====== Un peu d'espionnage ====== Pour les amateurs de sniff (de réseaux), voici ce que l'on peut capturer avec un wireshark lorsque notre serveur DNS récursif effectue lorsqu'il cherche à résoudre ''%%www.education.gouv.fr%%'' alors qu'il vient juste de démarrer et que son cache est vide. Je vous laisse la joie d'analyser ceci par vous-même. Vous y découvrirez la suite de questions posées aux divers serveurs non récursifs, pour obtenir la réponse finale : Frame 1 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.525400000 [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 198.41.0.4 (198.41.0.4) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa99a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 198.41.0.4 (198.41.0.4) User Datagram Protocol, Src Port: 46823 (46823), Dst Port: domain (53) Source port: 46823 (46823) Destination port: domain (53) Length: 58 Checksum: 0x9150 [incorrect, should be 0xf754 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 3] Transaction ID: 0xad84 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 2 (70 bytes on wire, 70 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.525448000 [Time delta from previous captured frame: 0.000048000 seconds] [Time delta from previous displayed frame: 0.000048000 seconds] [Time since reference or first frame: 0.000048000 seconds] Frame Number: 2 Frame Length: 70 bytes Capture Length: 70 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 198.41.0.4 (198.41.0.4) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 56 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa9b0 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 198.41.0.4 (198.41.0.4) User Datagram Protocol, Src Port: 51086 (51086), Dst Port: domain (53) Source port: 51086 (51086) Destination port: domain (53) Length: 36 Checksum: 0x913a [incorrect, should be 0x0fe8 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 5] Transaction ID: 0x03ca Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries : type NS, class IN Name: Type: NS (Authoritative name server) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 3 (440 bytes on wire, 440 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.751144000 [Time delta from previous captured frame: 0.225696000 seconds] [Time delta from previous displayed frame: 0.225696000 seconds] [Time since reference or first frame: 0.225744000 seconds] Frame Number: 3 Frame Length: 440 bytes Capture Length: 440 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 198.41.0.4 (198.41.0.4), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 426 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 52 Protocol: UDP (0x11) Header checksum: 0xb43e [correct] [Good: True] [Bad : False] Source: 198.41.0.4 (198.41.0.4) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 46823 (46823) Source port: domain (53) Destination port: 46823 (46823) Length: 406 Checksum: 0xaf9f [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 1] [Time: 0.225744000 seconds] Transaction ID: 0xad84 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 8 Additional RRs: 12 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Authoritative nameservers fr: type NS, class IN, ns G.EXT.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 12 Name server: G.EXT.NIC.fr fr: type NS, class IN, ns A.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: A.NIC.fr fr: type NS, class IN, ns F.EXT.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: F.EXT.NIC.fr fr: type NS, class IN, ns C.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: C.NIC.fr fr: type NS, class IN, ns E.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: E.NIC.fr fr: type NS, class IN, ns B.EXT.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: B.EXT.NIC.fr fr: type NS, class IN, ns D.EXT.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: D.EXT.NIC.fr fr: type NS, class IN, ns E.EXT.NIC.fr Name: fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: E.EXT.NIC.fr Additional records A.NIC.fr: type A, class IN, addr 192.93.0.129 Name: A.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.93.0.129 A.NIC.fr: type AAAA, class IN, addr 2001:660:3005:3::1:1 Name: A.NIC.fr Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:660:3005:3::1:1 B.EXT.NIC.fr: type A, class IN, addr 192.228.90.21 Name: B.EXT.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.228.90.21 C.NIC.fr: type A, class IN, addr 192.134.0.129 Name: C.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.134.0.129 C.NIC.fr: type AAAA, class IN, addr 2001:660:3006:4::1:1 Name: C.NIC.fr Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:660:3006:4::1:1 D.EXT.NIC.fr: type A, class IN, addr 204.152.184.85 Name: D.EXT.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 204.152.184.85 D.EXT.NIC.fr: type AAAA, class IN, addr 2001:4f8:0:2::8 Name: D.EXT.NIC.fr Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:4f8:0:2::8 E.EXT.NIC.fr: type A, class IN, addr 193.176.144.6 Name: E.EXT.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.176.144.6 E.NIC.fr: type A, class IN, addr 194.57.253.1 Name: E.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 194.57.253.1 F.EXT.NIC.fr: type A, class IN, addr 194.146.106.46 Name: F.EXT.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 194.146.106.46 G.EXT.NIC.fr: type A, class IN, addr 204.61.216.39 Name: G.EXT.NIC.fr Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 204.61.216.39 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 4 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.752069000 [Time delta from previous captured frame: 0.000925000 seconds] [Time delta from previous displayed frame: 0.000925000 seconds] [Time since reference or first frame: 0.226669000 seconds] Frame Number: 4 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 204.61.216.39 (204.61.216.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xcb62 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 204.61.216.39 (204.61.216.39) User Datagram Protocol, Src Port: 53923 (53923), Dst Port: domain (53) Source port: 53923 (53923) Destination port: domain (53) Length: 58 Checksum: 0x6f88 [incorrect, should be 0xc0ee (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 6] Transaction ID: 0xe9f6 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 5 (685 bytes on wire, 685 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.752266000 [Time delta from previous captured frame: 0.000197000 seconds] [Time delta from previous displayed frame: 0.000197000 seconds] [Time since reference or first frame: 0.226866000 seconds] Frame Number: 5 Frame Length: 685 bytes Capture Length: 685 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 198.41.0.4 (198.41.0.4), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 671 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 52 Protocol: UDP (0x11) Header checksum: 0xb349 [correct] [Good: True] [Bad : False] Source: 198.41.0.4 (198.41.0.4) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 51086 (51086) Source port: domain (53) Destination port: 51086 (51086) Length: 651 Checksum: 0x4d70 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 2] [Time: 0.226818000 seconds] Transaction ID: 0x03ca Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 13 Authority RRs: 0 Additional RRs: 21 Queries : type NS, class IN Name: Type: NS (Authoritative name server) Class: IN (0x0001) Answers : type NS, class IN, ns A.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 20 Name server: A.ROOT-SERVERS.NET : type NS, class IN, ns D.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: D.ROOT-SERVERS.NET : type NS, class IN, ns B.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: B.ROOT-SERVERS.NET : type NS, class IN, ns H.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: H.ROOT-SERVERS.NET : type NS, class IN, ns G.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: G.ROOT-SERVERS.NET : type NS, class IN, ns E.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: E.ROOT-SERVERS.NET : type NS, class IN, ns C.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: C.ROOT-SERVERS.NET : type NS, class IN, ns M.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: M.ROOT-SERVERS.NET : type NS, class IN, ns J.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: J.ROOT-SERVERS.NET : type NS, class IN, ns F.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: F.ROOT-SERVERS.NET : type NS, class IN, ns L.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: L.ROOT-SERVERS.NET : type NS, class IN, ns I.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: I.ROOT-SERVERS.NET : type NS, class IN, ns K.ROOT-SERVERS.NET Name: Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 6 days Data length: 4 Name server: K.ROOT-SERVERS.NET Additional records A.ROOT-SERVERS.NET: type A, class IN, addr 198.41.0.4 Name: A.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 198.41.0.4 A.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:503:ba3e::2:30 Name: A.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:503:ba3e::2:30 B.ROOT-SERVERS.NET: type A, class IN, addr 192.228.79.201 Name: B.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.228.79.201 C.ROOT-SERVERS.NET: type A, class IN, addr 192.33.4.12 Name: C.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.33.4.12 D.ROOT-SERVERS.NET: type A, class IN, addr 128.8.10.90 Name: D.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 128.8.10.90 E.ROOT-SERVERS.NET: type A, class IN, addr 192.203.230.10 Name: E.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.203.230.10 F.ROOT-SERVERS.NET: type A, class IN, addr 192.5.5.241 Name: F.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.5.5.241 F.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:2f::f Name: F.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:500:2f::f G.ROOT-SERVERS.NET: type A, class IN, addr 192.112.36.4 Name: G.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.112.36.4 H.ROOT-SERVERS.NET: type A, class IN, addr 128.63.2.53 Name: H.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 128.63.2.53 H.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:1::803f:235 Name: H.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:500:1::803f:235 I.ROOT-SERVERS.NET: type A, class IN, addr 192.36.148.17 Name: I.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.36.148.17 J.ROOT-SERVERS.NET: type A, class IN, addr 192.58.128.30 Name: J.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 192.58.128.30 J.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:503:c27::2:30 Name: J.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:503:c27::2:30 K.ROOT-SERVERS.NET: type A, class IN, addr 193.0.14.129 Name: K.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 193.0.14.129 K.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:7fd::1 Name: K.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:7fd::1 L.ROOT-SERVERS.NET: type A, class IN, addr 199.7.83.42 Name: L.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 199.7.83.42 L.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:500:3::42 Name: L.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:500:3::42 M.ROOT-SERVERS.NET: type A, class IN, addr 202.12.27.33 Name: M.ROOT-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 4 Addr: 202.12.27.33 M.ROOT-SERVERS.NET: type AAAA, class IN, addr 2001:dc3::35 Name: M.ROOT-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 41 days, 16 hours Data length: 16 Addr: 2001:dc3::35 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 6 (136 bytes on wire, 136 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.817813000 [Time delta from previous captured frame: 0.065547000 seconds] [Time delta from previous displayed frame: 0.065547000 seconds] [Time since reference or first frame: 0.292413000 seconds] Frame Number: 6 Frame Length: 136 bytes Capture Length: 136 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 204.61.216.39 (204.61.216.39), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 122 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 55 Protocol: UDP (0x11) Header checksum: 0xd436 [correct] [Good: True] [Bad : False] Source: 204.61.216.39 (204.61.216.39) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 53923 (53923) Source port: domain (53) Destination port: 53923 (53923) Length: 102 Checksum: 0x4a52 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 4] [Time: 0.065744000 seconds] Transaction ID: 0xe9f6 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 2 Additional RRs: 1 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Authoritative nameservers education.gouv.fr: type NS, class IN, ns ns3.atos.net Name: education.gouv.fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 14 Name server: ns3.atos.net education.gouv.fr: type NS, class IN, ns ns4.atos.net Name: education.gouv.fr Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns4.atos.net Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 7 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.819229000 [Time delta from previous captured frame: 0.001416000 seconds] [Time delta from previous displayed frame: 0.001416000 seconds] [Time since reference or first frame: 0.293829000 seconds] Frame Number: 7 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xed5c [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 128.63.2.53 (128.63.2.53) User Datagram Protocol, Src Port: 33601 (33601), Dst Port: domain (53) Source port: 33601 (33601) Destination port: domain (53) Length: 49 Checksum: 0x4d8e [incorrect, should be 0x25f0 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 11] Transaction ID: 0x9a5a Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.atos.net: type A, class IN Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 8 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.819423000 [Time delta from previous captured frame: 0.000194000 seconds] [Time delta from previous displayed frame: 0.000194000 seconds] [Time since reference or first frame: 0.294023000 seconds] Frame Number: 8 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xed5c [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 128.63.2.53 (128.63.2.53) User Datagram Protocol, Src Port: 44176 (44176), Dst Port: domain (53) Source port: 44176 (44176) Destination port: domain (53) Length: 49 Checksum: 0x4d8e [incorrect, should be 0x4a98 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 13] Transaction ID: 0x4c48 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 9 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.819623000 [Time delta from previous captured frame: 0.000200000 seconds] [Time delta from previous displayed frame: 0.000200000 seconds] [Time since reference or first frame: 0.294223000 seconds] Frame Number: 9 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xed5c [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 128.63.2.53 (128.63.2.53) User Datagram Protocol, Src Port: 53775 (53775), Dst Port: domain (53) Source port: 53775 (53775) Destination port: domain (53) Length: 49 Checksum: 0x4d8e [incorrect, should be 0xef3a (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 15] Transaction ID: 0x8240 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns4.atos.net: type A, class IN Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 10 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.820219000 [Time delta from previous captured frame: 0.000596000 seconds] [Time delta from previous displayed frame: 0.000596000 seconds] [Time since reference or first frame: 0.294819000 seconds] Frame Number: 10 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 128.63.2.53 (128.63.2.53) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xed5c [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 128.63.2.53 (128.63.2.53) User Datagram Protocol, Src Port: 55181 (55181), Dst Port: domain (53) Source port: 55181 (55181) Destination port: domain (53) Length: 49 Checksum: 0x4d8e [incorrect, should be 0xa621 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 17] Transaction ID: 0xc5c0 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 11 (568 bytes on wire, 568 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.965519000 [Time delta from previous captured frame: 0.145300000 seconds] [Time delta from previous displayed frame: 0.145300000 seconds] [Time since reference or first frame: 0.440119000 seconds] Frame Number: 11 Frame Length: 568 bytes Capture Length: 568 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 554 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 44 Protocol: UDP (0x11) Header checksum: 0xff77 [correct] [Good: True] [Bad : False] Source: 128.63.2.53 (128.63.2.53) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 33601 (33601) Source port: domain (53) Destination port: 33601 (33601) Length: 534 Checksum: 0x0ebc [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 7] [Time: 0.146290000 seconds] Transaction ID: 0x9a5a Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 13 Additional RRs: 16 Queries ns3.atos.net: type A, class IN Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Authoritative nameservers net: type NS, class IN, ns a.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 17 Name server: a.gtld-servers.net net: type NS, class IN, ns b.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: b.gtld-servers.net net: type NS, class IN, ns c.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: c.gtld-servers.net net: type NS, class IN, ns d.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: d.gtld-servers.net net: type NS, class IN, ns e.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: e.gtld-servers.net net: type NS, class IN, ns f.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: f.gtld-servers.net net: type NS, class IN, ns g.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: g.gtld-servers.net net: type NS, class IN, ns h.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: h.gtld-servers.net net: type NS, class IN, ns i.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: i.gtld-servers.net net: type NS, class IN, ns j.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: j.gtld-servers.net net: type NS, class IN, ns k.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: k.gtld-servers.net net: type NS, class IN, ns l.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: l.gtld-servers.net net: type NS, class IN, ns m.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: m.gtld-servers.net Additional records a.gtld-servers.net: type A, class IN, addr 192.5.6.30 Name: a.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.5.6.30 b.gtld-servers.net: type A, class IN, addr 192.33.14.30 Name: b.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.33.14.30 c.gtld-servers.net: type A, class IN, addr 192.26.92.30 Name: c.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.26.92.30 d.gtld-servers.net: type A, class IN, addr 192.31.80.30 Name: d.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.31.80.30 e.gtld-servers.net: type A, class IN, addr 192.12.94.30 Name: e.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.12.94.30 f.gtld-servers.net: type A, class IN, addr 192.35.51.30 Name: f.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.35.51.30 g.gtld-servers.net: type A, class IN, addr 192.42.93.30 Name: g.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.42.93.30 h.gtld-servers.net: type A, class IN, addr 192.54.112.30 Name: h.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.54.112.30 i.gtld-servers.net: type A, class IN, addr 192.43.172.30 Name: i.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.43.172.30 j.gtld-servers.net: type A, class IN, addr 192.48.79.30 Name: j.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.48.79.30 k.gtld-servers.net: type A, class IN, addr 192.52.178.30 Name: k.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.52.178.30 l.gtld-servers.net: type A, class IN, addr 192.41.162.30 Name: l.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.41.162.30 m.gtld-servers.net: type A, class IN, addr 192.55.83.30 Name: m.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.55.83.30 a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30 Name: a.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:a83e::2:30 b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30 Name: b.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:231d::2:30 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 12 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.966490000 [Time delta from previous captured frame: 0.000971000 seconds] [Time delta from previous displayed frame: 0.000971000 seconds] [Time since reference or first frame: 0.441090000 seconds] Frame Number: 12 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa191 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.33.14.30 (192.33.14.30) User Datagram Protocol, Src Port: 59259 (59259), Dst Port: domain (53) Source port: 59259 (59259) Destination port: domain (53) Length: 49 Checksum: 0x9959 [incorrect, should be 0x2d83 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 19] Transaction ID: 0xe2c1 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.atos.net: type A, class IN Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 13 (568 bytes on wire, 568 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.966808000 [Time delta from previous captured frame: 0.000318000 seconds] [Time delta from previous displayed frame: 0.000318000 seconds] [Time since reference or first frame: 0.441408000 seconds] Frame Number: 13 Frame Length: 568 bytes Capture Length: 568 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 554 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 44 Protocol: UDP (0x11) Header checksum: 0xff77 [correct] [Good: True] [Bad : False] Source: 128.63.2.53 (128.63.2.53) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 44176 (44176) Source port: domain (53) Destination port: 44176 (44176) Length: 534 Checksum: 0x3364 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 8] [Time: 0.147385000 seconds] Transaction ID: 0x4c48 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 13 Additional RRs: 16 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers net: type NS, class IN, ns a.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 17 Name server: a.gtld-servers.net net: type NS, class IN, ns b.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: b.gtld-servers.net net: type NS, class IN, ns c.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: c.gtld-servers.net net: type NS, class IN, ns d.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: d.gtld-servers.net net: type NS, class IN, ns e.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: e.gtld-servers.net net: type NS, class IN, ns f.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: f.gtld-servers.net net: type NS, class IN, ns g.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: g.gtld-servers.net net: type NS, class IN, ns h.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: h.gtld-servers.net net: type NS, class IN, ns i.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: i.gtld-servers.net net: type NS, class IN, ns j.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: j.gtld-servers.net net: type NS, class IN, ns k.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: k.gtld-servers.net net: type NS, class IN, ns l.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: l.gtld-servers.net net: type NS, class IN, ns m.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: m.gtld-servers.net Additional records a.gtld-servers.net: type A, class IN, addr 192.5.6.30 Name: a.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.5.6.30 b.gtld-servers.net: type A, class IN, addr 192.33.14.30 Name: b.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.33.14.30 c.gtld-servers.net: type A, class IN, addr 192.26.92.30 Name: c.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.26.92.30 d.gtld-servers.net: type A, class IN, addr 192.31.80.30 Name: d.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.31.80.30 e.gtld-servers.net: type A, class IN, addr 192.12.94.30 Name: e.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.12.94.30 f.gtld-servers.net: type A, class IN, addr 192.35.51.30 Name: f.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.35.51.30 g.gtld-servers.net: type A, class IN, addr 192.42.93.30 Name: g.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.42.93.30 h.gtld-servers.net: type A, class IN, addr 192.54.112.30 Name: h.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.54.112.30 i.gtld-servers.net: type A, class IN, addr 192.43.172.30 Name: i.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.43.172.30 j.gtld-servers.net: type A, class IN, addr 192.48.79.30 Name: j.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.48.79.30 k.gtld-servers.net: type A, class IN, addr 192.52.178.30 Name: k.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.52.178.30 l.gtld-servers.net: type A, class IN, addr 192.41.162.30 Name: l.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.41.162.30 m.gtld-servers.net: type A, class IN, addr 192.55.83.30 Name: m.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.55.83.30 a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30 Name: a.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:a83e::2:30 b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30 Name: b.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:231d::2:30 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 14 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.967319000 [Time delta from previous captured frame: 0.000511000 seconds] [Time delta from previous displayed frame: 0.000511000 seconds] [Time since reference or first frame: 0.441919000 seconds] Frame Number: 14 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa191 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.33.14.30 (192.33.14.30) User Datagram Protocol, Src Port: 37934 (37934), Dst Port: domain (53) Source port: 37934 (37934) Destination port: domain (53) Length: 49 Checksum: 0x9959 [incorrect, should be 0x1960 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 20] Transaction ID: 0x4a17 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 15 (568 bytes on wire, 568 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.968223000 [Time delta from previous captured frame: 0.000904000 seconds] [Time delta from previous displayed frame: 0.000904000 seconds] [Time since reference or first frame: 0.442823000 seconds] Frame Number: 15 Frame Length: 568 bytes Capture Length: 568 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 554 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 44 Protocol: UDP (0x11) Header checksum: 0xff77 [correct] [Good: True] [Bad : False] Source: 128.63.2.53 (128.63.2.53) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 53775 (53775) Source port: domain (53) Destination port: 53775 (53775) Length: 534 Checksum: 0xd806 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 9] [Time: 0.148600000 seconds] Transaction ID: 0x8240 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 13 Additional RRs: 16 Queries ns4.atos.net: type A, class IN Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Authoritative nameservers net: type NS, class IN, ns a.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 17 Name server: a.gtld-servers.net net: type NS, class IN, ns b.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: b.gtld-servers.net net: type NS, class IN, ns c.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: c.gtld-servers.net net: type NS, class IN, ns d.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: d.gtld-servers.net net: type NS, class IN, ns e.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: e.gtld-servers.net net: type NS, class IN, ns f.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: f.gtld-servers.net net: type NS, class IN, ns g.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: g.gtld-servers.net net: type NS, class IN, ns h.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: h.gtld-servers.net net: type NS, class IN, ns i.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: i.gtld-servers.net net: type NS, class IN, ns j.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: j.gtld-servers.net net: type NS, class IN, ns k.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: k.gtld-servers.net net: type NS, class IN, ns l.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: l.gtld-servers.net net: type NS, class IN, ns m.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: m.gtld-servers.net Additional records a.gtld-servers.net: type A, class IN, addr 192.5.6.30 Name: a.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.5.6.30 b.gtld-servers.net: type A, class IN, addr 192.33.14.30 Name: b.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.33.14.30 c.gtld-servers.net: type A, class IN, addr 192.26.92.30 Name: c.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.26.92.30 d.gtld-servers.net: type A, class IN, addr 192.31.80.30 Name: d.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.31.80.30 e.gtld-servers.net: type A, class IN, addr 192.12.94.30 Name: e.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.12.94.30 f.gtld-servers.net: type A, class IN, addr 192.35.51.30 Name: f.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.35.51.30 g.gtld-servers.net: type A, class IN, addr 192.42.93.30 Name: g.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.42.93.30 h.gtld-servers.net: type A, class IN, addr 192.54.112.30 Name: h.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.54.112.30 i.gtld-servers.net: type A, class IN, addr 192.43.172.30 Name: i.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.43.172.30 j.gtld-servers.net: type A, class IN, addr 192.48.79.30 Name: j.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.48.79.30 k.gtld-servers.net: type A, class IN, addr 192.52.178.30 Name: k.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.52.178.30 l.gtld-servers.net: type A, class IN, addr 192.41.162.30 Name: l.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.41.162.30 m.gtld-servers.net: type A, class IN, addr 192.55.83.30 Name: m.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.55.83.30 a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30 Name: a.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:a83e::2:30 b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30 Name: b.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:231d::2:30 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 16 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.968724000 [Time delta from previous captured frame: 0.000501000 seconds] [Time delta from previous displayed frame: 0.000501000 seconds] [Time since reference or first frame: 0.443324000 seconds] Frame Number: 16 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa191 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.33.14.30 (192.33.14.30) User Datagram Protocol, Src Port: 57419 (57419), Dst Port: domain (53) Source port: 57419 (57419) Destination port: domain (53) Length: 49 Checksum: 0x9959 [incorrect, should be 0x33f4 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 21] Transaction ID: 0xe37f Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns4.atos.net: type A, class IN Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 17 (568 bytes on wire, 568 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.969408000 [Time delta from previous captured frame: 0.000684000 seconds] [Time delta from previous displayed frame: 0.000684000 seconds] [Time since reference or first frame: 0.444008000 seconds] Frame Number: 17 Frame Length: 568 bytes Capture Length: 568 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 128.63.2.53 (128.63.2.53), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 554 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 44 Protocol: UDP (0x11) Header checksum: 0xff77 [correct] [Good: True] [Bad : False] Source: 128.63.2.53 (128.63.2.53) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 55181 (55181) Source port: domain (53) Destination port: 55181 (55181) Length: 534 Checksum: 0x8eed [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 10] [Time: 0.149189000 seconds] Transaction ID: 0xc5c0 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 13 Additional RRs: 16 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers net: type NS, class IN, ns a.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 17 Name server: a.gtld-servers.net net: type NS, class IN, ns b.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: b.gtld-servers.net net: type NS, class IN, ns c.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: c.gtld-servers.net net: type NS, class IN, ns d.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: d.gtld-servers.net net: type NS, class IN, ns e.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: e.gtld-servers.net net: type NS, class IN, ns f.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: f.gtld-servers.net net: type NS, class IN, ns g.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: g.gtld-servers.net net: type NS, class IN, ns h.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: h.gtld-servers.net net: type NS, class IN, ns i.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: i.gtld-servers.net net: type NS, class IN, ns j.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: j.gtld-servers.net net: type NS, class IN, ns k.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: k.gtld-servers.net net: type NS, class IN, ns l.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: l.gtld-servers.net net: type NS, class IN, ns m.gtld-servers.net Name: net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: m.gtld-servers.net Additional records a.gtld-servers.net: type A, class IN, addr 192.5.6.30 Name: a.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.5.6.30 b.gtld-servers.net: type A, class IN, addr 192.33.14.30 Name: b.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.33.14.30 c.gtld-servers.net: type A, class IN, addr 192.26.92.30 Name: c.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.26.92.30 d.gtld-servers.net: type A, class IN, addr 192.31.80.30 Name: d.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.31.80.30 e.gtld-servers.net: type A, class IN, addr 192.12.94.30 Name: e.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.12.94.30 f.gtld-servers.net: type A, class IN, addr 192.35.51.30 Name: f.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.35.51.30 g.gtld-servers.net: type A, class IN, addr 192.42.93.30 Name: g.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.42.93.30 h.gtld-servers.net: type A, class IN, addr 192.54.112.30 Name: h.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.54.112.30 i.gtld-servers.net: type A, class IN, addr 192.43.172.30 Name: i.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.43.172.30 j.gtld-servers.net: type A, class IN, addr 192.48.79.30 Name: j.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.48.79.30 k.gtld-servers.net: type A, class IN, addr 192.52.178.30 Name: k.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.52.178.30 l.gtld-servers.net: type A, class IN, addr 192.41.162.30 Name: l.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.41.162.30 m.gtld-servers.net: type A, class IN, addr 192.55.83.30 Name: m.gtld-servers.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.55.83.30 a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30 Name: a.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:a83e::2:30 b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30 Name: b.gtld-servers.net Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:231d::2:30 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 18 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:17.969968000 [Time delta from previous captured frame: 0.000560000 seconds] [Time delta from previous displayed frame: 0.000560000 seconds] [Time since reference or first frame: 0.444568000 seconds] Frame Number: 18 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.33.14.30 (192.33.14.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xa191 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.33.14.30 (192.33.14.30) User Datagram Protocol, Src Port: 49346 (49346), Dst Port: domain (53) Source port: 49346 (49346) Destination port: domain (53) Length: 49 Checksum: 0x9959 [incorrect, should be 0x8338 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 24] Transaction ID: 0xb3a9 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 19 (163 bytes on wire, 163 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.052941000 [Time delta from previous captured frame: 0.082973000 seconds] [Time delta from previous displayed frame: 0.082973000 seconds] [Time since reference or first frame: 0.527541000 seconds] Frame Number: 19 Frame Length: 163 bytes Capture Length: 163 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 149 Identification: 0x012e (302) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: UDP (0x11) Header checksum: 0xab13 [correct] [Good: True] [Bad : False] Source: 192.33.14.30 (192.33.14.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 59259 (59259) Source port: domain (53) Destination port: 59259 (59259) Length: 129 Checksum: 0xa413 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 12] [Time: 0.086451000 seconds] Transaction ID: 0xe2c1 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 2 Additional RRs: 3 Queries ns3.atos.net: type A, class IN Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Answers ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 Authoritative nameservers atos.net: type NS, class IN, ns ns3.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns3.atos.net atos.net: type NS, class IN, ns ns4.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns4.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 20 (147 bytes on wire, 147 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.052991000 [Time delta from previous captured frame: 0.000050000 seconds] [Time delta from previous displayed frame: 0.000050000 seconds] [Time since reference or first frame: 0.527591000 seconds] Frame Number: 20 Frame Length: 147 bytes Capture Length: 147 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 133 Identification: 0x0130 (304) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: UDP (0x11) Header checksum: 0xab21 [correct] [Good: True] [Bad : False] Source: 192.33.14.30 (192.33.14.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 37934 (37934) Source port: domain (53) Destination port: 37934 (37934) Length: 113 Checksum: 0x0c9a [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 14] [Time: 0.085672000 seconds] Transaction ID: 0x4a17 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 2 Additional RRs: 3 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers atos.net: type NS, class IN, ns ns3.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns3.atos.net atos.net: type NS, class IN, ns ns4.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns4.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 21 (163 bytes on wire, 163 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.054794000 [Time delta from previous captured frame: 0.001803000 seconds] [Time delta from previous displayed frame: 0.001803000 seconds] [Time since reference or first frame: 0.529394000 seconds] Frame Number: 21 Frame Length: 163 bytes Capture Length: 163 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 149 Identification: 0x0134 (308) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: UDP (0x11) Header checksum: 0xab0d [correct] [Good: True] [Bad : False] Source: 192.33.14.30 (192.33.14.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 57419 (57419) Source port: domain (53) Destination port: 57419 (57419) Length: 129 Checksum: 0xd3c5 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 16] [Time: 0.086070000 seconds] Transaction ID: 0xe37f Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 2 Additional RRs: 3 Queries ns4.atos.net: type A, class IN Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Answers ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 Authoritative nameservers atos.net: type NS, class IN, ns ns3.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.atos.net atos.net: type NS, class IN, ns ns4.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns4.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 22 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.054973000 [Time delta from previous captured frame: 0.000179000 seconds] [Time delta from previous displayed frame: 0.000179000 seconds] [Time since reference or first frame: 0.529573000 seconds] Frame Number: 22 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x7fa0 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 193.56.46.248 (193.56.46.248) User Datagram Protocol, Src Port: 41923 (41923), Dst Port: domain (53) Source port: 41923 (41923) Destination port: domain (53) Length: 49 Checksum: 0xbb4a [incorrect, should be 0x803e (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 26] Transaction ID: 0xb1b2 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 23 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.055249000 [Time delta from previous captured frame: 0.000276000 seconds] [Time delta from previous displayed frame: 0.000276000 seconds] [Time since reference or first frame: 0.529849000 seconds] Frame Number: 23 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x7f97 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 193.56.46.248 (193.56.46.248) User Datagram Protocol, Src Port: 36866 (36866), Dst Port: domain (53) Source port: 36866 (36866) Destination port: domain (53) Length: 58 Checksum: 0xbb53 [incorrect, should be 0x8575 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 27] Transaction ID: 0x1c46 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 24 (147 bytes on wire, 147 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.055585000 [Time delta from previous captured frame: 0.000336000 seconds] [Time delta from previous displayed frame: 0.000336000 seconds] [Time since reference or first frame: 0.530185000 seconds] Frame Number: 24 Frame Length: 147 bytes Capture Length: 147 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.33.14.30 (192.33.14.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 133 Identification: 0x0138 (312) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: UDP (0x11) Header checksum: 0xab19 [correct] [Good: True] [Bad : False] Source: 192.33.14.30 (192.33.14.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 49346 (49346) Source port: domain (53) Destination port: 49346 (49346) Length: 113 Checksum: 0x7681 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 18] [Time: 0.085617000 seconds] Transaction ID: 0xb3a9 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 2 Additional RRs: 3 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers atos.net: type NS, class IN, ns ns3.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.atos.net atos.net: type NS, class IN, ns ns4.atos.net Name: atos.net Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns4.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 25 (83 bytes on wire, 83 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.055900000 [Time delta from previous captured frame: 0.000315000 seconds] [Time delta from previous displayed frame: 0.000315000 seconds] [Time since reference or first frame: 0.530500000 seconds] Frame Number: 25 Frame Length: 83 bytes Capture Length: 83 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 193.56.46.248 (193.56.46.248) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 69 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x7fa0 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 193.56.46.248 (193.56.46.248) User Datagram Protocol, Src Port: 34065 (34065), Dst Port: domain (53) Source port: 34065 (34065) Destination port: domain (53) Length: 49 Checksum: 0xbb4a [incorrect, should be 0xb376 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 29] Transaction ID: 0x9d2b Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 26 (139 bytes on wire, 139 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.113489000 [Time delta from previous captured frame: 0.057589000 seconds] [Time delta from previous displayed frame: 0.057589000 seconds] [Time since reference or first frame: 0.588089000 seconds] Frame Number: 26 Frame Length: 139 bytes Capture Length: 139 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 125 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x8968 [correct] [Good: True] [Bad : False] Source: 193.56.46.248 (193.56.46.248) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 41923 (41923) Source port: domain (53) Destination port: 41923 (41923) Length: 105 Checksum: 0x4966 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 22] [Time: 0.058516000 seconds] Transaction ID: 0xb1b2 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries ns3.atos.net: type AAAA, class IN Name: ns3.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers atos.net: type SOA, class IN, mname ns3.atos.net Name: atos.net Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 day Data length: 44 Primary name server: ns3.atos.net Responsible authority's mailbox: hostmaster.axime.com Serial number: 2007101801 Refresh interval: 6 hours Retry interval: 1 hour Expiration limit: 30 days Minimum TTL: 1 day Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 27 (300 bytes on wire, 300 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.114211000 [Time delta from previous captured frame: 0.000722000 seconds] [Time delta from previous displayed frame: 0.000722000 seconds] [Time since reference or first frame: 0.588811000 seconds] Frame Number: 27 Frame Length: 300 bytes Capture Length: 300 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 286 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x88c7 [correct] [Good: True] [Bad : False] Source: 193.56.46.248 (193.56.46.248) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 36866 (36866) Source port: domain (53) Destination port: 36866 (36866) Length: 266 Checksum: 0x0e76 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 23] [Time: 0.058962000 seconds] Transaction ID: 0x1c46 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 2 Authority RRs: 5 Additional RRs: 3 Queries www.education.gouv.fr: type A, class IN Name: www.education.gouv.fr Type: A (Host address) Class: IN (0x0001) Answers www.education.gouv.fr: type CNAME, class IN, cname front.webedu.men.aw.atosorigin.com Name: www.education.gouv.fr Type: CNAME (Canonical name for an alias) Class: IN (0x0001) Time to live: 1 hour Data length: 36 Primary name: front.webedu.men.aw.atosorigin.com front.webedu.men.aw.atosorigin.com: type A, class IN, addr 160.92.130.142 Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 160.92.130.142 Authoritative nameservers aw.atosorigin.com: type NS, class IN, ns ns4.atos.net Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 14 Name server: ns4.atos.net aw.atosorigin.com: type NS, class IN, ns ns1.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 20 Name server: ns1.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns2.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns2.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns3.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns3.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns3.atos.net Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns3.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 28 (105 bytes on wire, 105 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.114788000 [Time delta from previous captured frame: 0.000577000 seconds] [Time delta from previous displayed frame: 0.000577000 seconds] [Time since reference or first frame: 0.589388000 seconds] Frame Number: 28 Frame Length: 105 bytes Capture Length: 105 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.112.36.4 (192.112.36.4) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x8b46 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.112.36.4 (192.112.36.4) User Datagram Protocol, Src Port: 49484 (49484), Dst Port: domain (53) Source port: 49484 (49484) Destination port: domain (53) Length: 71 Checksum: 0xafa4 [incorrect, should be 0x73a4 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 30] Transaction ID: 0x7d69 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 29 (143 bytes on wire, 143 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.116129000 [Time delta from previous captured frame: 0.001341000 seconds] [Time delta from previous displayed frame: 0.001341000 seconds] [Time since reference or first frame: 0.590729000 seconds] Frame Number: 29 Frame Length: 143 bytes Capture Length: 143 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 193.56.46.248 (193.56.46.248), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 129 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x8964 [correct] [Good: True] [Bad : False] Source: 193.56.46.248 (193.56.46.248) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 34065 (34065) Source port: domain (53) Destination port: 34065 (34065) Length: 109 Checksum: 0x05ed [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 25] [Time: 0.060229000 seconds] Transaction ID: 0x9d2b Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries ns4.atos.net: type AAAA, class IN Name: ns4.atos.net Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers atos.net: type SOA, class IN, mname ns3.atos.net Name: atos.net Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 day Data length: 48 Primary name server: ns3.atos.net Responsible authority's mailbox: hostmaster.axime.com Serial number: 2007101801 Refresh interval: 6 hours Retry interval: 1 hour Expiration limit: 30 days Minimum TTL: 1 day Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 30 (593 bytes on wire, 593 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.289804000 [Time delta from previous captured frame: 0.173675000 seconds] [Time delta from previous displayed frame: 0.173675000 seconds] [Time since reference or first frame: 0.764404000 seconds] Frame Number: 30 Frame Length: 593 bytes Capture Length: 593 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.112.36.4 (192.112.36.4), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 579 Identification: 0xb4bf (46271) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 235 Protocol: UDP (0x11) Header checksum: 0x299e [correct] [Good: True] [Bad : False] Source: 192.112.36.4 (192.112.36.4) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 49484 (49484) Source port: domain (53) Destination port: 49484 (49484) Length: 559 Checksum: 0xdbd9 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 28] [Time: 0.175016000 seconds] Transaction ID: 0x7d69 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 13 Additional RRs: 16 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Authoritative nameservers com: type NS, class IN, ns C.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 20 Name server: C.GTLD-SERVERS.NET com: type NS, class IN, ns B.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: B.GTLD-SERVERS.NET com: type NS, class IN, ns F.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: F.GTLD-SERVERS.NET com: type NS, class IN, ns I.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: I.GTLD-SERVERS.NET com: type NS, class IN, ns D.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: D.GTLD-SERVERS.NET com: type NS, class IN, ns K.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: K.GTLD-SERVERS.NET com: type NS, class IN, ns H.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: H.GTLD-SERVERS.NET com: type NS, class IN, ns L.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: L.GTLD-SERVERS.NET com: type NS, class IN, ns J.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: J.GTLD-SERVERS.NET com: type NS, class IN, ns G.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: G.GTLD-SERVERS.NET com: type NS, class IN, ns E.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: E.GTLD-SERVERS.NET com: type NS, class IN, ns M.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: M.GTLD-SERVERS.NET com: type NS, class IN, ns A.GTLD-SERVERS.NET Name: com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 4 Name server: A.GTLD-SERVERS.NET Additional records A.GTLD-SERVERS.NET: type A, class IN, addr 192.5.6.30 Name: A.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.5.6.30 B.GTLD-SERVERS.NET: type A, class IN, addr 192.33.14.30 Name: B.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.33.14.30 C.GTLD-SERVERS.NET: type A, class IN, addr 192.26.92.30 Name: C.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.26.92.30 D.GTLD-SERVERS.NET: type A, class IN, addr 192.31.80.30 Name: D.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.31.80.30 E.GTLD-SERVERS.NET: type A, class IN, addr 192.12.94.30 Name: E.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.12.94.30 F.GTLD-SERVERS.NET: type A, class IN, addr 192.35.51.30 Name: F.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.35.51.30 G.GTLD-SERVERS.NET: type A, class IN, addr 192.42.93.30 Name: G.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.42.93.30 H.GTLD-SERVERS.NET: type A, class IN, addr 192.54.112.30 Name: H.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.54.112.30 I.GTLD-SERVERS.NET: type A, class IN, addr 192.43.172.30 Name: I.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.43.172.30 J.GTLD-SERVERS.NET: type A, class IN, addr 192.48.79.30 Name: J.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.48.79.30 K.GTLD-SERVERS.NET: type A, class IN, addr 192.52.178.30 Name: K.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.52.178.30 L.GTLD-SERVERS.NET: type A, class IN, addr 192.41.162.30 Name: L.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.41.162.30 M.GTLD-SERVERS.NET: type A, class IN, addr 192.55.83.30 Name: M.GTLD-SERVERS.NET Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 192.55.83.30 A.GTLD-SERVERS.NET: type AAAA, class IN, addr 2001:503:a83e::2:30 Name: A.GTLD-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:a83e::2:30 B.GTLD-SERVERS.NET: type AAAA, class IN, addr 2001:503:231d::2:30 Name: B.GTLD-SERVERS.NET Type: AAAA (IPv6 address) Class: IN (0x0001) Time to live: 2 days Data length: 16 Addr: 2001:503:231d::2:30 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 31 (105 bytes on wire, 105 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.290657000 [Time delta from previous captured frame: 0.000853000 seconds] [Time delta from previous displayed frame: 0.000853000 seconds] [Time since reference or first frame: 0.765257000 seconds] Frame Number: 31 Frame Length: 105 bytes Capture Length: 105 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.43.172.30 (192.43.172.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x0371 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.43.172.30 (192.43.172.30) User Datagram Protocol, Src Port: 42271 (42271), Dst Port: domain (53) Source port: 42271 (42271) Destination port: domain (53) Length: 71 Checksum: 0x377a [incorrect, should be 0x332b (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 32] Transaction ID: 0x523a Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 32 (181 bytes on wire, 181 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.375139000 [Time delta from previous captured frame: 0.084482000 seconds] [Time delta from previous displayed frame: 0.084482000 seconds] [Time since reference or first frame: 0.849739000 seconds] Frame Number: 32 Frame Length: 181 bytes Capture Length: 181 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.43.172.30 (192.43.172.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 167 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 55 Protocol: UDP (0x11) Header checksum: 0x0c25 [correct] [Good: True] [Bad : False] Source: 192.43.172.30 (192.43.172.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 42271 (42271) Source port: domain (53) Destination port: 42271 (42271) Length: 147 Checksum: 0xa0b8 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 31] [Time: 0.084482000 seconds] Transaction ID: 0x523a Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 2 Additional RRs: 3 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Authoritative nameservers atosorigin.com: type NS, class IN, ns ns3.atos.net Name: atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 14 Name server: ns3.atos.net atosorigin.com: type NS, class IN, ns ns4.atos.net Name: atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns4.atos.net Additional records ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 33 (105 bytes on wire, 105 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.375579000 [Time delta from previous captured frame: 0.000440000 seconds] [Time delta from previous displayed frame: 0.000440000 seconds] [Time since reference or first frame: 0.850179000 seconds] Frame Number: 33 Frame Length: 105 bytes Capture Length: 105 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5658 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 160.92.121.6 (160.92.121.6) User Datagram Protocol, Src Port: 42540 (42540), Dst Port: domain (53) Source port: 42540 (42540) Destination port: domain (53) Length: 71 Checksum: 0xe492 [incorrect, should be 0xacc8 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 34] Transaction ID: 0x2a77 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 34 (329 bytes on wire, 329 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.434086000 [Time delta from previous captured frame: 0.058507000 seconds] [Time delta from previous displayed frame: 0.058507000 seconds] [Time since reference or first frame: 0.908686000 seconds] Frame Number: 34 Frame Length: 329 bytes Capture Length: 329 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 315 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x5f78 [correct] [Good: True] [Bad : False] Source: 160.92.121.6 (160.92.121.6) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 42540 (42540) Source port: domain (53) Destination port: 42540 (42540) Length: 295 Checksum: 0xf951 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 33] [Time: 0.058507000 seconds] Transaction ID: 0x2a77 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 5 Additional RRs: 7 Queries front.webedu.men.aw.atosorigin.com: type A, class IN Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Answers front.webedu.men.aw.atosorigin.com: type A, class IN, addr 160.92.130.142 Name: front.webedu.men.aw.atosorigin.com Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 160.92.130.142 Authoritative nameservers aw.atosorigin.com: type NS, class IN, ns ns4.atos.net Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 14 Name server: ns4.atos.net aw.atosorigin.com: type NS, class IN, ns ns1.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 20 Name server: ns1.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns2.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns2.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns3.ext.origin-it.com Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns3.ext.origin-it.com aw.atosorigin.com: type NS, class IN, ns ns3.atos.net Name: aw.atosorigin.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 1 day Data length: 6 Name server: ns3.atos.net Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.138 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 23 hours, 29 minutes, 16 seconds Data length: 4 Addr: 212.159.192.138 ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 23 hours, 29 minutes, 16 seconds Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 23 hours, 29 minutes, 16 seconds Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 22 hours, 55 minutes, 47 seconds Data length: 4 Addr: 12.174.168.53 ns3.atos.net: type A, class IN, addr 160.92.121.6 Name: ns3.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 160.92.121.6 ns4.atos.net: type A, class IN, addr 193.56.46.248 Name: ns4.atos.net Type: A (Host address) Class: IN (0x0001) Time to live: 1 day Data length: 4 Addr: 193.56.46.248 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 35 (105 bytes on wire, 105 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.465084000 [Time delta from previous captured frame: 0.030998000 seconds] [Time delta from previous displayed frame: 0.030998000 seconds] [Time since reference or first frame: 0.939684000 seconds] Frame Number: 35 Frame Length: 105 bytes Capture Length: 105 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5658 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 160.92.121.6 (160.92.121.6) User Datagram Protocol, Src Port: 56075 (56075), Dst Port: domain (53) Source port: 56075 (56075) Destination port: domain (53) Length: 71 Checksum: 0xe492 [incorrect, should be 0x6b04 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 42] Transaction ID: 0x3741 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type AAAA, class IN Name: front.webedu.men.aw.atosorigin.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 36 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.465400000 [Time delta from previous captured frame: 0.000316000 seconds] [Time delta from previous displayed frame: 0.000316000 seconds] [Time since reference or first frame: 0.940000000 seconds] Frame Number: 36 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 33435 (33435), Dst Port: domain (53) Source port: 33435 (33435) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0xd1bc (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 45] Transaction ID: 0x1d6f Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns1.ext.origin-it.com: type A, class IN Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 37 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.465647000 [Time delta from previous captured frame: 0.000247000 seconds] [Time delta from previous displayed frame: 0.000247000 seconds] [Time since reference or first frame: 0.940247000 seconds] Frame Number: 37 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 48220 (48220), Dst Port: domain (53) Source port: 48220 (48220) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0xc153 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 46] Transaction ID: 0xd916 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns1.ext.origin-it.com: type AAAA, class IN Name: ns1.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 38 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.465893000 [Time delta from previous captured frame: 0.000246000 seconds] [Time delta from previous displayed frame: 0.000246000 seconds] [Time since reference or first frame: 0.940493000 seconds] Frame Number: 38 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 57398 (57398), Dst Port: domain (53) Source port: 57398 (57398) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0x8bf7 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 48] Transaction ID: 0x0598 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns2.ext.origin-it.com: type A, class IN Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 39 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.466136000 [Time delta from previous captured frame: 0.000243000 seconds] [Time delta from previous displayed frame: 0.000243000 seconds] [Time since reference or first frame: 0.940736000 seconds] Frame Number: 39 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 49777 (49777), Dst Port: domain (53) Source port: 49777 (49777) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0x237e (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 50] Transaction ID: 0x70d6 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns2.ext.origin-it.com: type AAAA, class IN Name: ns2.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 40 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.466391000 [Time delta from previous captured frame: 0.000255000 seconds] [Time delta from previous displayed frame: 0.000255000 seconds] [Time since reference or first frame: 0.940991000 seconds] Frame Number: 40 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 43175 (43175), Dst Port: domain (53) Source port: 43175 (43175) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0xc839 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 51] Transaction ID: 0x00e4 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.ext.origin-it.com: type A, class IN Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 41 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.466641000 [Time delta from previous captured frame: 0.000250000 seconds] [Time delta from previous displayed frame: 0.000250000 seconds] [Time since reference or first frame: 0.941241000 seconds] Frame Number: 41 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 192.31.80.30 (192.31.80.30) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5f8a [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 192.31.80.30 (192.31.80.30) User Datagram Protocol, Src Port: 35694 (35694), Dst Port: domain (53) Source port: 35694 (35694) Destination port: domain (53) Length: 58 Checksum: 0xdb60 [incorrect, should be 0xe6fa (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 49] Transaction ID: 0xe45b Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.ext.origin-it.com: type AAAA, class IN Name: ns3.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 42 (170 bytes on wire, 170 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.523457000 [Time delta from previous captured frame: 0.056816000 seconds] [Time delta from previous displayed frame: 0.056816000 seconds] [Time since reference or first frame: 0.998057000 seconds] Frame Number: 42 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x6017 [correct] [Good: True] [Bad : False] Source: 160.92.121.6 (160.92.121.6) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 56075 (56075) Source port: domain (53) Destination port: 56075 (56075) Length: 136 Checksum: 0x7d90 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 35] [Time: 0.058373000 seconds] Transaction ID: 0x3741 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type AAAA, class IN Name: front.webedu.men.aw.atosorigin.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers aw.atosorigin.com: type SOA, class IN, mname ns3.atos.net Name: aw.atosorigin.com Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 day Data length: 53 Primary name server: ns3.atos.net Responsible authority's mailbox: hostmaster.axime.com Serial number: 2009012801 Refresh interval: 6 hours Retry interval: 1 hour Expiration limit: 30 days Minimum TTL: 1 day Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 43 (105 bytes on wire, 105 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.536407000 [Time delta from previous captured frame: 0.012950000 seconds] [Time delta from previous displayed frame: 0.012950000 seconds] [Time since reference or first frame: 1.011007000 seconds] Frame Number: 43 Frame Length: 105 bytes Capture Length: 105 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 160.92.121.6 (160.92.121.6) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 91 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x5658 [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 160.92.121.6 (160.92.121.6) User Datagram Protocol, Src Port: 60212 (60212), Dst Port: domain (53) Source port: 60212 (60212) Destination port: domain (53) Length: 71 Checksum: 0xe492 [incorrect, should be 0x0237 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 44] Transaction ID: 0x8ff2 Flags: 0x0000 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...0 .... = Non-authenticated data OK: Non-authenticated data is unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type MX, class IN Name: front.webedu.men.aw.atosorigin.com Type: MX (Mail exchange) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 44 (170 bytes on wire, 170 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.594895000 [Time delta from previous captured frame: 0.058488000 seconds] [Time delta from previous displayed frame: 0.058488000 seconds] [Time since reference or first frame: 1.069495000 seconds] Frame Number: 44 Frame Length: 170 bytes Capture Length: 170 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 160.92.121.6 (160.92.121.6), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 156 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 54 Protocol: UDP (0x11) Header checksum: 0x6017 [correct] [Good: True] [Bad : False] Source: 160.92.121.6 (160.92.121.6) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 60212 (60212) Source port: domain (53) Destination port: 60212 (60212) Length: 136 Checksum: 0x14c3 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 43] [Time: 0.058488000 seconds] Transaction ID: 0x8ff2 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries front.webedu.men.aw.atosorigin.com: type MX, class IN Name: front.webedu.men.aw.atosorigin.com Type: MX (Mail exchange) Class: IN (0x0001) Authoritative nameservers aw.atosorigin.com: type SOA, class IN, mname ns3.atos.net Name: aw.atosorigin.com Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 day Data length: 53 Primary name server: ns3.atos.net Responsible authority's mailbox: hostmaster.axime.com Serial number: 2009012801 Refresh interval: 6 hours Retry interval: 1 hour Expiration limit: 30 days Minimum TTL: 1 day Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 45 (206 bytes on wire, 206 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.621758000 [Time delta from previous captured frame: 0.026863000 seconds] [Time delta from previous displayed frame: 0.026863000 seconds] [Time since reference or first frame: 1.096358000 seconds] Frame Number: 45 Frame Length: 206 bytes Capture Length: 206 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 192 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 49 Protocol: UDP (0x11) Header checksum: 0x6e18 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 33435 (33435) Source port: domain (53) Destination port: 33435 (33435) Length: 172 Checksum: 0x6106 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 36] [Time: 0.156358000 seconds] Transaction ID: 0x1d6f Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 3 Additional RRs: 4 Queries ns1.ext.origin-it.com: type A, class IN Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Answers ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 46 (190 bytes on wire, 190 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.623676000 [Time delta from previous captured frame: 0.001918000 seconds] [Time delta from previous displayed frame: 0.001918000 seconds] [Time since reference or first frame: 1.098276000 seconds] Frame Number: 46 Frame Length: 190 bytes Capture Length: 190 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 176 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: UDP (0x11) Header checksum: 0x6d28 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 48220 (48220) Source port: domain (53) Destination port: 48220 (48220) Length: 156 Checksum: 0x30b6 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 37] [Time: 0.158029000 seconds] Transaction ID: 0xd916 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 3 Additional RRs: 4 Queries ns1.ext.origin-it.com: type AAAA, class IN Name: ns1.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 47 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.624105000 [Time delta from previous captured frame: 0.000429000 seconds] [Time delta from previous displayed frame: 0.000429000 seconds] [Time since reference or first frame: 1.098705000 seconds] Frame Number: 47 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xdb1d [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 212.159.192.10 (212.159.192.10) User Datagram Protocol, Src Port: 45765 (45765), Dst Port: domain (53) Source port: 45765 (45765) Destination port: domain (53) Length: 58 Checksum: 0x5fcd [incorrect, should be 0xf637 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 54] Transaction ID: 0x295d Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns1.ext.origin-it.com: type AAAA, class IN Name: ns1.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 48 (206 bytes on wire, 206 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.626902000 [Time delta from previous captured frame: 0.002797000 seconds] [Time delta from previous displayed frame: 0.002797000 seconds] [Time since reference or first frame: 1.101502000 seconds] Frame Number: 48 Frame Length: 206 bytes Capture Length: 206 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 192 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 49 Protocol: UDP (0x11) Header checksum: 0x6e18 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 57398 (57398) Source port: domain (53) Destination port: 57398 (57398) Length: 172 Checksum: 0x4ebc [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 38] [Time: 0.161009000 seconds] Transaction ID: 0x0598 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 3 Additional RRs: 4 Queries ns2.ext.origin-it.com: type A, class IN Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Answers ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 49 (190 bytes on wire, 190 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.629679000 [Time delta from previous captured frame: 0.002777000 seconds] [Time delta from previous displayed frame: 0.002777000 seconds] [Time since reference or first frame: 1.104279000 seconds] Frame Number: 49 Frame Length: 190 bytes Capture Length: 190 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 176 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: UDP (0x11) Header checksum: 0x6d28 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 35694 (35694) Source port: domain (53) Destination port: 35694 (35694) Length: 156 Checksum: 0x745d [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 41] [Time: 0.163038000 seconds] Transaction ID: 0xe45b Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 3 Additional RRs: 4 Queries ns3.ext.origin-it.com: type AAAA, class IN Name: ns3.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 50 (190 bytes on wire, 190 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.629731000 [Time delta from previous captured frame: 0.000052000 seconds] [Time delta from previous displayed frame: 0.000052000 seconds] [Time since reference or first frame: 1.104331000 seconds] Frame Number: 50 Frame Length: 190 bytes Capture Length: 190 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 176 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: UDP (0x11) Header checksum: 0x6d28 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 49777 (49777) Source port: domain (53) Destination port: 49777 (49777) Length: 156 Checksum: 0xa1e0 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 39] [Time: 0.163595000 seconds] Transaction ID: 0x70d6 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 3 Additional RRs: 4 Queries ns2.ext.origin-it.com: type AAAA, class IN Name: ns2.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 51 (206 bytes on wire, 206 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.629856000 [Time delta from previous captured frame: 0.000125000 seconds] [Time delta from previous displayed frame: 0.000125000 seconds] [Time since reference or first frame: 1.104456000 seconds] Frame Number: 51 Frame Length: 206 bytes Capture Length: 206 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.31.80.30 (192.31.80.30), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 192 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: UDP (0x11) Header checksum: 0x6d18 [correct] [Good: True] [Bad : False] Source: 192.31.80.30 (192.31.80.30) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 43175 (43175) Source port: domain (53) Destination port: 43175 (43175) Length: 172 Checksum: 0x3c63 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 40] [Time: 0.163465000 seconds] Transaction ID: 0x00e4 Flags: 0x8000 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 3 Additional RRs: 4 Queries ns3.ext.origin-it.com: type A, class IN Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Answers ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 Authoritative nameservers origin-it.com: type NS, class IN, ns ns1.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns1.ext.origin-it.com origin-it.com: type NS, class IN, ns ns2.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 6 Name server: ns2.ext.origin-it.com origin-it.com: type NS, class IN, ns ns3.ext.origin-it.com Name: origin-it.com Type: NS (Authoritative name server) Class: IN (0x0001) Time to live: 2 days Data length: 2 Name server: ns3.ext.origin-it.com Additional records ns1.ext.origin-it.com: type A, class IN, addr 212.159.192.10 Name: ns1.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 212.159.192.10 ns2.ext.origin-it.com: type A, class IN, addr 203.95.78.38 Name: ns2.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 203.95.78.38 ns3.ext.origin-it.com: type A, class IN, addr 12.174.168.53 Name: ns3.ext.origin-it.com Type: A (Host address) Class: IN (0x0001) Time to live: 2 days Data length: 4 Addr: 12.174.168.53 : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 512 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x0 Data length: 0 Frame 52 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.630186000 [Time delta from previous captured frame: 0.000330000 seconds] [Time delta from previous displayed frame: 0.000330000 seconds] [Time since reference or first frame: 1.104786000 seconds] Frame Number: 52 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xdb1d [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 212.159.192.10 (212.159.192.10) User Datagram Protocol, Src Port: 42994 (42994), Dst Port: domain (53) Source port: 42994 (42994) Destination port: domain (53) Length: 58 Checksum: 0x5fcd [incorrect, should be 0x63e3 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 55] Transaction ID: 0xc683 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns2.ext.origin-it.com: type AAAA, class IN Name: ns2.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 53 (92 bytes on wire, 92 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.630430000 [Time delta from previous captured frame: 0.000244000 seconds] [Time delta from previous displayed frame: 0.000244000 seconds] [Time since reference or first frame: 1.105030000 seconds] Frame Number: 53 Frame Length: 92 bytes Capture Length: 92 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: D-Link_52:bf:ab (00:1b:11:52:bf:ab), Dst: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Destination: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.10.47 (192.168.10.47), Dst: 212.159.192.10 (212.159.192.10) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xdb1d [correct] [Good: True] [Bad : False] Source: 192.168.10.47 (192.168.10.47) Destination: 212.159.192.10 (212.159.192.10) User Datagram Protocol, Src Port: 49832 (49832), Dst Port: domain (53) Source port: 49832 (49832) Destination port: domain (53) Length: 58 Checksum: 0x5fcd [incorrect, should be 0xd93f (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Domain Name System (query) [Response In: 56] Transaction ID: 0x3670 Flags: 0x0010 (Standard query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ...1 .... = Non-authenticated data OK: Non-authenticated data is acceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries ns3.ext.origin-it.com: type AAAA, class IN Name: ns3.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 54 (155 bytes on wire, 155 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.693191000 [Time delta from previous captured frame: 0.062761000 seconds] [Time delta from previous displayed frame: 0.062761000 seconds] [Time since reference or first frame: 1.167791000 seconds] Frame Number: 54 Frame Length: 155 bytes Capture Length: 155 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 141 Identification: 0xbd19 (48409) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 242 Protocol: UDP (0x11) Header checksum: 0x6bc4 [correct] [Good: True] [Bad : False] Source: 212.159.192.10 (212.159.192.10) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 45765 (45765) Source port: domain (53) Destination port: 45765 (45765) Length: 121 Checksum: 0xb8a9 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 47] [Time: 0.069086000 seconds] Transaction ID: 0x295d Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries ns1.ext.origin-it.com: type AAAA, class IN Name: ns1.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com Name: origin-it.com Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 hour Data length: 51 Primary name server: ns1.ext.origin-it.com Responsible authority's mailbox: hostmaster.origin-services.com Serial number: 2005111500 Refresh interval: 3 hours Retry interval: 1 hour Expiration limit: 14 days Minimum TTL: 1 hour Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 55 (159 bytes on wire, 159 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.700821000 [Time delta from previous captured frame: 0.007630000 seconds] [Time delta from previous displayed frame: 0.007630000 seconds] [Time since reference or first frame: 1.175421000 seconds] Frame Number: 55 Frame Length: 159 bytes Capture Length: 159 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 145 Identification: 0xbd1a (48410) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 242 Protocol: UDP (0x11) Header checksum: 0x6bbf [correct] [Good: True] [Bad : False] Source: 212.159.192.10 (212.159.192.10) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 42994 (42994) Source port: domain (53) Destination port: 42994 (42994) Length: 125 Checksum: 0x7ed6 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 52] [Time: 0.070635000 seconds] Transaction ID: 0xc683 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries ns2.ext.origin-it.com: type AAAA, class IN Name: ns2.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com Name: origin-it.com Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 hour Data length: 55 Primary name server: ns1.ext.origin-it.com Responsible authority's mailbox: hostmaster.origin-services.com Serial number: 2005111500 Refresh interval: 3 hours Retry interval: 1 hour Expiration limit: 14 days Minimum TTL: 1 hour Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0 Frame 56 (159 bytes on wire, 159 bytes captured) Arrival Time: Jan 28, 2009 15:56:18.701281000 [Time delta from previous captured frame: 0.000460000 seconds] [Time delta from previous displayed frame: 0.000460000 seconds] [Time since reference or first frame: 1.175881000 seconds] Frame Number: 56 Frame Length: 159 bytes Capture Length: 159 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:dns] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8), Dst: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Destination: D-Link_52:bf:ab (00:1b:11:52:bf:ab) Address: D-Link_52:bf:ab (00:1b:11:52:bf:ab) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) Address: AcctonTe_8e:cb:b8 (00:00:e8:8e:cb:b8) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 212.159.192.10 (212.159.192.10), Dst: 192.168.10.47 (192.168.10.47) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 145 Identification: 0xbd1b (48411) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 242 Protocol: UDP (0x11) Header checksum: 0x6bbe [correct] [Good: True] [Bad : False] Source: 212.159.192.10 (212.159.192.10) Destination: 192.168.10.47 (192.168.10.47) User Datagram Protocol, Src Port: domain (53), Dst Port: 49832 (49832) Source port: domain (53) Destination port: 49832 (49832) Length: 125 Checksum: 0xf432 [correct] [Good Checksum: True] [Bad Checksum: False] Domain Name System (response) [Request In: 53] [Time: 0.070851000 seconds] Transaction ID: 0x3670 Flags: 0x8400 (Standard query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 0 Authority RRs: 1 Additional RRs: 1 Queries ns3.ext.origin-it.com: type AAAA, class IN Name: ns3.ext.origin-it.com Type: AAAA (IPv6 address) Class: IN (0x0001) Authoritative nameservers origin-it.com: type SOA, class IN, mname ns1.ext.origin-it.com Name: origin-it.com Type: SOA (Start of zone of authority) Class: IN (0x0001) Time to live: 1 hour Data length: 55 Primary name server: ns1.ext.origin-it.com Responsible authority's mailbox: hostmaster.origin-services.com Serial number: 2005111500 Refresh interval: 3 hours Retry interval: 1 hour Expiration limit: 14 days Minimum TTL: 1 hour Additional records : type OPT Name: Type: OPT (EDNS0 option) UDP payload size: 4096 Higher bits in extended RCODE: 0x0 EDNS0 version: 0 Z: 0x8000 Bit 0 (DO bit): 1 (Accepts DNSSEC security RRs) Bits 1-15: 0x0 (reserved) Data length: 0