.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: B.EXT.NIC.fr
fr: type NS, class IN, ns D.EXT.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: D.EXT.NIC.fr
fr: type NS, class IN, ns E.EXT.NIC.fr
Name: fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: E.EXT.NIC.fr
Additional records
A.NIC.fr: type A, class IN, addr 192.93.0.129
Name: A.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.93.0.129
A.NIC.fr: type AAAA, class IN, addr 2001:660:3005:3::1:1
Name: A.NIC.fr
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:660:3005:3::1:1
B.EXT.NIC.fr: type A, class IN, addr 192.228.90.21
Name: B.EXT.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.228.90.21
C.NIC.fr: type A, class IN, addr 192.134.0.129
Name: C.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.134.0.129
C.NIC.fr: type AAAA, class IN, addr 2001:660:3006:4::1:1
Name: C.NIC.fr
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:660:3006:4::1:1
D.EXT.NIC.fr: type A, class IN, addr 204.152.184.85
Name: D.EXT.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 204.152.184.85
D.EXT.NIC.fr: type AAAA, class IN, addr 2001:4f8:0:2::8
Name: D.EXT.NIC.fr
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:4f8:0:2::8
E.EXT.NIC.fr: type A, class IN, addr 193.176.144.6
Name: E.EXT.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.176.144.6
E.NIC.fr: type A, class IN, addr 194.57.253.1
Name: E.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 194.57.253.1
F.EXT.NIC.fr: type A, class IN, addr 194.146.106.46
Name: F.EXT.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 194.146.106.46
G.EXT.NIC.fr: type A, class IN, addr 204.61.216.39
Name: G.EXT.NIC.fr
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 204.61.216.39
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 4 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.752069000
[Time delta from previous captured frame: 0.000925000 seconds]
[Time delta from previous displayed frame: 0.000925000 seconds]
[Time since reference or first frame: 0.226669000 seconds]
Frame Number: 4
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 204.61.216.39 (204.61.216.39)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xcb62 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 204.61.216.39 (204.61.216.39)
User Datagram Protocol, Src Port: 53923 (53923), Dst Port: domain (53)
Source port: 53923 (53923)
Destination port: domain (53)
Length: 58
Checksum: 0x6f88 [incorrect, should be 0xc0ee (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 6]
Transaction ID: 0xe9f6
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 5 (685 bytes on wire, 685 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.752266000
[Time delta from previous captured frame: 0.000197000 seconds]
[Time delta from previous displayed frame: 0.000197000 seconds]
[Time since reference or first frame: 0.226866000 seconds]
Frame Number: 5
Frame Length: 685 bytes
Capture Length: 685 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 198.41.0.4 (198.41.0.4), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 671
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 52
Protocol: UDP (0x11)
Header checksum: 0xb349 [correct]
[Good: True]
[Bad : False]
Source: 198.41.0.4 (198.41.0.4)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 51086 (51086)
Source port: domain (53)
Destination port: 51086 (51086)
Length: 651
Checksum: 0x4d70 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 2]
[Time: 0.226818000 seconds]
Transaction ID: 0x03ca
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 13
Authority RRs: 0
Additional RRs: 21
Queries
<Root>: type NS, class IN
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Answers
<Root>: type NS, class IN, ns A.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 20
Name server: A.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns D.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: D.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns B.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: B.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns H.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: H.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns G.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: G.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns E.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: E.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns C.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: C.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns M.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: M.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns J.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: J.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns F.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: F.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns L.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: L.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns I.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: I.ROOT-SERVERS.NET
<Root>: type NS, class IN, ns K.ROOT-SERVERS.NET
Name: <Root>
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 6 days
Data length: 4
Name server: K.ROOT-SERVERS.NET
Additional records
A.ROOT-SERVERS.NET: type A, class IN, addr 198.41.0.4
Name: A.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 198.41.0.4
A.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:503:ba3e::2:30
Name: A.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:503:ba3e::2:30
B.ROOT-SERVERS.NET: type A, class IN, addr 192.228.79.201
Name: B.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.228.79.201
C.ROOT-SERVERS.NET: type A, class IN, addr 192.33.4.12
Name: C.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.33.4.12
D.ROOT-SERVERS.NET: type A, class IN, addr 128.8.10.90
Name: D.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 128.8.10.90
E.ROOT-SERVERS.NET: type A, class IN, addr 192.203.230.10
Name: E.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.203.230.10
F.ROOT-SERVERS.NET: type A, class IN, addr 192.5.5.241
Name: F.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.5.5.241
F.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:2f::f
Name: F.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:500:2f::f
G.ROOT-SERVERS.NET: type A, class IN, addr 192.112.36.4
Name: G.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.112.36.4
H.ROOT-SERVERS.NET: type A, class IN, addr 128.63.2.53
Name: H.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 128.63.2.53
H.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:1::803f:235
Name: H.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:500:1::803f:235
I.ROOT-SERVERS.NET: type A, class IN, addr 192.36.148.17
Name: I.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.36.148.17
J.ROOT-SERVERS.NET: type A, class IN, addr 192.58.128.30
Name: J.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 192.58.128.30
J.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:503:c27::2:30
Name: J.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:503:c27::2:30
K.ROOT-SERVERS.NET: type A, class IN, addr 193.0.14.129
Name: K.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 193.0.14.129
K.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:7fd::1
Name: K.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:7fd::1
L.ROOT-SERVERS.NET: type A, class IN, addr 199.7.83.42
Name: L.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 199.7.83.42
L.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:3::42
Name: L.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:500:3::42
M.ROOT-SERVERS.NET: type A, class IN, addr 202.12.27.33
Name: M.ROOT-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 4
Addr: 202.12.27.33
M.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:dc3::35
Name: M.ROOT-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 41 days, 16 hours
Data length: 16
Addr: 2001:dc3::35
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 6 (136 bytes on wire, 136 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.817813000
[Time delta from previous captured frame: 0.065547000 seconds]
[Time delta from previous displayed frame: 0.065547000 seconds]
[Time since reference or first frame: 0.292413000 seconds]
Frame Number: 6
Frame Length: 136 bytes
Capture Length: 136 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 204.61.216.39 (204.61.216.39), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 122
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 55
Protocol: UDP (0x11)
Header checksum: 0xd436 [correct]
[Good: True]
[Bad : False]
Source: 204.61.216.39 (204.61.216.39)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 53923 (53923)
Source port: domain (53)
Destination port: 53923 (53923)
Length: 102
Checksum: 0x4a52 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 4]
[Time: 0.065744000 seconds]
Transaction ID: 0xe9f6
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 2
Additional RRs: 1
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
education.gouv.fr: type NS, class IN, ns ns3.atos.net
Name: education.gouv.fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 14
Name server: ns3.atos.net
education.gouv.fr: type NS, class IN, ns ns4.atos.net
Name: education.gouv.fr
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns4.atos.net
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 7 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.819229000
[Time delta from previous captured frame: 0.001416000 seconds]
[Time delta from previous displayed frame: 0.001416000 seconds]
[Time since reference or first frame: 0.293829000 seconds]
Frame Number: 7
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xed5c [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 128.63.2.53 (128.63.2.53)
User Datagram Protocol, Src Port: 33601 (33601), Dst Port: domain (53)
Source port: 33601 (33601)
Destination port: domain (53)
Length: 49
Checksum: 0x4d8e [incorrect, should be 0x25f0 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 11]
Transaction ID: 0x9a5a
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.atos.net: type A, class IN
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 8 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.819423000
[Time delta from previous captured frame: 0.000194000 seconds]
[Time delta from previous displayed frame: 0.000194000 seconds]
[Time since reference or first frame: 0.294023000 seconds]
Frame Number: 8
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xed5c [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 128.63.2.53 (128.63.2.53)
User Datagram Protocol, Src Port: 44176 (44176), Dst Port: domain (53)
Source port: 44176 (44176)
Destination port: domain (53)
Length: 49
Checksum: 0x4d8e [incorrect, should be 0x4a98 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 13]
Transaction ID: 0x4c48
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 9 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.819623000
[Time delta from previous captured frame: 0.000200000 seconds]
[Time delta from previous displayed frame: 0.000200000 seconds]
[Time since reference or first frame: 0.294223000 seconds]
Frame Number: 9
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xed5c [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 128.63.2.53 (128.63.2.53)
User Datagram Protocol, Src Port: 53775 (53775), Dst Port: domain (53)
Source port: 53775 (53775)
Destination port: domain (53)
Length: 49
Checksum: 0x4d8e [incorrect, should be 0xef3a (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 15]
Transaction ID: 0x8240
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns4.atos.net: type A, class IN
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 10 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.820219000
[Time delta from previous captured frame: 0.000596000 seconds]
[Time delta from previous displayed frame: 0.000596000 seconds]
[Time since reference or first frame: 0.294819000 seconds]
Frame Number: 10
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xed5c [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 128.63.2.53 (128.63.2.53)
User Datagram Protocol, Src Port: 55181 (55181), Dst Port: domain (53)
Source port: 55181 (55181)
Destination port: domain (53)
Length: 49
Checksum: 0x4d8e [incorrect, should be 0xa621 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 17]
Transaction ID: 0xc5c0
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 11 (568 bytes on wire, 568 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.965519000
[Time delta from previous captured frame: 0.145300000 seconds]
[Time delta from previous displayed frame: 0.145300000 seconds]
[Time since reference or first frame: 0.440119000 seconds]
Frame Number: 11
Frame Length: 568 bytes
Capture Length: 568 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 554
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 44
Protocol: UDP (0x11)
Header checksum: 0xff77 [correct]
[Good: True]
[Bad : False]
Source: 128.63.2.53 (128.63.2.53)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 33601 (33601)
Source port: domain (53)
Destination port: 33601 (33601)
Length: 534
Checksum: 0x0ebc [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 7]
[Time: 0.146290000 seconds]
Transaction ID: 0x9a5a
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 13
Additional RRs: 16
Queries
ns3.atos.net: type A, class IN
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
net: type NS, class IN, ns a.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 17
Name server: a.gtld-servers.net
net: type NS, class IN, ns b.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: b.gtld-servers.net
net: type NS, class IN, ns c.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: c.gtld-servers.net
net: type NS, class IN, ns d.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: d.gtld-servers.net
net: type NS, class IN, ns e.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: e.gtld-servers.net
net: type NS, class IN, ns f.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: f.gtld-servers.net
net: type NS, class IN, ns g.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: g.gtld-servers.net
net: type NS, class IN, ns h.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: h.gtld-servers.net
net: type NS, class IN, ns i.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: i.gtld-servers.net
net: type NS, class IN, ns j.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: j.gtld-servers.net
net: type NS, class IN, ns k.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: k.gtld-servers.net
net: type NS, class IN, ns l.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: l.gtld-servers.net
net: type NS, class IN, ns m.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: m.gtld-servers.net
Additional records
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
Name: a.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.5.6.30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
Name: b.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.33.14.30
c.gtld-servers.net: type A, class IN, addr 192.26.92.30
Name: c.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.26.92.30
d.gtld-servers.net: type A, class IN, addr 192.31.80.30
Name: d.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.31.80.30
e.gtld-servers.net: type A, class IN, addr 192.12.94.30
Name: e.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.12.94.30
f.gtld-servers.net: type A, class IN, addr 192.35.51.30
Name: f.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.35.51.30
g.gtld-servers.net: type A, class IN, addr 192.42.93.30
Name: g.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.42.93.30
h.gtld-servers.net: type A, class IN, addr 192.54.112.30
Name: h.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.54.112.30
i.gtld-servers.net: type A, class IN, addr 192.43.172.30
Name: i.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.43.172.30
j.gtld-servers.net: type A, class IN, addr 192.48.79.30
Name: j.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.48.79.30
k.gtld-servers.net: type A, class IN, addr 192.52.178.30
Name: k.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.52.178.30
l.gtld-servers.net: type A, class IN, addr 192.41.162.30
Name: l.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.41.162.30
m.gtld-servers.net: type A, class IN, addr 192.55.83.30
Name: m.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.55.83.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
Name: a.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:a83e::2:30
b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30
Name: b.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:231d::2:30
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 12 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.966490000
[Time delta from previous captured frame: 0.000971000 seconds]
[Time delta from previous displayed frame: 0.000971000 seconds]
[Time since reference or first frame: 0.441090000 seconds]
Frame Number: 12
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa191 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.33.14.30 (192.33.14.30)
User Datagram Protocol, Src Port: 59259 (59259), Dst Port: domain (53)
Source port: 59259 (59259)
Destination port: domain (53)
Length: 49
Checksum: 0x9959 [incorrect, should be 0x2d83 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 19]
Transaction ID: 0xe2c1
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.atos.net: type A, class IN
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 13 (568 bytes on wire, 568 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.966808000
[Time delta from previous captured frame: 0.000318000 seconds]
[Time delta from previous displayed frame: 0.000318000 seconds]
[Time since reference or first frame: 0.441408000 seconds]
Frame Number: 13
Frame Length: 568 bytes
Capture Length: 568 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 554
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 44
Protocol: UDP (0x11)
Header checksum: 0xff77 [correct]
[Good: True]
[Bad : False]
Source: 128.63.2.53 (128.63.2.53)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 44176 (44176)
Source port: domain (53)
Destination port: 44176 (44176)
Length: 534
Checksum: 0x3364 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 8]
[Time: 0.147385000 seconds]
Transaction ID: 0x4c48
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 13
Additional RRs: 16
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
net: type NS, class IN, ns a.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 17
Name server: a.gtld-servers.net
net: type NS, class IN, ns b.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: b.gtld-servers.net
net: type NS, class IN, ns c.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: c.gtld-servers.net
net: type NS, class IN, ns d.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: d.gtld-servers.net
net: type NS, class IN, ns e.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: e.gtld-servers.net
net: type NS, class IN, ns f.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: f.gtld-servers.net
net: type NS, class IN, ns g.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: g.gtld-servers.net
net: type NS, class IN, ns h.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: h.gtld-servers.net
net: type NS, class IN, ns i.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: i.gtld-servers.net
net: type NS, class IN, ns j.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: j.gtld-servers.net
net: type NS, class IN, ns k.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: k.gtld-servers.net
net: type NS, class IN, ns l.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: l.gtld-servers.net
net: type NS, class IN, ns m.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: m.gtld-servers.net
Additional records
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
Name: a.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.5.6.30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
Name: b.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.33.14.30
c.gtld-servers.net: type A, class IN, addr 192.26.92.30
Name: c.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.26.92.30
d.gtld-servers.net: type A, class IN, addr 192.31.80.30
Name: d.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.31.80.30
e.gtld-servers.net: type A, class IN, addr 192.12.94.30
Name: e.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.12.94.30
f.gtld-servers.net: type A, class IN, addr 192.35.51.30
Name: f.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.35.51.30
g.gtld-servers.net: type A, class IN, addr 192.42.93.30
Name: g.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.42.93.30
h.gtld-servers.net: type A, class IN, addr 192.54.112.30
Name: h.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.54.112.30
i.gtld-servers.net: type A, class IN, addr 192.43.172.30
Name: i.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.43.172.30
j.gtld-servers.net: type A, class IN, addr 192.48.79.30
Name: j.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.48.79.30
k.gtld-servers.net: type A, class IN, addr 192.52.178.30
Name: k.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.52.178.30
l.gtld-servers.net: type A, class IN, addr 192.41.162.30
Name: l.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.41.162.30
m.gtld-servers.net: type A, class IN, addr 192.55.83.30
Name: m.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.55.83.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
Name: a.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:a83e::2:30
b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30
Name: b.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:231d::2:30
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 14 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.967319000
[Time delta from previous captured frame: 0.000511000 seconds]
[Time delta from previous displayed frame: 0.000511000 seconds]
[Time since reference or first frame: 0.441919000 seconds]
Frame Number: 14
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa191 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.33.14.30 (192.33.14.30)
User Datagram Protocol, Src Port: 37934 (37934), Dst Port: domain (53)
Source port: 37934 (37934)
Destination port: domain (53)
Length: 49
Checksum: 0x9959 [incorrect, should be 0x1960 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 20]
Transaction ID: 0x4a17
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 15 (568 bytes on wire, 568 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.968223000
[Time delta from previous captured frame: 0.000904000 seconds]
[Time delta from previous displayed frame: 0.000904000 seconds]
[Time since reference or first frame: 0.442823000 seconds]
Frame Number: 15
Frame Length: 568 bytes
Capture Length: 568 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 554
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 44
Protocol: UDP (0x11)
Header checksum: 0xff77 [correct]
[Good: True]
[Bad : False]
Source: 128.63.2.53 (128.63.2.53)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 53775 (53775)
Source port: domain (53)
Destination port: 53775 (53775)
Length: 534
Checksum: 0xd806 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 9]
[Time: 0.148600000 seconds]
Transaction ID: 0x8240
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 13
Additional RRs: 16
Queries
ns4.atos.net: type A, class IN
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
net: type NS, class IN, ns a.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 17
Name server: a.gtld-servers.net
net: type NS, class IN, ns b.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: b.gtld-servers.net
net: type NS, class IN, ns c.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: c.gtld-servers.net
net: type NS, class IN, ns d.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: d.gtld-servers.net
net: type NS, class IN, ns e.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: e.gtld-servers.net
net: type NS, class IN, ns f.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: f.gtld-servers.net
net: type NS, class IN, ns g.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: g.gtld-servers.net
net: type NS, class IN, ns h.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: h.gtld-servers.net
net: type NS, class IN, ns i.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: i.gtld-servers.net
net: type NS, class IN, ns j.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: j.gtld-servers.net
net: type NS, class IN, ns k.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: k.gtld-servers.net
net: type NS, class IN, ns l.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: l.gtld-servers.net
net: type NS, class IN, ns m.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: m.gtld-servers.net
Additional records
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
Name: a.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.5.6.30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
Name: b.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.33.14.30
c.gtld-servers.net: type A, class IN, addr 192.26.92.30
Name: c.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.26.92.30
d.gtld-servers.net: type A, class IN, addr 192.31.80.30
Name: d.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.31.80.30
e.gtld-servers.net: type A, class IN, addr 192.12.94.30
Name: e.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.12.94.30
f.gtld-servers.net: type A, class IN, addr 192.35.51.30
Name: f.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.35.51.30
g.gtld-servers.net: type A, class IN, addr 192.42.93.30
Name: g.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.42.93.30
h.gtld-servers.net: type A, class IN, addr 192.54.112.30
Name: h.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.54.112.30
i.gtld-servers.net: type A, class IN, addr 192.43.172.30
Name: i.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.43.172.30
j.gtld-servers.net: type A, class IN, addr 192.48.79.30
Name: j.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.48.79.30
k.gtld-servers.net: type A, class IN, addr 192.52.178.30
Name: k.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.52.178.30
l.gtld-servers.net: type A, class IN, addr 192.41.162.30
Name: l.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.41.162.30
m.gtld-servers.net: type A, class IN, addr 192.55.83.30
Name: m.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.55.83.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
Name: a.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:a83e::2:30
b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30
Name: b.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:231d::2:30
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 16 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.968724000
[Time delta from previous captured frame: 0.000501000 seconds]
[Time delta from previous displayed frame: 0.000501000 seconds]
[Time since reference or first frame: 0.443324000 seconds]
Frame Number: 16
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa191 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.33.14.30 (192.33.14.30)
User Datagram Protocol, Src Port: 57419 (57419), Dst Port: domain (53)
Source port: 57419 (57419)
Destination port: domain (53)
Length: 49
Checksum: 0x9959 [incorrect, should be 0x33f4 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 21]
Transaction ID: 0xe37f
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns4.atos.net: type A, class IN
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 17 (568 bytes on wire, 568 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.969408000
[Time delta from previous captured frame: 0.000684000 seconds]
[Time delta from previous displayed frame: 0.000684000 seconds]
[Time since reference or first frame: 0.444008000 seconds]
Frame Number: 17
Frame Length: 568 bytes
Capture Length: 568 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 554
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 44
Protocol: UDP (0x11)
Header checksum: 0xff77 [correct]
[Good: True]
[Bad : False]
Source: 128.63.2.53 (128.63.2.53)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 55181 (55181)
Source port: domain (53)
Destination port: 55181 (55181)
Length: 534
Checksum: 0x8eed [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 10]
[Time: 0.149189000 seconds]
Transaction ID: 0xc5c0
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 13
Additional RRs: 16
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
net: type NS, class IN, ns a.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 17
Name server: a.gtld-servers.net
net: type NS, class IN, ns b.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: b.gtld-servers.net
net: type NS, class IN, ns c.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: c.gtld-servers.net
net: type NS, class IN, ns d.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: d.gtld-servers.net
net: type NS, class IN, ns e.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: e.gtld-servers.net
net: type NS, class IN, ns f.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: f.gtld-servers.net
net: type NS, class IN, ns g.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: g.gtld-servers.net
net: type NS, class IN, ns h.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: h.gtld-servers.net
net: type NS, class IN, ns i.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: i.gtld-servers.net
net: type NS, class IN, ns j.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: j.gtld-servers.net
net: type NS, class IN, ns k.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: k.gtld-servers.net
net: type NS, class IN, ns l.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: l.gtld-servers.net
net: type NS, class IN, ns m.gtld-servers.net
Name: net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: m.gtld-servers.net
Additional records
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
Name: a.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.5.6.30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
Name: b.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.33.14.30
c.gtld-servers.net: type A, class IN, addr 192.26.92.30
Name: c.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.26.92.30
d.gtld-servers.net: type A, class IN, addr 192.31.80.30
Name: d.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.31.80.30
e.gtld-servers.net: type A, class IN, addr 192.12.94.30
Name: e.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.12.94.30
f.gtld-servers.net: type A, class IN, addr 192.35.51.30
Name: f.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.35.51.30
g.gtld-servers.net: type A, class IN, addr 192.42.93.30
Name: g.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.42.93.30
h.gtld-servers.net: type A, class IN, addr 192.54.112.30
Name: h.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.54.112.30
i.gtld-servers.net: type A, class IN, addr 192.43.172.30
Name: i.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.43.172.30
j.gtld-servers.net: type A, class IN, addr 192.48.79.30
Name: j.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.48.79.30
k.gtld-servers.net: type A, class IN, addr 192.52.178.30
Name: k.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.52.178.30
l.gtld-servers.net: type A, class IN, addr 192.41.162.30
Name: l.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.41.162.30
m.gtld-servers.net: type A, class IN, addr 192.55.83.30
Name: m.gtld-servers.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.55.83.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
Name: a.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:a83e::2:30
b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30
Name: b.gtld-servers.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:231d::2:30
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 18 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:17.969968000
[Time delta from previous captured frame: 0.000560000 seconds]
[Time delta from previous displayed frame: 0.000560000 seconds]
[Time since reference or first frame: 0.444568000 seconds]
Frame Number: 18
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa191 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.33.14.30 (192.33.14.30)
User Datagram Protocol, Src Port: 49346 (49346), Dst Port: domain (53)
Source port: 49346 (49346)
Destination port: domain (53)
Length: 49
Checksum: 0x9959 [incorrect, should be 0x8338 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 24]
Transaction ID: 0xb3a9
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 19 (163 bytes on wire, 163 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.052941000
[Time delta from previous captured frame: 0.082973000 seconds]
[Time delta from previous displayed frame: 0.082973000 seconds]
[Time since reference or first frame: 0.527541000 seconds]
Frame Number: 19
Frame Length: 163 bytes
Capture Length: 163 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 149
Identification: 0x012e (302)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (0x11)
Header checksum: 0xab13 [correct]
[Good: True]
[Bad : False]
Source: 192.33.14.30 (192.33.14.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 59259 (59259)
Source port: domain (53)
Destination port: 59259 (59259)
Length: 129
Checksum: 0xa413 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 12]
[Time: 0.086451000 seconds]
Transaction ID: 0xe2c1
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 2
Additional RRs: 3
Queries
ns3.atos.net: type A, class IN
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Answers
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
Authoritative nameservers
atos.net: type NS, class IN, ns ns3.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns3.atos.net
atos.net: type NS, class IN, ns ns4.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns4.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 20 (147 bytes on wire, 147 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.052991000
[Time delta from previous captured frame: 0.000050000 seconds]
[Time delta from previous displayed frame: 0.000050000 seconds]
[Time since reference or first frame: 0.527591000 seconds]
Frame Number: 20
Frame Length: 147 bytes
Capture Length: 147 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 133
Identification: 0x0130 (304)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (0x11)
Header checksum: 0xab21 [correct]
[Good: True]
[Bad : False]
Source: 192.33.14.30 (192.33.14.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 37934 (37934)
Source port: domain (53)
Destination port: 37934 (37934)
Length: 113
Checksum: 0x0c9a [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 14]
[Time: 0.085672000 seconds]
Transaction ID: 0x4a17
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 2
Additional RRs: 3
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
atos.net: type NS, class IN, ns ns3.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns3.atos.net
atos.net: type NS, class IN, ns ns4.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns4.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 21 (163 bytes on wire, 163 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.054794000
[Time delta from previous captured frame: 0.001803000 seconds]
[Time delta from previous displayed frame: 0.001803000 seconds]
[Time since reference or first frame: 0.529394000 seconds]
Frame Number: 21
Frame Length: 163 bytes
Capture Length: 163 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 149
Identification: 0x0134 (308)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (0x11)
Header checksum: 0xab0d [correct]
[Good: True]
[Bad : False]
Source: 192.33.14.30 (192.33.14.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 57419 (57419)
Source port: domain (53)
Destination port: 57419 (57419)
Length: 129
Checksum: 0xd3c5 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 16]
[Time: 0.086070000 seconds]
Transaction ID: 0xe37f
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 2
Additional RRs: 3
Queries
ns4.atos.net: type A, class IN
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Answers
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
Authoritative nameservers
atos.net: type NS, class IN, ns ns3.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.atos.net
atos.net: type NS, class IN, ns ns4.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns4.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 22 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.054973000
[Time delta from previous captured frame: 0.000179000 seconds]
[Time delta from previous displayed frame: 0.000179000 seconds]
[Time since reference or first frame: 0.529573000 seconds]
Frame Number: 22
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x7fa0 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 193.56.46.248 (193.56.46.248)
User Datagram Protocol, Src Port: 41923 (41923), Dst Port: domain (53)
Source port: 41923 (41923)
Destination port: domain (53)
Length: 49
Checksum: 0xbb4a [incorrect, should be 0x803e (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 26]
Transaction ID: 0xb1b2
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 23 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.055249000
[Time delta from previous captured frame: 0.000276000 seconds]
[Time delta from previous displayed frame: 0.000276000 seconds]
[Time since reference or first frame: 0.529849000 seconds]
Frame Number: 23
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x7f97 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 193.56.46.248 (193.56.46.248)
User Datagram Protocol, Src Port: 36866 (36866), Dst Port: domain (53)
Source port: 36866 (36866)
Destination port: domain (53)
Length: 58
Checksum: 0xbb53 [incorrect, should be 0x8575 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 27]
Transaction ID: 0x1c46
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 24 (147 bytes on wire, 147 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.055585000
[Time delta from previous captured frame: 0.000336000 seconds]
[Time delta from previous displayed frame: 0.000336000 seconds]
[Time since reference or first frame: 0.530185000 seconds]
Frame Number: 24
Frame Length: 147 bytes
Capture Length: 147 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 133
Identification: 0x0138 (312)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (0x11)
Header checksum: 0xab19 [correct]
[Good: True]
[Bad : False]
Source: 192.33.14.30 (192.33.14.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 49346 (49346)
Source port: domain (53)
Destination port: 49346 (49346)
Length: 113
Checksum: 0x7681 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 18]
[Time: 0.085617000 seconds]
Transaction ID: 0xb3a9
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 2
Additional RRs: 3
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
atos.net: type NS, class IN, ns ns3.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.atos.net
atos.net: type NS, class IN, ns ns4.atos.net
Name: atos.net
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns4.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 25 (83 bytes on wire, 83 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.055900000
[Time delta from previous captured frame: 0.000315000 seconds]
[Time delta from previous displayed frame: 0.000315000 seconds]
[Time since reference or first frame: 0.530500000 seconds]
Frame Number: 25
Frame Length: 83 bytes
Capture Length: 83 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 69
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x7fa0 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 193.56.46.248 (193.56.46.248)
User Datagram Protocol, Src Port: 34065 (34065), Dst Port: domain (53)
Source port: 34065 (34065)
Destination port: domain (53)
Length: 49
Checksum: 0xbb4a [incorrect, should be 0xb376 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 29]
Transaction ID: 0x9d2b
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 26 (139 bytes on wire, 139 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.113489000
[Time delta from previous captured frame: 0.057589000 seconds]
[Time delta from previous displayed frame: 0.057589000 seconds]
[Time since reference or first frame: 0.588089000 seconds]
Frame Number: 26
Frame Length: 139 bytes
Capture Length: 139 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 125
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x8968 [correct]
[Good: True]
[Bad : False]
Source: 193.56.46.248 (193.56.46.248)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 41923 (41923)
Source port: domain (53)
Destination port: 41923 (41923)
Length: 105
Checksum: 0x4966 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 22]
[Time: 0.058516000 seconds]
Transaction ID: 0xb1b2
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
ns3.atos.net: type AAAA, class IN
Name: ns3.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
atos.net: type SOA, class IN, mname ns3.atos.net
Name: atos.net
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 day
Data length: 44
Primary name server: ns3.atos.net
Responsible authority's mailbox: hostmaster.axime.com
Serial number: 2007101801
Refresh interval: 6 hours
Retry interval: 1 hour
Expiration limit: 30 days
Minimum TTL: 1 day
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 27 (300 bytes on wire, 300 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.114211000
[Time delta from previous captured frame: 0.000722000 seconds]
[Time delta from previous displayed frame: 0.000722000 seconds]
[Time since reference or first frame: 0.588811000 seconds]
Frame Number: 27
Frame Length: 300 bytes
Capture Length: 300 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 286
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x88c7 [correct]
[Good: True]
[Bad : False]
Source: 193.56.46.248 (193.56.46.248)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 36866 (36866)
Source port: domain (53)
Destination port: 36866 (36866)
Length: 266
Checksum: 0x0e76 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 23]
[Time: 0.058962000 seconds]
Transaction ID: 0x1c46
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 2
Authority RRs: 5
Additional RRs: 3
Queries
www.education.gouv.fr: type A, class IN
Name: www.education.gouv.fr
Type: A (Host address)
Class: IN (0x0001)
Answers
www.education.gouv.fr: type CNAME, class IN, cname front.webedu.men.aw.atosorigin.com
Name: www.education.gouv.fr
Type: CNAME (Canonical name for an alias)
Class: IN (0x0001)
Time to live: 1 hour
Data length: 36
Primary name: front.webedu.men.aw.atosorigin.com
front.webedu.men.aw.atosorigin.com: type A, class IN, addr 160.92.130.142
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 160.92.130.142
Authoritative nameservers
aw.atosorigin.com: type NS, class IN, ns ns4.atos.net
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 14
Name server: ns4.atos.net
aw.atosorigin.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 20
Name server: ns1.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns2.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns3.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns3.atos.net
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns3.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 28 (105 bytes on wire, 105 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.114788000
[Time delta from previous captured frame: 0.000577000 seconds]
[Time delta from previous displayed frame: 0.000577000 seconds]
[Time since reference or first frame: 0.589388000 seconds]
Frame Number: 28
Frame Length: 105 bytes
Capture Length: 105 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.112.36.4 (192.112.36.4)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 91
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x8b46 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.112.36.4 (192.112.36.4)
User Datagram Protocol, Src Port: 49484 (49484), Dst Port: domain (53)
Source port: 49484 (49484)
Destination port: domain (53)
Length: 71
Checksum: 0xafa4 [incorrect, should be 0x73a4 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 30]
Transaction ID: 0x7d69
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 29 (143 bytes on wire, 143 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.116129000
[Time delta from previous captured frame: 0.001341000 seconds]
[Time delta from previous displayed frame: 0.001341000 seconds]
[Time since reference or first frame: 0.590729000 seconds]
Frame Number: 29
Frame Length: 143 bytes
Capture Length: 143 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 129
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x8964 [correct]
[Good: True]
[Bad : False]
Source: 193.56.46.248 (193.56.46.248)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 34065 (34065)
Source port: domain (53)
Destination port: 34065 (34065)
Length: 109
Checksum: 0x05ed [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 25]
[Time: 0.060229000 seconds]
Transaction ID: 0x9d2b
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
ns4.atos.net: type AAAA, class IN
Name: ns4.atos.net
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
atos.net: type SOA, class IN, mname ns3.atos.net
Name: atos.net
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 day
Data length: 48
Primary name server: ns3.atos.net
Responsible authority's mailbox: hostmaster.axime.com
Serial number: 2007101801
Refresh interval: 6 hours
Retry interval: 1 hour
Expiration limit: 30 days
Minimum TTL: 1 day
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 30 (593 bytes on wire, 593 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.289804000
[Time delta from previous captured frame: 0.173675000 seconds]
[Time delta from previous displayed frame: 0.173675000 seconds]
[Time since reference or first frame: 0.764404000 seconds]
Frame Number: 30
Frame Length: 593 bytes
Capture Length: 593 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.112.36.4 (192.112.36.4), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 579
Identification: 0xb4bf (46271)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 235
Protocol: UDP (0x11)
Header checksum: 0x299e [correct]
[Good: True]
[Bad : False]
Source: 192.112.36.4 (192.112.36.4)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 49484 (49484)
Source port: domain (53)
Destination port: 49484 (49484)
Length: 559
Checksum: 0xdbd9 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 28]
[Time: 0.175016000 seconds]
Transaction ID: 0x7d69
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 13
Additional RRs: 16
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
com: type NS, class IN, ns C.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 20
Name server: C.GTLD-SERVERS.NET
com: type NS, class IN, ns B.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: B.GTLD-SERVERS.NET
com: type NS, class IN, ns F.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: F.GTLD-SERVERS.NET
com: type NS, class IN, ns I.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: I.GTLD-SERVERS.NET
com: type NS, class IN, ns D.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: D.GTLD-SERVERS.NET
com: type NS, class IN, ns K.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: K.GTLD-SERVERS.NET
com: type NS, class IN, ns H.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: H.GTLD-SERVERS.NET
com: type NS, class IN, ns L.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: L.GTLD-SERVERS.NET
com: type NS, class IN, ns J.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: J.GTLD-SERVERS.NET
com: type NS, class IN, ns G.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: G.GTLD-SERVERS.NET
com: type NS, class IN, ns E.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: E.GTLD-SERVERS.NET
com: type NS, class IN, ns M.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: M.GTLD-SERVERS.NET
com: type NS, class IN, ns A.GTLD-SERVERS.NET
Name: com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Name server: A.GTLD-SERVERS.NET
Additional records
A.GTLD-SERVERS.NET: type A, class IN, addr 192.5.6.30
Name: A.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.5.6.30
B.GTLD-SERVERS.NET: type A, class IN, addr 192.33.14.30
Name: B.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.33.14.30
C.GTLD-SERVERS.NET: type A, class IN, addr 192.26.92.30
Name: C.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.26.92.30
D.GTLD-SERVERS.NET: type A, class IN, addr 192.31.80.30
Name: D.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.31.80.30
E.GTLD-SERVERS.NET: type A, class IN, addr 192.12.94.30
Name: E.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.12.94.30
F.GTLD-SERVERS.NET: type A, class IN, addr 192.35.51.30
Name: F.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.35.51.30
G.GTLD-SERVERS.NET: type A, class IN, addr 192.42.93.30
Name: G.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.42.93.30
H.GTLD-SERVERS.NET: type A, class IN, addr 192.54.112.30
Name: H.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.54.112.30
I.GTLD-SERVERS.NET: type A, class IN, addr 192.43.172.30
Name: I.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.43.172.30
J.GTLD-SERVERS.NET: type A, class IN, addr 192.48.79.30
Name: J.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.48.79.30
K.GTLD-SERVERS.NET: type A, class IN, addr 192.52.178.30
Name: K.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.52.178.30
L.GTLD-SERVERS.NET: type A, class IN, addr 192.41.162.30
Name: L.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.41.162.30
M.GTLD-SERVERS.NET: type A, class IN, addr 192.55.83.30
Name: M.GTLD-SERVERS.NET
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 192.55.83.30
A.GTLD-SERVERS.NET: type AAAA, class IN, addr 2001:503:a83e::2:30
Name: A.GTLD-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:a83e::2:30
B.GTLD-SERVERS.NET: type AAAA, class IN, addr 2001:503:231d::2:30
Name: B.GTLD-SERVERS.NET
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 16
Addr: 2001:503:231d::2:30
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 31 (105 bytes on wire, 105 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.290657000
[Time delta from previous captured frame: 0.000853000 seconds]
[Time delta from previous displayed frame: 0.000853000 seconds]
[Time since reference or first frame: 0.765257000 seconds]
Frame Number: 31
Frame Length: 105 bytes
Capture Length: 105 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.43.172.30 (192.43.172.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 91
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x0371 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.43.172.30 (192.43.172.30)
User Datagram Protocol, Src Port: 42271 (42271), Dst Port: domain (53)
Source port: 42271 (42271)
Destination port: domain (53)
Length: 71
Checksum: 0x377a [incorrect, should be 0x332b (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 32]
Transaction ID: 0x523a
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 32 (181 bytes on wire, 181 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.375139000
[Time delta from previous captured frame: 0.084482000 seconds]
[Time delta from previous displayed frame: 0.084482000 seconds]
[Time since reference or first frame: 0.849739000 seconds]
Frame Number: 32
Frame Length: 181 bytes
Capture Length: 181 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.43.172.30 (192.43.172.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 167
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 55
Protocol: UDP (0x11)
Header checksum: 0x0c25 [correct]
[Good: True]
[Bad : False]
Source: 192.43.172.30 (192.43.172.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 42271 (42271)
Source port: domain (53)
Destination port: 42271 (42271)
Length: 147
Checksum: 0xa0b8 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 31]
[Time: 0.084482000 seconds]
Transaction ID: 0x523a
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 2
Additional RRs: 3
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Authoritative nameservers
atosorigin.com: type NS, class IN, ns ns3.atos.net
Name: atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 14
Name server: ns3.atos.net
atosorigin.com: type NS, class IN, ns ns4.atos.net
Name: atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns4.atos.net
Additional records
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 33 (105 bytes on wire, 105 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.375579000
[Time delta from previous captured frame: 0.000440000 seconds]
[Time delta from previous displayed frame: 0.000440000 seconds]
[Time since reference or first frame: 0.850179000 seconds]
Frame Number: 33
Frame Length: 105 bytes
Capture Length: 105 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 91
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5658 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 160.92.121.6 (160.92.121.6)
User Datagram Protocol, Src Port: 42540 (42540), Dst Port: domain (53)
Source port: 42540 (42540)
Destination port: domain (53)
Length: 71
Checksum: 0xe492 [incorrect, should be 0xacc8 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 34]
Transaction ID: 0x2a77
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 34 (329 bytes on wire, 329 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.434086000
[Time delta from previous captured frame: 0.058507000 seconds]
[Time delta from previous displayed frame: 0.058507000 seconds]
[Time since reference or first frame: 0.908686000 seconds]
Frame Number: 34
Frame Length: 329 bytes
Capture Length: 329 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 315
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x5f78 [correct]
[Good: True]
[Bad : False]
Source: 160.92.121.6 (160.92.121.6)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 42540 (42540)
Source port: domain (53)
Destination port: 42540 (42540)
Length: 295
Checksum: 0xf951 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 33]
[Time: 0.058507000 seconds]
Transaction ID: 0x2a77
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 5
Additional RRs: 7
Queries
front.webedu.men.aw.atosorigin.com: type A, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Answers
front.webedu.men.aw.atosorigin.com: type A, class IN, addr 160.92.130.142
Name: front.webedu.men.aw.atosorigin.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 160.92.130.142
Authoritative nameservers
aw.atosorigin.com: type NS, class IN, ns ns4.atos.net
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 14
Name server: ns4.atos.net
aw.atosorigin.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 20
Name server: ns1.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns2.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns3.ext.origin-it.com
aw.atosorigin.com: type NS, class IN, ns ns3.atos.net
Name: aw.atosorigin.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 1 day
Data length: 6
Name server: ns3.atos.net
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.138
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 23 hours, 29 minutes, 16 seconds
Data length: 4
Addr: 212.159.192.138
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 23 hours, 29 minutes, 16 seconds
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 23 hours, 29 minutes, 16 seconds
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 22 hours, 55 minutes, 47 seconds
Data length: 4
Addr: 12.174.168.53
ns3.atos.net: type A, class IN, addr 160.92.121.6
Name: ns3.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 160.92.121.6
ns4.atos.net: type A, class IN, addr 193.56.46.248
Name: ns4.atos.net
Type: A (Host address)
Class: IN (0x0001)
Time to live: 1 day
Data length: 4
Addr: 193.56.46.248
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 35 (105 bytes on wire, 105 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.465084000
[Time delta from previous captured frame: 0.030998000 seconds]
[Time delta from previous displayed frame: 0.030998000 seconds]
[Time since reference or first frame: 0.939684000 seconds]
Frame Number: 35
Frame Length: 105 bytes
Capture Length: 105 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 91
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5658 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 160.92.121.6 (160.92.121.6)
User Datagram Protocol, Src Port: 56075 (56075), Dst Port: domain (53)
Source port: 56075 (56075)
Destination port: domain (53)
Length: 71
Checksum: 0xe492 [incorrect, should be 0x6b04 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 42]
Transaction ID: 0x3741
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type AAAA, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 36 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.465400000
[Time delta from previous captured frame: 0.000316000 seconds]
[Time delta from previous displayed frame: 0.000316000 seconds]
[Time since reference or first frame: 0.940000000 seconds]
Frame Number: 36
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 33435 (33435), Dst Port: domain (53)
Source port: 33435 (33435)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0xd1bc (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 45]
Transaction ID: 0x1d6f
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns1.ext.origin-it.com: type A, class IN
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 37 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.465647000
[Time delta from previous captured frame: 0.000247000 seconds]
[Time delta from previous displayed frame: 0.000247000 seconds]
[Time since reference or first frame: 0.940247000 seconds]
Frame Number: 37
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 48220 (48220), Dst Port: domain (53)
Source port: 48220 (48220)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0xc153 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 46]
Transaction ID: 0xd916
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns1.ext.origin-it.com: type AAAA, class IN
Name: ns1.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 38 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.465893000
[Time delta from previous captured frame: 0.000246000 seconds]
[Time delta from previous displayed frame: 0.000246000 seconds]
[Time since reference or first frame: 0.940493000 seconds]
Frame Number: 38
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 57398 (57398), Dst Port: domain (53)
Source port: 57398 (57398)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0x8bf7 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 48]
Transaction ID: 0x0598
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns2.ext.origin-it.com: type A, class IN
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 39 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.466136000
[Time delta from previous captured frame: 0.000243000 seconds]
[Time delta from previous displayed frame: 0.000243000 seconds]
[Time since reference or first frame: 0.940736000 seconds]
Frame Number: 39
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 49777 (49777), Dst Port: domain (53)
Source port: 49777 (49777)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0x237e (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 50]
Transaction ID: 0x70d6
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns2.ext.origin-it.com: type AAAA, class IN
Name: ns2.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 40 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.466391000
[Time delta from previous captured frame: 0.000255000 seconds]
[Time delta from previous displayed frame: 0.000255000 seconds]
[Time since reference or first frame: 0.940991000 seconds]
Frame Number: 40
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 43175 (43175), Dst Port: domain (53)
Source port: 43175 (43175)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0xc839 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 51]
Transaction ID: 0x00e4
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.ext.origin-it.com: type A, class IN
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 41 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.466641000
[Time delta from previous captured frame: 0.000250000 seconds]
[Time delta from previous displayed frame: 0.000250000 seconds]
[Time since reference or first frame: 0.941241000 seconds]
Frame Number: 41
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5f8a [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 192.31.80.30 (192.31.80.30)
User Datagram Protocol, Src Port: 35694 (35694), Dst Port: domain (53)
Source port: 35694 (35694)
Destination port: domain (53)
Length: 58
Checksum: 0xdb60 [incorrect, should be 0xe6fa (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 49]
Transaction ID: 0xe45b
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.ext.origin-it.com: type AAAA, class IN
Name: ns3.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 42 (170 bytes on wire, 170 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.523457000
[Time delta from previous captured frame: 0.056816000 seconds]
[Time delta from previous displayed frame: 0.056816000 seconds]
[Time since reference or first frame: 0.998057000 seconds]
Frame Number: 42
Frame Length: 170 bytes
Capture Length: 170 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 156
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x6017 [correct]
[Good: True]
[Bad : False]
Source: 160.92.121.6 (160.92.121.6)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 56075 (56075)
Source port: domain (53)
Destination port: 56075 (56075)
Length: 136
Checksum: 0x7d90 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 35]
[Time: 0.058373000 seconds]
Transaction ID: 0x3741
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type AAAA, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
aw.atosorigin.com: type SOA, class IN, mname ns3.atos.net
Name: aw.atosorigin.com
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 day
Data length: 53
Primary name server: ns3.atos.net
Responsible authority's mailbox: hostmaster.axime.com
Serial number: 2009012801
Refresh interval: 6 hours
Retry interval: 1 hour
Expiration limit: 30 days
Minimum TTL: 1 day
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 43 (105 bytes on wire, 105 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.536407000
[Time delta from previous captured frame: 0.012950000 seconds]
[Time delta from previous displayed frame: 0.012950000 seconds]
[Time since reference or first frame: 1.011007000 seconds]
Frame Number: 43
Frame Length: 105 bytes
Capture Length: 105 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 91
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x5658 [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 160.92.121.6 (160.92.121.6)
User Datagram Protocol, Src Port: 60212 (60212), Dst Port: domain (53)
Source port: 60212 (60212)
Destination port: domain (53)
Length: 71
Checksum: 0xe492 [incorrect, should be 0x0237 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 44]
Transaction ID: 0x8ff2
Flags: 0x0000 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type MX, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: MX (Mail exchange)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 44 (170 bytes on wire, 170 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.594895000
[Time delta from previous captured frame: 0.058488000 seconds]
[Time delta from previous displayed frame: 0.058488000 seconds]
[Time since reference or first frame: 1.069495000 seconds]
Frame Number: 44
Frame Length: 170 bytes
Capture Length: 170 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 156
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 54
Protocol: UDP (0x11)
Header checksum: 0x6017 [correct]
[Good: True]
[Bad : False]
Source: 160.92.121.6 (160.92.121.6)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 60212 (60212)
Source port: domain (53)
Destination port: 60212 (60212)
Length: 136
Checksum: 0x14c3 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 43]
[Time: 0.058488000 seconds]
Transaction ID: 0x8ff2
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
front.webedu.men.aw.atosorigin.com: type MX, class IN
Name: front.webedu.men.aw.atosorigin.com
Type: MX (Mail exchange)
Class: IN (0x0001)
Authoritative nameservers
aw.atosorigin.com: type SOA, class IN, mname ns3.atos.net
Name: aw.atosorigin.com
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 day
Data length: 53
Primary name server: ns3.atos.net
Responsible authority's mailbox: hostmaster.axime.com
Serial number: 2009012801
Refresh interval: 6 hours
Retry interval: 1 hour
Expiration limit: 30 days
Minimum TTL: 1 day
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 45 (206 bytes on wire, 206 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.621758000
[Time delta from previous captured frame: 0.026863000 seconds]
[Time delta from previous displayed frame: 0.026863000 seconds]
[Time since reference or first frame: 1.096358000 seconds]
Frame Number: 45
Frame Length: 206 bytes
Capture Length: 206 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 192
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 49
Protocol: UDP (0x11)
Header checksum: 0x6e18 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 33435 (33435)
Source port: domain (53)
Destination port: 33435 (33435)
Length: 172
Checksum: 0x6106 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 36]
[Time: 0.156358000 seconds]
Transaction ID: 0x1d6f
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 3
Additional RRs: 4
Queries
ns1.ext.origin-it.com: type A, class IN
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Answers
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 46 (190 bytes on wire, 190 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.623676000
[Time delta from previous captured frame: 0.001918000 seconds]
[Time delta from previous displayed frame: 0.001918000 seconds]
[Time since reference or first frame: 1.098276000 seconds]
Frame Number: 46
Frame Length: 190 bytes
Capture Length: 190 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 176
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 50
Protocol: UDP (0x11)
Header checksum: 0x6d28 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 48220 (48220)
Source port: domain (53)
Destination port: 48220 (48220)
Length: 156
Checksum: 0x30b6 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 37]
[Time: 0.158029000 seconds]
Transaction ID: 0xd916
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 3
Additional RRs: 4
Queries
ns1.ext.origin-it.com: type AAAA, class IN
Name: ns1.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 47 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.624105000
[Time delta from previous captured frame: 0.000429000 seconds]
[Time delta from previous displayed frame: 0.000429000 seconds]
[Time since reference or first frame: 1.098705000 seconds]
Frame Number: 47
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xdb1d [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 212.159.192.10 (212.159.192.10)
User Datagram Protocol, Src Port: 45765 (45765), Dst Port: domain (53)
Source port: 45765 (45765)
Destination port: domain (53)
Length: 58
Checksum: 0x5fcd [incorrect, should be 0xf637 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 54]
Transaction ID: 0x295d
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns1.ext.origin-it.com: type AAAA, class IN
Name: ns1.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 48 (206 bytes on wire, 206 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.626902000
[Time delta from previous captured frame: 0.002797000 seconds]
[Time delta from previous displayed frame: 0.002797000 seconds]
[Time since reference or first frame: 1.101502000 seconds]
Frame Number: 48
Frame Length: 206 bytes
Capture Length: 206 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 192
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 49
Protocol: UDP (0x11)
Header checksum: 0x6e18 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 57398 (57398)
Source port: domain (53)
Destination port: 57398 (57398)
Length: 172
Checksum: 0x4ebc [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 38]
[Time: 0.161009000 seconds]
Transaction ID: 0x0598
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 3
Additional RRs: 4
Queries
ns2.ext.origin-it.com: type A, class IN
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Answers
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 49 (190 bytes on wire, 190 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.629679000
[Time delta from previous captured frame: 0.002777000 seconds]
[Time delta from previous displayed frame: 0.002777000 seconds]
[Time since reference or first frame: 1.104279000 seconds]
Frame Number: 49
Frame Length: 190 bytes
Capture Length: 190 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 176
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 50
Protocol: UDP (0x11)
Header checksum: 0x6d28 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 35694 (35694)
Source port: domain (53)
Destination port: 35694 (35694)
Length: 156
Checksum: 0x745d [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 41]
[Time: 0.163038000 seconds]
Transaction ID: 0xe45b
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 3
Additional RRs: 4
Queries
ns3.ext.origin-it.com: type AAAA, class IN
Name: ns3.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 50 (190 bytes on wire, 190 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.629731000
[Time delta from previous captured frame: 0.000052000 seconds]
[Time delta from previous displayed frame: 0.000052000 seconds]
[Time since reference or first frame: 1.104331000 seconds]
Frame Number: 50
Frame Length: 190 bytes
Capture Length: 190 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 176
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 50
Protocol: UDP (0x11)
Header checksum: 0x6d28 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 49777 (49777)
Source port: domain (53)
Destination port: 49777 (49777)
Length: 156
Checksum: 0xa1e0 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 39]
[Time: 0.163595000 seconds]
Transaction ID: 0x70d6
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 3
Additional RRs: 4
Queries
ns2.ext.origin-it.com: type AAAA, class IN
Name: ns2.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 51 (206 bytes on wire, 206 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.629856000
[Time delta from previous captured frame: 0.000125000 seconds]
[Time delta from previous displayed frame: 0.000125000 seconds]
[Time since reference or first frame: 1.104456000 seconds]
Frame Number: 51
Frame Length: 206 bytes
Capture Length: 206 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 192
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 50
Protocol: UDP (0x11)
Header checksum: 0x6d18 [correct]
[Good: True]
[Bad : False]
Source: 192.31.80.30 (192.31.80.30)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 43175 (43175)
Source port: domain (53)
Destination port: 43175 (43175)
Length: 172
Checksum: 0x3c63 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 40]
[Time: 0.163465000 seconds]
Transaction ID: 0x00e4
Flags: 0x8000 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .0.. .... .... = Authoritative: Server is not an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 1
Authority RRs: 3
Additional RRs: 4
Queries
ns3.ext.origin-it.com: type A, class IN
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Answers
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
Authoritative nameservers
origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns1.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 6
Name server: ns2.ext.origin-it.com
origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com
Name: origin-it.com
Type: NS (Authoritative name server)
Class: IN (0x0001)
Time to live: 2 days
Data length: 2
Name server: ns3.ext.origin-it.com
Additional records
ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10
Name: ns1.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 212.159.192.10
ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38
Name: ns2.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 203.95.78.38
ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53
Name: ns3.ext.origin-it.com
Type: A (Host address)
Class: IN (0x0001)
Time to live: 2 days
Data length: 4
Addr: 12.174.168.53
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 512
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x0
Data length: 0
Frame 52 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.630186000
[Time delta from previous captured frame: 0.000330000 seconds]
[Time delta from previous displayed frame: 0.000330000 seconds]
[Time since reference or first frame: 1.104786000 seconds]
Frame Number: 52
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xdb1d [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 212.159.192.10 (212.159.192.10)
User Datagram Protocol, Src Port: 42994 (42994), Dst Port: domain (53)
Source port: 42994 (42994)
Destination port: domain (53)
Length: 58
Checksum: 0x5fcd [incorrect, should be 0x63e3 (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 55]
Transaction ID: 0xc683
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns2.ext.origin-it.com: type AAAA, class IN
Name: ns2.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 53 (92 bytes on wire, 92 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.630430000
[Time delta from previous captured frame: 0.000244000 seconds]
[Time delta from previous displayed frame: 0.000244000 seconds]
[Time since reference or first frame: 1.105030000 seconds]
Frame Number: 53
Frame Length: 92 bytes
Capture Length: 92 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: Checksum Errors]
[Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1]
Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xdb1d [correct]
[Good: True]
[Bad : False]
Source: 192.168.10.47 (192.168.10.47)
Destination: 212.159.192.10 (212.159.192.10)
User Datagram Protocol, Src Port: 49832 (49832), Dst Port: domain (53)
Source port: 49832 (49832)
Destination port: domain (53)
Length: 58
Checksum: 0x5fcd [incorrect, should be 0xd93f (maybe caused by "UDP checksum offload"?)]
[Good Checksum: False]
[Bad Checksum: True]
Domain Name System (query)
[Response In: 56]
Transaction ID: 0x3670
Flags: 0x0010 (Standard query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Standard query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... .0.. .... = Z: reserved (0)
.... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 1
Queries
ns3.ext.origin-it.com: type AAAA, class IN
Name: ns3.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 54 (155 bytes on wire, 155 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.693191000
[Time delta from previous captured frame: 0.062761000 seconds]
[Time delta from previous displayed frame: 0.062761000 seconds]
[Time since reference or first frame: 1.167791000 seconds]
Frame Number: 54
Frame Length: 155 bytes
Capture Length: 155 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 141
Identification: 0xbd19 (48409)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 242
Protocol: UDP (0x11)
Header checksum: 0x6bc4 [correct]
[Good: True]
[Bad : False]
Source: 212.159.192.10 (212.159.192.10)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 45765 (45765)
Source port: domain (53)
Destination port: 45765 (45765)
Length: 121
Checksum: 0xb8a9 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 47]
[Time: 0.069086000 seconds]
Transaction ID: 0x295d
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
ns1.ext.origin-it.com: type AAAA, class IN
Name: ns1.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com
Name: origin-it.com
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 hour
Data length: 51
Primary name server: ns1.ext.origin-it.com
Responsible authority's mailbox: hostmaster.origin-services.com
Serial number: 2005111500
Refresh interval: 3 hours
Retry interval: 1 hour
Expiration limit: 14 days
Minimum TTL: 1 hour
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 55 (159 bytes on wire, 159 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.700821000
[Time delta from previous captured frame: 0.007630000 seconds]
[Time delta from previous displayed frame: 0.007630000 seconds]
[Time since reference or first frame: 1.175421000 seconds]
Frame Number: 55
Frame Length: 159 bytes
Capture Length: 159 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 145
Identification: 0xbd1a (48410)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 242
Protocol: UDP (0x11)
Header checksum: 0x6bbf [correct]
[Good: True]
[Bad : False]
Source: 212.159.192.10 (212.159.192.10)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 42994 (42994)
Source port: domain (53)
Destination port: 42994 (42994)
Length: 125
Checksum: 0x7ed6 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 52]
[Time: 0.070635000 seconds]
Transaction ID: 0xc683
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
ns2.ext.origin-it.com: type AAAA, class IN
Name: ns2.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com
Name: origin-it.com
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 hour
Data length: 55
Primary name server: ns1.ext.origin-it.com
Responsible authority's mailbox: hostmaster.origin-services.com
Serial number: 2005111500
Refresh interval: 3 hours
Retry interval: 1 hour
Expiration limit: 14 days
Minimum TTL: 1 hour
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0
Frame 56 (159 bytes on wire, 159 bytes captured)
Arrival Time: Jan 28, 2009 15:56:18.701281000
[Time delta from previous captured frame: 0.000460000 seconds]
[Time delta from previous displayed frame: 0.000460000 seconds]
[Time since reference or first frame: 1.175881000 seconds]
Frame Number: 56
Frame Length: 159 bytes
Capture Length: 159 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:dns]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 145
Identification: 0xbd1b (48411)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 242
Protocol: UDP (0x11)
Header checksum: 0x6bbe [correct]
[Good: True]
[Bad : False]
Source: 212.159.192.10 (212.159.192.10)
Destination: 192.168.10.47 (192.168.10.47)
User Datagram Protocol, Src Port: domain (53), Dst Port: 49832 (49832)
Source port: domain (53)
Destination port: 49832 (49832)
Length: 125
Checksum: 0xf432 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Domain Name System (response)
[Request In: 53]
[Time: 0.070851000 seconds]
Transaction ID: 0x3670
Flags: 0x8400 (Standard query response, No error)
1... .... .... .... = Response: Message is a response
.000 0... .... .... = Opcode: Standard query (0)
.... .1.. .... .... = Authoritative: Server is an authority for domain
.... ..0. .... .... = Truncated: Message is not truncated
.... ...0 .... .... = Recursion desired: Don't do query recursively
.... .... 0... .... = Recursion available: Server can't do recursive queries
.... .... .0.. .... = Z: reserved (0)
.... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server
.... .... .... 0000 = Reply code: No error (0)
Questions: 1
Answer RRs: 0
Authority RRs: 1
Additional RRs: 1
Queries
ns3.ext.origin-it.com: type AAAA, class IN
Name: ns3.ext.origin-it.com
Type: AAAA (IPv6 address)
Class: IN (0x0001)
Authoritative nameservers
origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com
Name: origin-it.com
Type: SOA (Start of zone of authority)
Class: IN (0x0001)
Time to live: 1 hour
Data length: 55
Primary name server: ns1.ext.origin-it.com
Responsible authority's mailbox: hostmaster.origin-services.com
Serial number: 2005111500
Refresh interval: 3 hours
Retry interval: 1 hour
Expiration limit: 14 days
Minimum TTL: 1 hour
Additional records
<Root>: type OPT
Name: <Root>
Type: OPT (EDNS0 option)
UDP payload size: 4096
Higher bits in extended RCODE: 0x0
EDNS0 version: 0
Z: 0x8000
Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs)
Bits 1-15: 0x0 (reserved)
Data length: 0