OXE to Cisco IP trunk
bigmac wrote:then I have an issue as port mirroring not an option on this site...
Just find an old hub (not a switch!) connect PC, GD and your LAN connection to it.
Run Wireshark on PC with option "host <your_GD_address>"
If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.
-
bigmac
Managed to mirror it but to be honest have limited knowledge on what I am seeing here. from the T3 it looks like CCM is rejecting my call. BTW Calls from CCM to me work fine.
I did try uploading as txt but looks like file format not allowed
No. Time Source Destination Protocol Info
No. Time Source Destination Protocol Info
29 9.912155 AlcatelB_8c:f4:0f Broadcast ARP Who has 10.248.92.254? Tell 10.248.92.63
Frame 29 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.364323000
[Time delta from previous captured frame: 0.588448000 seconds]
[Time delta from previous displayed frame: 0.588448000 seconds]
[Time since reference or first frame: 9.912155000 seconds]
Frame Number: 29
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
[Is gratuitous: False]
Sender MAC address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Sender IP address: 10.248.92.63 (10.248.92.63)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.248.92.254 (10.248.92.254)
No. Time Source Destination Protocol Info
30 9.912274 All-HSRP-routers_04 AlcatelB_8c:f4:0f ARP 10.248.92.254 is at 00:00:0c:07:ac:04
Frame 30 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.364442000
[Time delta from previous captured frame: 0.000119000 seconds]
[Time delta from previous displayed frame: 0.000119000 seconds]
[Time since reference or first frame: 9.912274000 seconds]
Frame Number: 30
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: All-HSRP-routers_04 (00:00:0c:07:ac:04), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
[Is gratuitous: False]
Sender MAC address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Sender IP address: 10.248.92.254 (10.248.92.254)
Target MAC address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Target IP address: 10.248.92.63 (10.248.92.63)
No. Time Source Destination Protocol Info
31 9.913577 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [SYN] Seq=0 Win=32120 Len=0 MSS=1460 TSV=142220 TSER=0 WS=0
Frame 31 (74 bytes on wire, 74 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.365745000
[Time delta from previous captured frame: 0.001303000 seconds]
[Time delta from previous displayed frame: 0.001303000 seconds]
[Time since reference or first frame: 9.913577000 seconds]
Frame Number: 31
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x000d (13)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00da [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 0, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgement: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port h323hostcall]
[Message: Connection establish request (SYN): server port h323hostcall]
[Severity level: Chat]
[Group: Sequence]
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x6500 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 142220, TSecr 0
NOP
Window scale: 0 (multiply by 1)
No. Time Source Destination Protocol Info
32 9.925243 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3012946083 TSER=142220 WS=0
Frame 32 (74 bytes on wire, 74 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.377411000
[Time delta from previous captured frame: 0.011666000 seconds]
[Time delta from previous displayed frame: 0.011666000 seconds]
[Time since reference or first frame: 9.925243000 seconds]
Frame Number: 32
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x0687 [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 0, Ack: 1, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 40 bytes
Flags: 0x12 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port h323hostcall]
[Message: Connection establish acknowledge (SYN+ACK): server port h323hostcall]
[Severity level: Chat]
[Group: Sequence]
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x40d3 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 3012946083, TSecr 142220
NOP
Window scale: 0 (multiply by 1)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 31]
[The RTT to ACK the segment was: 0.011666000 seconds]
No. Time Source Destination Protocol Info
33 9.926523 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [ACK] Seq=1 Ack=1 Win=32120 Len=0 TSV=142221 TSER=3012946083
Frame 33 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.378691000
[Time delta from previous captured frame: 0.001280000 seconds]
[Time delta from previous displayed frame: 0.001280000 seconds]
[Time since reference or first frame: 9.926523000 seconds]
Frame Number: 33
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x000e (14)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00e1 [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 1, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x08bf [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142221, TSecr 3012946083
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 32]
[The RTT to ACK the segment was: 0.001280000 seconds]
No. Time Source Destination Protocol Info
34 9.938301 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [FIN, ACK] Seq=1 Ack=1 Win=5792 Len=0 TSV=3012946084 TSER=142221
Frame 34 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.390469000
[Time delta from previous captured frame: 0.011778000 seconds]
[Time delta from previous displayed frame: 0.011778000 seconds]
[Time since reference or first frame: 9.938301000 seconds]
Frame Number: 34
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0b2a (2858)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0xfb64 [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 1, Ack: 1, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
[Expert Info (Chat/Sequence): Connection finish (FIN)]
[Message: Connection finish (FIN)]
[Severity level: Chat]
[Group: Sequence]
Window size: 5792
Checksum: 0x6f95 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3012946084, TSecr 142221
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 33]
[The RTT to ACK the segment was: 0.011778000 seconds]
No. Time Source Destination Protocol Info
35 9.939796 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [ACK] Seq=1 Ack=2 Win=32120 Len=0 TSV=142223 TSER=3012946084
Frame 35 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.391964000
[Time delta from previous captured frame: 0.001495000 seconds]
[Time delta from previous displayed frame: 0.001495000 seconds]
[Time since reference or first frame: 9.939796000 seconds]
Frame Number: 35
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x000f (15)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00e0 [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 2, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x08bb [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142223, TSecr 3012946084
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 34]
[The RTT to ACK the segment was: 0.001495000 seconds]
No. Time Source Destination Protocol Info
36 9.944869 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [FIN, ACK] Seq=1 Ack=2 Win=32120 Len=0 TSV=142223 TSER=3012946084
Frame 36 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.397037000
[Time delta from previous captured frame: 0.005073000 seconds]
[Time delta from previous displayed frame: 0.005073000 seconds]
[Time since reference or first frame: 9.944869000 seconds]
Frame Number: 36
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0010 (16)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00df [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 2, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
[Expert Info (Chat/Sequence): Connection finish (FIN)]
[Message: Connection finish (FIN)]
[Severity level: Chat]
[Group: Sequence]
Window size: 32120
Checksum: 0x08ba [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142223, TSecr 3012946084
No. Time Source Destination Protocol Info
37 9.956168 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [ACK] Seq=2 Ack=2 Win=5792 Len=0 TSV=3012946086 TSER=142223
Frame 37 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.408336000
[Time delta from previous captured frame: 0.011299000 seconds]
[Time delta from previous displayed frame: 0.011299000 seconds]
[Time since reference or first frame: 9.956168000 seconds]
Frame Number: 37
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x068f [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 2, Ack: 2, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 2 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x6f90 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3012946086, TSecr 142223
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 36]
[The RTT to ACK the segment was: 0.011299000 seconds]
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_ed:69:ad (00:0b:46:ed:69:ad)
Address: Cisco_ed:69:ad (00:0b:46:ed:69:ad)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Length: 38
Trailer: 0000000000000000
Logical-Link Control
DSAP: Spanning Tree BPDU (0x42)
IG Bit: Individual
SSAP: Spanning Tree BPDU (0x42)
CR Bit: Command
Control field: U, func=UI (0x03)
000. 00.. = Command: Unnumbered Information (0x00)
.... ..11 = Frame type: Unnumbered frame (0x03)
Spanning Tree Protocol
Protocol Identifier: Spanning Tree Protocol (0x0000)
Protocol Version Identifier: Spanning Tree (0)
BPDU Type: Configuration (0x00)
BPDU flags: 0x00
0... .... = Topology Change Acknowledgment: No
.... ...0 = Topology Change: No
Root Identifier: 8192 / 0 / 00:09:12:05:e0:03
Root Bridge Priority: 8192
Root Bridge System ID Extension: 0
Root Bridge System ID: 00:09:12:05:e0:03
Root Path Cost: 3004
Bridge Identifier: 49152 / 4 / 00:0b:46:ed:69:80
Bridge Priority: 49152
Bridge System ID Extension: 4
Bridge System ID: 00:0b:46:ed:69:80
Port identifier: 0x802d
Message Age: 1
Max Age: 20
Hello Time: 2
Forward Delay: 15
I did try uploading as txt but looks like file format not allowed
No. Time Source Destination Protocol Info
No. Time Source Destination Protocol Info
29 9.912155 AlcatelB_8c:f4:0f Broadcast ARP Who has 10.248.92.254? Tell 10.248.92.63
Frame 29 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.364323000
[Time delta from previous captured frame: 0.588448000 seconds]
[Time delta from previous displayed frame: 0.588448000 seconds]
[Time since reference or first frame: 9.912155000 seconds]
Frame Number: 29
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
[Is gratuitous: False]
Sender MAC address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Sender IP address: 10.248.92.63 (10.248.92.63)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.248.92.254 (10.248.92.254)
No. Time Source Destination Protocol Info
30 9.912274 All-HSRP-routers_04 AlcatelB_8c:f4:0f ARP 10.248.92.254 is at 00:00:0c:07:ac:04
Frame 30 (60 bytes on wire, 60 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.364442000
[Time delta from previous captured frame: 0.000119000 seconds]
[Time delta from previous displayed frame: 0.000119000 seconds]
[Time since reference or first frame: 9.912274000 seconds]
Frame Number: 30
Frame Length: 60 bytes
Capture Length: 60 bytes
[Frame is marked: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: All-HSRP-routers_04 (00:00:0c:07:ac:04), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
[Is gratuitous: False]
Sender MAC address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Sender IP address: 10.248.92.254 (10.248.92.254)
Target MAC address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Target IP address: 10.248.92.63 (10.248.92.63)
No. Time Source Destination Protocol Info
31 9.913577 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [SYN] Seq=0 Win=32120 Len=0 MSS=1460 TSV=142220 TSER=0 WS=0
Frame 31 (74 bytes on wire, 74 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.365745000
[Time delta from previous captured frame: 0.001303000 seconds]
[Time delta from previous displayed frame: 0.001303000 seconds]
[Time since reference or first frame: 9.913577000 seconds]
Frame Number: 31
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x000d (13)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00da [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 0, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 0 (relative sequence number)
Header length: 40 bytes
Flags: 0x02 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgement: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish request (SYN): server port h323hostcall]
[Message: Connection establish request (SYN): server port h323hostcall]
[Severity level: Chat]
[Group: Sequence]
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x6500 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 142220, TSecr 0
NOP
Window scale: 0 (multiply by 1)
No. Time Source Destination Protocol Info
32 9.925243 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=3012946083 TSER=142220 WS=0
Frame 32 (74 bytes on wire, 74 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.377411000
[Time delta from previous captured frame: 0.011666000 seconds]
[Time delta from previous displayed frame: 0.011666000 seconds]
[Time since reference or first frame: 9.925243000 seconds]
Frame Number: 32
Frame Length: 74 bytes
Capture Length: 74 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x0687 [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 0, Ack: 1, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 0 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 40 bytes
Flags: 0x12 (SYN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
[Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port h323hostcall]
[Message: Connection establish acknowledge (SYN+ACK): server port h323hostcall]
[Severity level: Chat]
[Group: Sequence]
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x40d3 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Timestamps: TSval 3012946083, TSecr 142220
NOP
Window scale: 0 (multiply by 1)
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 31]
[The RTT to ACK the segment was: 0.011666000 seconds]
No. Time Source Destination Protocol Info
33 9.926523 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [ACK] Seq=1 Ack=1 Win=32120 Len=0 TSV=142221 TSER=3012946083
Frame 33 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.378691000
[Time delta from previous captured frame: 0.001280000 seconds]
[Time delta from previous displayed frame: 0.001280000 seconds]
[Time since reference or first frame: 9.926523000 seconds]
Frame Number: 33
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x000e (14)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00e1 [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 1, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x08bf [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142221, TSecr 3012946083
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 32]
[The RTT to ACK the segment was: 0.001280000 seconds]
No. Time Source Destination Protocol Info
34 9.938301 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [FIN, ACK] Seq=1 Ack=1 Win=5792 Len=0 TSV=3012946084 TSER=142221
Frame 34 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.390469000
[Time delta from previous captured frame: 0.011778000 seconds]
[Time delta from previous displayed frame: 0.011778000 seconds]
[Time since reference or first frame: 9.938301000 seconds]
Frame Number: 34
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0b2a (2858)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0xfb64 [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 1, Ack: 1, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
[Expert Info (Chat/Sequence): Connection finish (FIN)]
[Message: Connection finish (FIN)]
[Severity level: Chat]
[Group: Sequence]
Window size: 5792
Checksum: 0x6f95 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3012946084, TSecr 142221
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 33]
[The RTT to ACK the segment was: 0.011778000 seconds]
No. Time Source Destination Protocol Info
35 9.939796 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [ACK] Seq=1 Ack=2 Win=32120 Len=0 TSV=142223 TSER=3012946084
Frame 35 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.391964000
[Time delta from previous captured frame: 0.001495000 seconds]
[Time delta from previous displayed frame: 0.001495000 seconds]
[Time since reference or first frame: 9.939796000 seconds]
Frame Number: 35
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x000f (15)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00e0 [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 2, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 32120
Checksum: 0x08bb [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142223, TSecr 3012946084
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 34]
[The RTT to ACK the segment was: 0.001495000 seconds]
No. Time Source Destination Protocol Info
36 9.944869 10.248.92.63 10.54.200.104 TCP 21004 > h323hostcall [FIN, ACK] Seq=1 Ack=2 Win=32120 Len=0 TSV=142223 TSER=3012946084
Frame 36 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.397037000
[Time delta from previous captured frame: 0.005073000 seconds]
[Time delta from previous displayed frame: 0.005073000 seconds]
[Time since reference or first frame: 9.944869000 seconds]
Frame Number: 36
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f), Dst: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Destination: All-HSRP-routers_04 (00:00:0c:07:ac:04)
Address: All-HSRP-routers_04 (00:00:0c:07:ac:04)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.248.92.63 (10.248.92.63), Dst: 10.54.200.104 (10.54.200.104)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0010 (16)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0x00df [correct]
[Good: True]
[Bad : False]
Source: 10.248.92.63 (10.248.92.63)
Destination: 10.54.200.104 (10.54.200.104)
Transmission Control Protocol, Src Port: 21004 (21004), Dst Port: h323hostcall (1720), Seq: 1, Ack: 2, Len: 0
Source port: 21004 (21004)
Destination port: h323hostcall (1720)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x11 (FIN, ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...1 = Fin: Set
[Expert Info (Chat/Sequence): Connection finish (FIN)]
[Message: Connection finish (FIN)]
[Severity level: Chat]
[Group: Sequence]
Window size: 32120
Checksum: 0x08ba [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 142223, TSecr 3012946084
No. Time Source Destination Protocol Info
37 9.956168 10.54.200.104 10.248.92.63 TCP h323hostcall > 21004 [ACK] Seq=2 Ack=2 Win=5792 Len=0 TSV=3012946086 TSER=142223
Frame 37 (66 bytes on wire, 66 bytes captured)
Arrival Time: Feb 2, 2010 11:02:42.408336000
[Time delta from previous captured frame: 0.011299000 seconds]
[Time delta from previous displayed frame: 0.011299000 seconds]
[Time since reference or first frame: 9.956168000 seconds]
Frame Number: 37
Frame Length: 66 bytes
Capture Length: 66 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Cisco_05:e3:fc (00:09:12:05:e3:fc), Dst: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Destination: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
Address: AlcatelB_8c:f4:0f (00:80:9f:8c:f4:0f)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_05:e3:fc (00:09:12:05:e3:fc)
Address: Cisco_05:e3:fc (00:09:12:05:e3:fc)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.54.200.104 (10.54.200.104), Dst: 10.248.92.63 (10.248.92.63)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00)
0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 52
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: TCP (0x06)
Header checksum: 0x068f [correct]
[Good: True]
[Bad : False]
Source: 10.54.200.104 (10.54.200.104)
Destination: 10.248.92.63 (10.248.92.63)
Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 21004 (21004), Seq: 2, Ack: 2, Len: 0
Source port: h323hostcall (1720)
Destination port: 21004 (21004)
[Stream index: 0]
Sequence number: 2 (relative sequence number)
Acknowledgement number: 2 (relative ack number)
Header length: 32 bytes
Flags: 0x10 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgement: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 5792
Checksum: 0x6f90 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Options: (12 bytes)
NOP
NOP
Timestamps: TSval 3012946086, TSecr 142223
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 36]
[The RTT to ACK the segment was: 0.011299000 seconds]
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Cisco_ed:69:ad (00:0b:46:ed:69:ad)
Address: Cisco_ed:69:ad (00:0b:46:ed:69:ad)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Length: 38
Trailer: 0000000000000000
Logical-Link Control
DSAP: Spanning Tree BPDU (0x42)
IG Bit: Individual
SSAP: Spanning Tree BPDU (0x42)
CR Bit: Command
Control field: U, func=UI (0x03)
000. 00.. = Command: Unnumbered Information (0x00)
.... ..11 = Frame type: Unnumbered frame (0x03)
Spanning Tree Protocol
Protocol Identifier: Spanning Tree Protocol (0x0000)
Protocol Version Identifier: Spanning Tree (0)
BPDU Type: Configuration (0x00)
BPDU flags: 0x00
0... .... = Topology Change Acknowledgment: No
.... ...0 = Topology Change: No
Root Identifier: 8192 / 0 / 00:09:12:05:e0:03
Root Bridge Priority: 8192
Root Bridge System ID Extension: 0
Root Bridge System ID: 00:09:12:05:e0:03
Root Path Cost: 3004
Bridge Identifier: 49152 / 4 / 00:0b:46:ed:69:80
Bridge Priority: 49152
Bridge System ID Extension: 4
Bridge System ID: 00:0b:46:ed:69:80
Port identifier: 0x802d
Message Age: 1
Max Age: 20
Hello Time: 2
Forward Delay: 15
It is true - .txt file has an "invalid type" icon in download attachment manager.bigmac wrote:Managed to mirror it but to be honest have limited knowledge on what I am seeing here. from the T3 it looks like CCM is rejecting my call. BTW Calls from CCM to me work fine.
I did try uploading as txt but looks like file format not allowed
About the trace - it is getting warmer:) But still - ho H.323 payload is shown in packets. Is it possible to miirror GD traffic in a raw "form". Like a hexdump?
If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.
-
bigmac
In the words of Homer J Woo Hoo. Working now going to kill CCM engineer 
. They have a cluster of CCM's and a network issue occured so all the phones registered to a CCM with a different address, why it took so long to tell me this I cannot imagine!! once I changed the speed dial to new address all ok!!!. Thanks for all the input all the same.
. They have a cluster of CCM's and a network issue occured so all the phones registered to a CCM with a different address, why it took so long to tell me this I cannot imagine!! once I changed the speed dial to new address all ok!!!. Thanks for all the input all the same.bigmac wrote:In the words of Homer J Woo Hoo. Working now going to kill CCM engineer
Just kill'em!
If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.
-
frank
- Alcatel Unleashed Certified Guru
- Posts: 3397
- Joined: 06 Jul 2004 00:18
- Location: New York
- Contact:
Fixed. You can now upload .txtManaged to mirror it but to be honest have limited knowledge on what I am seeing here. from the T3 it looks like CCM is rejecting my call. BTW Calls from CCM to me work fine.
I did try uploading as txt but looks like file format not allowed
No. Time Source Destination Protocol Info
Guys, if you see anything like that, please open a thread in "Talk to the admin" forum.
Thanks
Code Free Or Die
