[libvirt] [PATCH 3/3] Add sample output of Wireshark dissector

From: "Yuto KAWAMURA(kawamuray)" <kawamuray.dadada(a)gmail.com&gt; Add directory devtools/wireshark-dissector/samples/ and libvirt-sample.pdml which is sample output of dissector. --- .../samples/libvirt-sample.pdml | 7970 ++++++++++++++++++++ 1 file changed, 7970 insertions(+) create mode 100644 devtools/wireshark-dissector/samples/libvirt-sample.pdml diff --git a/devtools/wireshark-dissector/samples/libvirt-sample.pdml b/devtools/wireshark-dissector/samples/libvirt-sample.pdml new file mode 100644 index 0000000..bb6f0e8 --- /dev/null +++ b/devtools/wireshark-dissector/samples/libvirt-sample.pdml @@ -0,0 +1,7970 @@ +<?xml version="1.0"?> +<?xml-stylesheet type="text/xsl" href="pdml2html.xsl"?> +<!-- You can find pdml2html.xsl in /usr/share/wireshark or at http://anonsvn.wireshark.org/trunk/wireshark/pdml2html.xsl. --> +<pdml version="0" creator="wireshark/1.10.2" time="Wed Sep 18 13:06:59 2013" capture_file=""> +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="4" showname="Number" value="4" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.311108000 JST" showname="Captured Time" value="1379477225.311108000" size="94"/> + </proto> + <proto name="frame" showname="Frame 4: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.311108000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.311108000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.311108000 seconds" size="0" pos="0" show="1379477225.311108000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000364000 seconds" size="0" pos="0" show="0.000364000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.000386000 seconds" size="0" pos="0" show="0.000386000"/> + <field name="frame.number" showname="Frame Number: 4" size="0" pos="0" show="4"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0x4cf4 (19700)" size="2" pos="18" show="0x4cf4" value="4cf4"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0xefb1 [correct]" size="2" pos="24" show="0xefb1" value="efb1"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="efb1"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="efb1"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55128 (55128), Dst Port: 16509 (16509), Seq: 1, Ack: 1, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55128 (55128)" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="d4f33c85"/> + <field name="tcp.nxtseq" showname="Next sequence number: 29 (relative sequence number)" size="0" pos="34" show="29"/> + <field name="tcp.ack" showname="Acknowledgment number: 1 (relative ack number)" size="4" pos="42" show="1" value="04f9c1ac"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:77:5a:bb:70:76" value="0101080a5abb70775abb7076"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233463, TSecr 1522233462" size="10" pos="56" value="080a5abb70775abb7076"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233463" size="4" pos="58" show="1522233463" value="5abb7077"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233462" size="4" pos="62" show="1522233462" value="5abb7076"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000042000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="6" showname="Number" value="6" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.314424000 JST" showname="Captured Time" value="1379477225.314424000" size="102"/> + </proto> + <proto name="frame" showname="Frame 6: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.314424000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.314424000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.314424000 seconds" size="0" pos="0" show="1379477225.314424000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.003309000 seconds" size="0" pos="0" show="0.003309000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.003316000 seconds" size="0" pos="0" show="0.003316000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.003702000 seconds" size="0" pos="0" show="0.003702000"/> + <field name="frame.number" showname="Frame Number: 6" size="0" pos="0" show="6"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0xb1db (45531)" size="2" pos="18" show="0xb1db" value="b1db"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x8ac2 [correct]" size="2" pos="24" show="0x8ac2" value="8ac2"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="8ac2"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="8ac2"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55128 (55128), Seq: 1, Ack: 29, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55128 (55128)" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="04f9c1ac"/> + <field name="tcp.nxtseq" showname="Next sequence number: 37 (relative sequence number)" size="0" pos="34" show="37"/> + <field name="tcp.ack" showname="Acknowledgment number: 29 (relative ack number)" size="4" pos="42" show="29" value="d4f33ca1"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:7a:5a:bb:70:77" value="0101080a5abb707a5abb7077"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233466, TSecr 1522233463" size="10" pos="56" value="080a5abb707a5abb7077"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233466" size="4" pos="58" show="1522233466" value="5abb707a"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233463" size="4" pos="62" show="1522233463" value="5abb7077"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000000420000000100000000000000000000000100000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_auth_list_ret" showname="remote_auth_list_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types" showname="types :: remote_auth_type&lt;1&gt;" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types.types" showname="types: REMOTE_AUTH_NONE(0)" size="4" pos="98" show="0" value="00000000"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="8" showname="Number" value="8" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.314770000 JST" showname="Captured Time" value="1379477225.314770000" size="98"/> + </proto> + <proto name="frame" showname="Frame 8: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.314770000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.314770000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.314770000 seconds" size="0" pos="0" show="1379477225.314770000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000295000 seconds" size="0" pos="0" show="0.000295000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000346000 seconds" size="0" pos="0" show="0.000346000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.004048000 seconds" size="0" pos="0" show="0.004048000"/> + <field name="frame.number" showname="Frame Number: 8" size="0" pos="0" show="8"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0x4cf6 (19702)" size="2" pos="18" show="0x4cf6" value="4cf6"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0xefab [correct]" size="2" pos="24" show="0xefab" value="efab"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="efab"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="efab"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55128 (55128), Dst Port: 16509 (16509), Seq: 29, Ack: 37, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55128 (55128)" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 29 (relative sequence number)" size="4" pos="38" show="29" value="d4f33ca1"/> + <field name="tcp.nxtseq" showname="Next sequence number: 61 (relative sequence number)" size="0" pos="34" show="61"/> + <field name="tcp.ack" showname="Acknowledgment number: 37 (relative ack number)" size="4" pos="42" show="37" value="04f9c1d0"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:7a:5a:bb:70:7a" value="0101080a5abb707a5abb707a"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233466, TSecr 1522233466" size="10" pos="56" value="080a5abb707a5abb707a"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233466" size="4" pos="58" show="1522233466" value="5abb707a"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233466" size="4" pos="62" show="1522233466" value="5abb707a"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c0000000000000001000000000000000a"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 10" size="4" pos="94" show="10" value="0000000a"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="9" showname="Number" value="9" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.320969000 JST" showname="Captured Time" value="1379477225.320969000" size="98"/> + </proto> + <proto name="frame" showname="Frame 9: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.320969000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.320969000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.320969000 seconds" size="0" pos="0" show="1379477225.320969000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.006199000 seconds" size="0" pos="0" show="0.006199000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.006199000 seconds" size="0" pos="0" show="0.006199000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.010247000 seconds" size="0" pos="0" show="0.010247000"/> + <field name="frame.number" showname="Frame Number: 9" size="0" pos="0" show="9"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xb1dc (45532)" size="2" pos="18" show="0xb1dc" value="b1dc"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x8ac5 [correct]" size="2" pos="24" show="0x8ac5" value="8ac5"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="8ac5"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="8ac5"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55128 (55128), Seq: 37, Ack: 61, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55128 (55128)" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 37 (relative sequence number)" size="4" pos="38" show="37" value="04f9c1d0"/> + <field name="tcp.nxtseq" showname="Next sequence number: 69 (relative sequence number)" size="0" pos="34" show="69"/> + <field name="tcp.ack" showname="Acknowledgment number: 61 (relative ack number)" size="4" pos="42" show="61" value="d4f33cc1"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:80:5a:bb:70:7a" value="0101080a5abb70805abb707a"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233472, TSecr 1522233466" size="10" pos="56" value="080a5abb70805abb707a"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233472" size="4" pos="58" show="1522233472" value="5abb7080"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233466" size="4" pos="62" show="1522233466" value="5abb707a"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 8" size="0" pos="34" show="8"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.006199000 seconds" size="0" pos="34" show="0.006199000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000010000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="122"> + <field name="num" pos="0" show="10" showname="Number" value="a" size="122"/> + <field name="len" pos="0" show="122" showname="Frame Length" value="7a" size="122"/> + <field name="caplen" pos="0" show="122" showname="Captured Length" value="7a" size="122"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.321200000 JST" showname="Captured Time" value="1379477225.321200000" size="122"/> + </proto> + <proto name="frame" showname="Frame 10: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.321200000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.321200000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.321200000 seconds" size="0" pos="0" show="1379477225.321200000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000231000 seconds" size="0" pos="0" show="0.000231000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000231000 seconds" size="0" pos="0" show="0.000231000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.010478000 seconds" size="0" pos="0" show="0.010478000"/> + <field name="frame.number" showname="Frame Number: 10" size="0" pos="0" show="10"/> + <field name="frame.len" showname="Frame Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.cap_len" showname="Capture Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 108" size="2" pos="16" show="108" value="006c"/> + <field name="ip.id" showname="Identification: 0x4cf7 (19703)" size="2" pos="18" show="0x4cf7" value="4cf7"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0xef92 [correct]" size="2" pos="24" show="0xef92" value="ef92"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="ef92"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="ef92"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55128 (55128), Dst Port: 16509 (16509), Seq: 61, Ack: 69, Len: 56" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55128 (55128)" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 56" hide="yes" size="1" pos="46" show="56" value="80"/> + <field name="tcp.seq" showname="Sequence number: 61 (relative sequence number)" size="4" pos="38" show="61" value="d4f33cc1"/> + <field name="tcp.nxtseq" showname="Next sequence number: 117 (relative sequence number)" size="0" pos="34" show="117"/> + <field name="tcp.ack" showname="Acknowledgment number: 69 (relative ack number)" size="4" pos="42" show="69" value="04f9c1f0"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe60 [validation disabled]" size="2" pos="50" show="0xfe60" value="fe60"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe60"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe60"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:81:5a:bb:70:80" value="0101080a5abb70815abb7080"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233473, TSecr 1522233472" size="10" pos="56" value="080a5abb70815abb7080"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233473" size="4" pos="58" show="1522233473" value="5abb7081"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233472" size="4" pos="62" show="1522233472" value="5abb7080"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 9" size="0" pos="34" show="9"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000231000 seconds" size="0" pos="34" show="0.000231000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 56" size="0" pos="34" show="56"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 56" size="56" pos="66" show="56" value="00000038200080860000000100000001000000000000000200000000000000010000000f71656d753a2f2f2f73657373696f6e0000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="56" pos="66"> + <field name="libvirt.length" showname="length: 56" size="4" pos="66" show="56" value="00000038"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_open_args" showname="remote_connect_open_args" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_open_args.name" showname="name: (null)" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_connect_open_args.flags" showname="flags: 15" size="4" pos="98" show="15" value="0000000f"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="11" showname="Number" value="b" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.327357000 JST" showname="Captured Time" value="1379477225.327357000" size="94"/> + </proto> + <proto name="frame" showname="Frame 11: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.327357000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.327357000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.327357000 seconds" size="0" pos="0" show="1379477225.327357000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.006157000 seconds" size="0" pos="0" show="0.006157000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.006157000 seconds" size="0" pos="0" show="0.006157000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.016635000 seconds" size="0" pos="0" show="0.016635000"/> + <field name="frame.number" showname="Frame Number: 11" size="0" pos="0" show="11"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xb1dd (45533)" size="2" pos="18" show="0xb1dd" value="b1dd"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x8ac8 [correct]" size="2" pos="24" show="0x8ac8" value="8ac8"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="8ac8"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="8ac8"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55128 (55128), Seq: 69, Ack: 117, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55128 (55128)" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 69 (relative sequence number)" size="4" pos="38" show="69" value="04f9c1f0"/> + <field name="tcp.nxtseq" showname="Next sequence number: 97 (relative sequence number)" size="0" pos="34" show="97"/> + <field name="tcp.ack" showname="Acknowledgment number: 117 (relative ack number)" size="4" pos="42" show="117" value="d4f33cf9"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:87:5a:bb:70:81" value="0101080a5abb70875abb7081"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233479, TSecr 1522233473" size="10" pos="56" value="080a5abb70875abb7081"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233479" size="4" pos="58" show="1522233479" value="5abb7087"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233473" size="4" pos="62" show="1522233473" value="5abb7081"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 10" size="0" pos="34" show="10"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.006157000 seconds" size="0" pos="34" show="0.006157000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000001000000010000000200000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="12" showname="Number" value="c" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.348433000 JST" showname="Captured Time" value="1379477225.348433000" size="102"/> + </proto> + <proto name="frame" showname="Frame 12: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.348433000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.348433000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.348433000 seconds" size="0" pos="0" show="1379477225.348433000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.021076000 seconds" size="0" pos="0" show="0.021076000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.021076000 seconds" size="0" pos="0" show="0.021076000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.037711000 seconds" size="0" pos="0" show="0.037711000"/> + <field name="frame.number" showname="Frame Number: 12" size="0" pos="0" show="12"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0x4cf8 (19704)" size="2" pos="18" show="0x4cf8" value="4cf8"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0xefa5 [correct]" size="2" pos="24" show="0xefa5" value="efa5"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="efa5"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="efa5"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55128 (55128), Dst Port: 16509 (16509), Seq: 117, Ack: 97, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55128 (55128)" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 117 (relative sequence number)" size="4" pos="38" show="117" value="d4f33cf9"/> + <field name="tcp.nxtseq" showname="Next sequence number: 153 (relative sequence number)" size="0" pos="34" show="153"/> + <field name="tcp.ack" showname="Acknowledgment number: 97 (relative ack number)" size="4" pos="42" show="97" value="04f9c20c"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:9c:5a:bb:70:87" value="0101080a5abb709c5abb7087"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233500, TSecr 1522233479" size="10" pos="56" value="080a5abb709c5abb7087"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233500" size="4" pos="58" show="1522233500" value="5abb709c"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233479" size="4" pos="62" show="1522233479" value="5abb7087"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 11" size="0" pos="34" show="11"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.021076000 seconds" size="0" pos="34" show="0.021076000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000001110000000000000003000000000000000100000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_LIST_ALL_DOMAINS (273)" size="4" pos="78" show="273" value="00000111"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_list_all_domains_args" showname="remote_connect_list_all_domains_args" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_list_all_domains_args.need_results" showname="need_results: 1" size="4" pos="94" show="1" value="00000001"/> + <field name="libvirt.remote_connect_list_all_domains_args.flags" showname="flags: 1" size="4" pos="98" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="13" showname="Number" value="d" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.353343000 JST" showname="Captured Time" value="1379477225.353343000" size="102"/> + </proto> + <proto name="frame" showname="Frame 13: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.353343000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.353343000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.353343000 seconds" size="0" pos="0" show="1379477225.353343000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004910000 seconds" size="0" pos="0" show="0.004910000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004910000 seconds" size="0" pos="0" show="0.004910000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.042621000 seconds" size="0" pos="0" show="0.042621000"/> + <field name="frame.number" showname="Frame Number: 13" size="0" pos="0" show="13"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0xb1de (45534)" size="2" pos="18" show="0xb1de" value="b1de"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x8abf [correct]" size="2" pos="24" show="0x8abf" value="8abf"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="8abf"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="8abf"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55128 (55128), Seq: 97, Ack: 153, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55128 (55128)" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 97 (relative sequence number)" size="4" pos="38" show="97" value="04f9c20c"/> + <field name="tcp.nxtseq" showname="Next sequence number: 133 (relative sequence number)" size="0" pos="34" show="133"/> + <field name="tcp.ack" showname="Acknowledgment number: 153 (relative ack number)" size="4" pos="42" show="153" value="d4f33d1d"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:a1:5a:bb:70:9c" value="0101080a5abb70a15abb709c"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233505, TSecr 1522233500" size="10" pos="56" value="080a5abb70a15abb709c"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233505" size="4" pos="58" show="1522233505" value="5abb70a1"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233500" size="4" pos="62" show="1522233500" value="5abb709c"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 12" size="0" pos="34" show="12"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004910000 seconds" size="0" pos="34" show="0.004910000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000001110000000100000003000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_LIST_ALL_DOMAINS (273)" size="4" pos="78" show="273" value="00000111"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_list_all_domains_ret" showname="remote_connect_list_all_domains_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_list_all_domains_ret.domains" showname="domains :: remote_nonnull_domain&lt;0&gt;" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_connect_list_all_domains_ret.ret" showname="ret: 0" size="4" pos="98" show="0" value="00000000"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="14" showname="Number" value="e" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.380854000 JST" showname="Captured Time" value="1379477225.380854000" size="94"/> + </proto> + <proto name="frame" showname="Frame 14: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.380854000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.380854000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.380854000 seconds" size="0" pos="0" show="1379477225.380854000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.027511000 seconds" size="0" pos="0" show="0.027511000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.027511000 seconds" size="0" pos="0" show="0.027511000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.070132000 seconds" size="0" pos="0" show="0.070132000"/> + <field name="frame.number" showname="Frame Number: 14" size="0" pos="0" show="14"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0x4cf9 (19705)" size="2" pos="18" show="0x4cf9" value="4cf9"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0xefac [correct]" size="2" pos="24" show="0xefac" value="efac"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="efac"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="efac"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55128 (55128), Dst Port: 16509 (16509), Seq: 153, Ack: 133, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55128 (55128)" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="34" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 153 (relative sequence number)" size="4" pos="38" show="153" value="d4f33d1d"/> + <field name="tcp.nxtseq" showname="Next sequence number: 181 (relative sequence number)" size="0" pos="34" show="181"/> + <field name="tcp.ack" showname="Acknowledgment number: 133 (relative ack number)" size="4" pos="42" show="133" value="04f9c230"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:bc:5a:bb:70:a1" value="0101080a5abb70bc5abb70a1"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233532, TSecr 1522233505" size="10" pos="56" value="080a5abb70bc5abb70a1"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233532" size="4" pos="58" show="1522233532" value="5abb70bc"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233505" size="4" pos="62" show="1522233505" value="5abb70a1"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 13" size="0" pos="34" show="13"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.027511000 seconds" size="0" pos="34" show="0.027511000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000000000000400000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="15" showname="Number" value="f" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.382384000 JST" showname="Captured Time" value="1379477225.382384000" size="94"/> + </proto> + <proto name="frame" showname="Frame 15: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.382384000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.382384000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.382384000 seconds" size="0" pos="0" show="1379477225.382384000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.001530000 seconds" size="0" pos="0" show="0.001530000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.001530000 seconds" size="0" pos="0" show="0.001530000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.071662000 seconds" size="0" pos="0" show="0.071662000"/> + <field name="frame.number" showname="Frame Number: 15" size="0" pos="0" show="15"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xb1df (45535)" size="2" pos="18" show="0xb1df" value="b1df"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x8ac6 [correct]" size="2" pos="24" show="0x8ac6" value="8ac6"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="8ac6"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="8ac6"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55128 (55128), Seq: 133, Ack: 181, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55128 (55128)" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55128" hide="yes" size="2" pos="36" show="55128" value="d758"/> + <field name="tcp.stream" showname="Stream index: 0" size="0" pos="34" show="0"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 133 (relative sequence number)" size="4" pos="38" show="133" value="04f9c230"/> + <field name="tcp.nxtseq" showname="Next sequence number: 161 (relative sequence number)" size="0" pos="34" show="161"/> + <field name="tcp.ack" showname="Acknowledgment number: 181 (relative ack number)" size="4" pos="42" show="181" value="d4f33d39"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:be:5a:bb:70:bc" value="0101080a5abb70be5abb70bc"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233534, TSecr 1522233532" size="10" pos="56" value="080a5abb70be5abb70bc"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233534" size="4" pos="58" show="1522233534" value="5abb70be"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233532" size="4" pos="62" show="1522233532" value="5abb70bc"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 14" size="0" pos="34" show="14"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.001530000 seconds" size="0" pos="34" show="0.001530000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000010000000400000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="22" showname="Number" value="16" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.395339000 JST" showname="Captured Time" value="1379477225.395339000" size="94"/> + </proto> + <proto name="frame" showname="Frame 22: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.395339000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.395339000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.395339000 seconds" size="0" pos="0" show="1379477225.395339000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000330000 seconds" size="0" pos="0" show="0.000330000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.012955000 seconds" size="0" pos="0" show="0.012955000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.084617000 seconds" size="0" pos="0" show="0.084617000"/> + <field name="frame.number" showname="Frame Number: 22" size="0" pos="0" show="22"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xb5e8 (46568)" size="2" pos="18" show="0xb5e8" value="b5e8"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x86bd [correct]" size="2" pos="24" show="0x86bd" value="86bd"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="86bd"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="86bd"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55129 (55129), Dst Port: 16509 (16509), Seq: 1, Ack: 1, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55129 (55129)" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="903bc52d"/> + <field name="tcp.nxtseq" showname="Next sequence number: 29 (relative sequence number)" size="0" pos="34" show="29"/> + <field name="tcp.ack" showname="Acknowledgment number: 1 (relative ack number)" size="4" pos="42" show="1" value="4e0a7b43"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:cb:5a:bb:70:ca" value="0101080a5abb70cb5abb70ca"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233547, TSecr 1522233546" size="10" pos="56" value="080a5abb70cb5abb70ca"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233547" size="4" pos="58" show="1522233547" value="5abb70cb"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233546" size="4" pos="62" show="1522233546" value="5abb70ca"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000042000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="24" showname="Number" value="18" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.400143000 JST" showname="Captured Time" value="1379477225.400143000" size="102"/> + </proto> + <proto name="frame" showname="Frame 24: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.400143000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.400143000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.400143000 seconds" size="0" pos="0" show="1379477225.400143000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004796000 seconds" size="0" pos="0" show="0.004796000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004804000 seconds" size="0" pos="0" show="0.004804000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.089421000 seconds" size="0" pos="0" show="0.089421000"/> + <field name="frame.number" showname="Frame Number: 24" size="0" pos="0" show="24"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0x0b89 (2953)" size="2" pos="18" show="0x0b89" value="0b89"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x3115 [correct]" size="2" pos="24" show="0x3115" value="3115"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="3115"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="3115"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55129 (55129), Seq: 1, Ack: 29, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55129 (55129)" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="4e0a7b43"/> + <field name="tcp.nxtseq" showname="Next sequence number: 37 (relative sequence number)" size="0" pos="34" show="37"/> + <field name="tcp.ack" showname="Acknowledgment number: 29 (relative ack number)" size="4" pos="42" show="29" value="903bc549"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:d0:5a:bb:70:cb" value="0101080a5abb70d05abb70cb"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233552, TSecr 1522233547" size="10" pos="56" value="080a5abb70d05abb70cb"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233552" size="4" pos="58" show="1522233552" value="5abb70d0"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233547" size="4" pos="62" show="1522233547" value="5abb70cb"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000000420000000100000000000000000000000100000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_auth_list_ret" showname="remote_auth_list_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types" showname="types :: remote_auth_type&lt;1&gt;" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types.types" showname="types: REMOTE_AUTH_NONE(0)" size="4" pos="98" show="0" value="00000000"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="26" showname="Number" value="1a" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.400365000 JST" showname="Captured Time" value="1379477225.400365000" size="98"/> + </proto> + <proto name="frame" showname="Frame 26: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.400365000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.400365000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.400365000 seconds" size="0" pos="0" show="1379477225.400365000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000214000 seconds" size="0" pos="0" show="0.000214000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000222000 seconds" size="0" pos="0" show="0.000222000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.089643000 seconds" size="0" pos="0" show="0.089643000"/> + <field name="frame.number" showname="Frame Number: 26" size="0" pos="0" show="26"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xb5ea (46570)" size="2" pos="18" show="0xb5ea" value="b5ea"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x86b7 [correct]" size="2" pos="24" show="0x86b7" value="86b7"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="86b7"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="86b7"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55129 (55129), Dst Port: 16509 (16509), Seq: 29, Ack: 37, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55129 (55129)" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 29 (relative sequence number)" size="4" pos="38" show="29" value="903bc549"/> + <field name="tcp.nxtseq" showname="Next sequence number: 61 (relative sequence number)" size="0" pos="34" show="61"/> + <field name="tcp.ack" showname="Acknowledgment number: 37 (relative ack number)" size="4" pos="42" show="37" value="4e0a7b67"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:d0:5a:bb:70:d0" value="0101080a5abb70d05abb70d0"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233552, TSecr 1522233552" size="10" pos="56" value="080a5abb70d05abb70d0"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233552" size="4" pos="58" show="1522233552" value="5abb70d0"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233552" size="4" pos="62" show="1522233552" value="5abb70d0"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c0000000000000001000000000000000a"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 10" size="4" pos="94" show="10" value="0000000a"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="27" showname="Number" value="1b" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.404752000 JST" showname="Captured Time" value="1379477225.404752000" size="98"/> + </proto> + <proto name="frame" showname="Frame 27: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.404752000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.404752000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.404752000 seconds" size="0" pos="0" show="1379477225.404752000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004387000 seconds" size="0" pos="0" show="0.004387000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004387000 seconds" size="0" pos="0" show="0.004387000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.094030000 seconds" size="0" pos="0" show="0.094030000"/> + <field name="frame.number" showname="Frame Number: 27" size="0" pos="0" show="27"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0x0b8a (2954)" size="2" pos="18" show="0x0b8a" value="0b8a"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x3118 [correct]" size="2" pos="24" show="0x3118" value="3118"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="3118"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="3118"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55129 (55129), Seq: 37, Ack: 61, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55129 (55129)" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 37 (relative sequence number)" size="4" pos="38" show="37" value="4e0a7b67"/> + <field name="tcp.nxtseq" showname="Next sequence number: 69 (relative sequence number)" size="0" pos="34" show="69"/> + <field name="tcp.ack" showname="Acknowledgment number: 61 (relative ack number)" size="4" pos="42" show="61" value="903bc569"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:d4:5a:bb:70:d0" value="0101080a5abb70d45abb70d0"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233556, TSecr 1522233552" size="10" pos="56" value="080a5abb70d45abb70d0"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233556" size="4" pos="58" show="1522233556" value="5abb70d4"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233552" size="4" pos="62" show="1522233552" value="5abb70d0"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 26" size="0" pos="34" show="26"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004387000 seconds" size="0" pos="34" show="0.004387000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000010000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="122"> + <field name="num" pos="0" show="28" showname="Number" value="1c" size="122"/> + <field name="len" pos="0" show="122" showname="Frame Length" value="7a" size="122"/> + <field name="caplen" pos="0" show="122" showname="Captured Length" value="7a" size="122"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.405058000 JST" showname="Captured Time" value="1379477225.405058000" size="122"/> + </proto> + <proto name="frame" showname="Frame 28: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.405058000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.405058000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.405058000 seconds" size="0" pos="0" show="1379477225.405058000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000306000 seconds" size="0" pos="0" show="0.000306000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000306000 seconds" size="0" pos="0" show="0.000306000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.094336000 seconds" size="0" pos="0" show="0.094336000"/> + <field name="frame.number" showname="Frame Number: 28" size="0" pos="0" show="28"/> + <field name="frame.len" showname="Frame Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.cap_len" showname="Capture Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 108" size="2" pos="16" show="108" value="006c"/> + <field name="ip.id" showname="Identification: 0xb5eb (46571)" size="2" pos="18" show="0xb5eb" value="b5eb"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x869e [correct]" size="2" pos="24" show="0x869e" value="869e"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="869e"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="869e"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55129 (55129), Dst Port: 16509 (16509), Seq: 61, Ack: 69, Len: 56" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55129 (55129)" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 56" hide="yes" size="1" pos="46" show="56" value="80"/> + <field name="tcp.seq" showname="Sequence number: 61 (relative sequence number)" size="4" pos="38" show="61" value="903bc569"/> + <field name="tcp.nxtseq" showname="Next sequence number: 117 (relative sequence number)" size="0" pos="34" show="117"/> + <field name="tcp.ack" showname="Acknowledgment number: 69 (relative ack number)" size="4" pos="42" show="69" value="4e0a7b87"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe60 [validation disabled]" size="2" pos="50" show="0xfe60" value="fe60"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe60"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe60"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:d5:5a:bb:70:d4" value="0101080a5abb70d55abb70d4"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233557, TSecr 1522233556" size="10" pos="56" value="080a5abb70d55abb70d4"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233557" size="4" pos="58" show="1522233557" value="5abb70d5"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233556" size="4" pos="62" show="1522233556" value="5abb70d4"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 27" size="0" pos="34" show="27"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000306000 seconds" size="0" pos="34" show="0.000306000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 56" size="0" pos="34" show="56"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 56" size="56" pos="66" show="56" value="00000038200080860000000100000001000000000000000200000000000000010000000f71656d753a2f2f2f73657373696f6e0000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="56" pos="66"> + <field name="libvirt.length" showname="length: 56" size="4" pos="66" show="56" value="00000038"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_open_args" showname="remote_connect_open_args" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_open_args.name" showname="name: (null)" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_connect_open_args.flags" showname="flags: 15" size="4" pos="98" show="15" value="0000000f"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="29" showname="Number" value="1d" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.409810000 JST" showname="Captured Time" value="1379477225.409810000" size="94"/> + </proto> + <proto name="frame" showname="Frame 29: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.409810000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.409810000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.409810000 seconds" size="0" pos="0" show="1379477225.409810000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004752000 seconds" size="0" pos="0" show="0.004752000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004752000 seconds" size="0" pos="0" show="0.004752000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.099088000 seconds" size="0" pos="0" show="0.099088000"/> + <field name="frame.number" showname="Frame Number: 29" size="0" pos="0" show="29"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0x0b8b (2955)" size="2" pos="18" show="0x0b8b" value="0b8b"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x311b [correct]" size="2" pos="24" show="0x311b" value="311b"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="311b"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="311b"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55129 (55129), Seq: 69, Ack: 117, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55129 (55129)" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 69 (relative sequence number)" size="4" pos="38" show="69" value="4e0a7b87"/> + <field name="tcp.nxtseq" showname="Next sequence number: 97 (relative sequence number)" size="0" pos="34" show="97"/> + <field name="tcp.ack" showname="Acknowledgment number: 117 (relative ack number)" size="4" pos="42" show="117" value="903bc5a1"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:d9:5a:bb:70:d5" value="0101080a5abb70d95abb70d5"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233561, TSecr 1522233557" size="10" pos="56" value="080a5abb70d95abb70d5"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233561" size="4" pos="58" show="1522233561" value="5abb70d9"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233557" size="4" pos="62" show="1522233557" value="5abb70d5"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 28" size="0" pos="34" show="28"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004752000 seconds" size="0" pos="34" show="0.004752000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000001000000010000000200000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="30" showname="Number" value="1e" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.410298000 JST" showname="Captured Time" value="1379477225.410298000" size="106"/> + </proto> + <proto name="frame" showname="Frame 30: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.410298000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.410298000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.410298000 seconds" size="0" pos="0" show="1379477225.410298000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000488000 seconds" size="0" pos="0" show="0.000488000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000488000 seconds" size="0" pos="0" show="0.000488000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.099576000 seconds" size="0" pos="0" show="0.099576000"/> + <field name="frame.number" showname="Frame Number: 30" size="0" pos="0" show="30"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xb5ec (46572)" size="2" pos="18" show="0xb5ec" value="b5ec"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x86ad [correct]" size="2" pos="24" show="0x86ad" value="86ad"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="86ad"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="86ad"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55129 (55129), Dst Port: 16509 (16509), Seq: 117, Ack: 97, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55129 (55129)" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 117 (relative sequence number)" size="4" pos="38" show="117" value="903bc5a1"/> + <field name="tcp.nxtseq" showname="Next sequence number: 157 (relative sequence number)" size="0" pos="34" show="157"/> + <field name="tcp.ack" showname="Acknowledgment number: 97 (relative ack number)" size="4" pos="42" show="97" value="4e0a7ba3"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:da:5a:bb:70:d9" value="0101080a5abb70da5abb70d9"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233562, TSecr 1522233561" size="10" pos="56" value="080a5abb70da5abb70d9"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233562" size="4" pos="58" show="1522233562" value="5abb70da"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233561" size="4" pos="62" show="1522233561" value="5abb70d9"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 29" size="0" pos="34" show="29"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000488000 seconds" size="0" pos="34" show="0.000488000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="00000028200080860000000100000125000000000000000300000000000000010000000100000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: NODE_GET_CPU_MAP (293)" size="4" pos="78" show="293" value="00000125"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_args" showname="remote_node_get_cpu_map_args" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_node_get_cpu_map_args.need_map" showname="need_map: 1" size="4" pos="94" show="1" value="00000001"/> + <field name="libvirt.remote_node_get_cpu_map_args.need_online" showname="need_online: 1" size="4" pos="98" show="1" value="00000001"/> + <field name="libvirt.remote_node_get_cpu_map_args.flags" showname="flags: 0" size="4" pos="102" show="0" value="00000000"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="110"> + <field name="num" pos="0" show="31" showname="Number" value="1f" size="110"/> + <field name="len" pos="0" show="110" showname="Frame Length" value="6e" size="110"/> + <field name="caplen" pos="0" show="110" showname="Captured Length" value="6e" size="110"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.414526000 JST" showname="Captured Time" value="1379477225.414526000" size="110"/> + </proto> + <proto name="frame" showname="Frame 31: 110 bytes on wire (880 bits), 110 bytes captured (880 bits) on interface 0" size="110" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.414526000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.414526000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.414526000 seconds" size="0" pos="0" show="1379477225.414526000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004228000 seconds" size="0" pos="0" show="0.004228000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004228000 seconds" size="0" pos="0" show="0.004228000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.103804000 seconds" size="0" pos="0" show="0.103804000"/> + <field name="frame.number" showname="Frame Number: 31" size="0" pos="0" show="31"/> + <field name="frame.len" showname="Frame Length: 110 bytes (880 bits)" size="0" pos="0" show="110"/> + <field name="frame.cap_len" showname="Capture Length: 110 bytes (880 bits)" size="0" pos="0" show="110"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 96" size="2" pos="16" show="96" value="0060"/> + <field name="ip.id" showname="Identification: 0x0b8c (2956)" size="2" pos="18" show="0x0b8c" value="0b8c"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x310a [correct]" size="2" pos="24" show="0x310a" value="310a"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="310a"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="310a"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55129 (55129), Seq: 97, Ack: 157, Len: 44" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55129 (55129)" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 44" hide="yes" size="1" pos="46" show="44" value="80"/> + <field name="tcp.seq" showname="Sequence number: 97 (relative sequence number)" size="4" pos="38" show="97" value="4e0a7ba3"/> + <field name="tcp.nxtseq" showname="Next sequence number: 141 (relative sequence number)" size="0" pos="34" show="141"/> + <field name="tcp.ack" showname="Acknowledgment number: 157 (relative ack number)" size="4" pos="42" show="157" value="903bc5c9"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe54 [validation disabled]" size="2" pos="50" show="0xfe54" value="fe54"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe54"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe54"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:de:5a:bb:70:da" value="0101080a5abb70de5abb70da"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233566, TSecr 1522233562" size="10" pos="56" value="080a5abb70de5abb70da"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233566" size="4" pos="58" show="1522233566" value="5abb70de"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233562" size="4" pos="62" show="1522233562" value="5abb70da"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 30" size="0" pos="34" show="30"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004228000 seconds" size="0" pos="34" show="0.004228000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 44" size="0" pos="34" show="44"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 44" size="44" pos="66" show="44" value="0000002c20008086000000010000012500000001000000030000000000000001ff0000000000000800000008"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="44" pos="66"> + <field name="libvirt.length" showname="length: 44" size="4" pos="66" show="44" value="0000002c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: NODE_GET_CPU_MAP (293)" size="4" pos="78" show="293" value="00000125"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_ret" showname="remote_node_get_cpu_map_ret" size="16" pos="94" show="" value=""> + <field name="libvirt.remote_node_get_cpu_map_ret.cpumap" showname="cpumap: ff" size="8" pos="94" show="00:00:00:01:ff:00:00:00" value="00000001ff000000"/> + <field name="libvirt.remote_node_get_cpu_map_ret.online" showname="online: 8" size="4" pos="102" show="8" value="00000008"/> + <field name="libvirt.remote_node_get_cpu_map_ret.ret" showname="ret: 8" size="4" pos="106" show="8" value="00000008"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="32" showname="Number" value="20" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.414966000 JST" showname="Captured Time" value="1379477225.414966000" size="94"/> + </proto> + <proto name="frame" showname="Frame 32: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.414966000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.414966000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.414966000 seconds" size="0" pos="0" show="1379477225.414966000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000440000 seconds" size="0" pos="0" show="0.000440000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000440000 seconds" size="0" pos="0" show="0.000440000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.104244000 seconds" size="0" pos="0" show="0.104244000"/> + <field name="frame.number" showname="Frame Number: 32" size="0" pos="0" show="32"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xb5ed (46573)" size="2" pos="18" show="0xb5ed" value="b5ed"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x86b8 [correct]" size="2" pos="24" show="0x86b8" value="86b8"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="86b8"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="86b8"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55129 (55129), Dst Port: 16509 (16509), Seq: 157, Ack: 141, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55129 (55129)" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="34" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 157 (relative sequence number)" size="4" pos="38" show="157" value="903bc5c9"/> + <field name="tcp.nxtseq" showname="Next sequence number: 185 (relative sequence number)" size="0" pos="34" show="185"/> + <field name="tcp.ack" showname="Acknowledgment number: 141 (relative ack number)" size="4" pos="42" show="141" value="4e0a7bcf"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:de:5a:bb:70:de" value="0101080a5abb70de5abb70de"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233566, TSecr 1522233566" size="10" pos="56" value="080a5abb70de5abb70de"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233566" size="4" pos="58" show="1522233566" value="5abb70de"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233566" size="4" pos="62" show="1522233566" value="5abb70de"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 31" size="0" pos="34" show="31"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000440000 seconds" size="0" pos="34" show="0.000440000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000000000000400000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="33" showname="Number" value="21" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.419210000 JST" showname="Captured Time" value="1379477225.419210000" size="94"/> + </proto> + <proto name="frame" showname="Frame 33: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.419210000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.419210000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.419210000 seconds" size="0" pos="0" show="1379477225.419210000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004244000 seconds" size="0" pos="0" show="0.004244000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004244000 seconds" size="0" pos="0" show="0.004244000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.108488000 seconds" size="0" pos="0" show="0.108488000"/> + <field name="frame.number" showname="Frame Number: 33" size="0" pos="0" show="33"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0x0b8d (2957)" size="2" pos="18" show="0x0b8d" value="0b8d"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x3119 [correct]" size="2" pos="24" show="0x3119" value="3119"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="3119"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="3119"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55129 (55129), Seq: 141, Ack: 185, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55129 (55129)" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55129" hide="yes" size="2" pos="36" show="55129" value="d759"/> + <field name="tcp.stream" showname="Stream index: 1" size="0" pos="34" show="1"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 141 (relative sequence number)" size="4" pos="38" show="141" value="4e0a7bcf"/> + <field name="tcp.nxtseq" showname="Next sequence number: 169 (relative sequence number)" size="0" pos="34" show="169"/> + <field name="tcp.ack" showname="Acknowledgment number: 185 (relative ack number)" size="4" pos="42" show="185" value="903bc5e5"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:e3:5a:bb:70:de" value="0101080a5abb70e35abb70de"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233571, TSecr 1522233566" size="10" pos="56" value="080a5abb70e35abb70de"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233571" size="4" pos="58" show="1522233571" value="5abb70e3"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233566" size="4" pos="62" show="1522233566" value="5abb70de"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 32" size="0" pos="34" show="32"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004244000 seconds" size="0" pos="34" show="0.004244000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000010000000400000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="40" showname="Number" value="28" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.431889000 JST" showname="Captured Time" value="1379477225.431889000" size="94"/> + </proto> + <proto name="frame" showname="Frame 40: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.431889000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.431889000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.431889000 seconds" size="0" pos="0" show="1379477225.431889000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000298000 seconds" size="0" pos="0" show="0.000298000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.012679000 seconds" size="0" pos="0" show="0.012679000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.121167000 seconds" size="0" pos="0" show="0.121167000"/> + <field name="frame.number" showname="Frame Number: 40" size="0" pos="0" show="40"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xe824 (59428)" size="2" pos="18" show="0xe824" value="e824"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5481 [correct]" size="2" pos="24" show="0x5481" value="5481"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5481"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5481"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 1, Ack: 1, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="0cb698ce"/> + <field name="tcp.nxtseq" showname="Next sequence number: 29 (relative sequence number)" size="0" pos="34" show="29"/> + <field name="tcp.ack" showname="Acknowledgment number: 1 (relative ack number)" size="4" pos="42" show="1" value="ff63beb8"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:ef:5a:bb:70:ef" value="0101080a5abb70ef5abb70ef"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233583, TSecr 1522233583" size="10" pos="56" value="080a5abb70ef5abb70ef"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233583" size="4" pos="58" show="1522233583" value="5abb70ef"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233583" size="4" pos="62" show="1522233583" value="5abb70ef"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000042000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="42" showname="Number" value="2a" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.434102000 JST" showname="Captured Time" value="1379477225.434102000" size="102"/> + </proto> + <proto name="frame" showname="Frame 42: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.434102000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.434102000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.434102000 seconds" size="0" pos="0" show="1379477225.434102000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.002206000 seconds" size="0" pos="0" show="0.002206000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.002213000 seconds" size="0" pos="0" show="0.002213000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.123380000 seconds" size="0" pos="0" show="0.123380000"/> + <field name="frame.number" showname="Frame Number: 42" size="0" pos="0" show="42"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0xce58 (52824)" size="2" pos="18" show="0xce58" value="ce58"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e45 [correct]" size="2" pos="24" show="0x6e45" value="6e45"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e45"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e45"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 1, Ack: 29, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="ff63beb8"/> + <field name="tcp.nxtseq" showname="Next sequence number: 37 (relative sequence number)" size="0" pos="34" show="37"/> + <field name="tcp.ack" showname="Acknowledgment number: 29 (relative ack number)" size="4" pos="42" show="29" value="0cb698ea"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:f2:5a:bb:70:ef" value="0101080a5abb70f25abb70ef"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233586, TSecr 1522233583" size="10" pos="56" value="080a5abb70f25abb70ef"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233586" size="4" pos="58" show="1522233586" value="5abb70f2"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233583" size="4" pos="62" show="1522233583" value="5abb70ef"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000000420000000100000000000000000000000100000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_auth_list_ret" showname="remote_auth_list_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types" showname="types :: remote_auth_type&lt;1&gt;" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types.types" showname="types: REMOTE_AUTH_NONE(0)" size="4" pos="98" show="0" value="00000000"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="44" showname="Number" value="2c" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.434243000 JST" showname="Captured Time" value="1379477225.434243000" size="98"/> + </proto> + <proto name="frame" showname="Frame 44: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.434243000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.434243000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.434243000 seconds" size="0" pos="0" show="1379477225.434243000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000133000 seconds" size="0" pos="0" show="0.000133000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000141000 seconds" size="0" pos="0" show="0.000141000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.123521000 seconds" size="0" pos="0" show="0.123521000"/> + <field name="frame.number" showname="Frame Number: 44" size="0" pos="0" show="44"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xe826 (59430)" size="2" pos="18" show="0xe826" value="e826"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x547b [correct]" size="2" pos="24" show="0x547b" value="547b"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="547b"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="547b"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 29, Ack: 37, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 29 (relative sequence number)" size="4" pos="38" show="29" value="0cb698ea"/> + <field name="tcp.nxtseq" showname="Next sequence number: 61 (relative sequence number)" size="0" pos="34" show="61"/> + <field name="tcp.ack" showname="Acknowledgment number: 37 (relative ack number)" size="4" pos="42" show="37" value="ff63bedc"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:f2:5a:bb:70:f2" value="0101080a5abb70f25abb70f2"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233586, TSecr 1522233586" size="10" pos="56" value="080a5abb70f25abb70f2"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233586" size="4" pos="58" show="1522233586" value="5abb70f2"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233586" size="4" pos="62" show="1522233586" value="5abb70f2"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c0000000000000001000000000000000a"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 10" size="4" pos="94" show="10" value="0000000a"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="45" showname="Number" value="2d" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.438638000 JST" showname="Captured Time" value="1379477225.438638000" size="98"/> + </proto> + <proto name="frame" showname="Frame 45: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.438638000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.438638000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.438638000 seconds" size="0" pos="0" show="1379477225.438638000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004395000 seconds" size="0" pos="0" show="0.004395000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004395000 seconds" size="0" pos="0" show="0.004395000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.127916000 seconds" size="0" pos="0" show="0.127916000"/> + <field name="frame.number" showname="Frame Number: 45" size="0" pos="0" show="45"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xce59 (52825)" size="2" pos="18" show="0xce59" value="ce59"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e48 [correct]" size="2" pos="24" show="0x6e48" value="6e48"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e48"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e48"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 37, Ack: 61, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 37 (relative sequence number)" size="4" pos="38" show="37" value="ff63bedc"/> + <field name="tcp.nxtseq" showname="Next sequence number: 69 (relative sequence number)" size="0" pos="34" show="69"/> + <field name="tcp.ack" showname="Acknowledgment number: 61 (relative ack number)" size="4" pos="42" show="61" value="0cb6990a"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:f6:5a:bb:70:f2" value="0101080a5abb70f65abb70f2"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233590, TSecr 1522233586" size="10" pos="56" value="080a5abb70f65abb70f2"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233590" size="4" pos="58" show="1522233590" value="5abb70f6"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233586" size="4" pos="62" show="1522233586" value="5abb70f2"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 44" size="0" pos="34" show="44"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004395000 seconds" size="0" pos="34" show="0.004395000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000010000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="122"> + <field name="num" pos="0" show="46" showname="Number" value="2e" size="122"/> + <field name="len" pos="0" show="122" showname="Frame Length" value="7a" size="122"/> + <field name="caplen" pos="0" show="122" showname="Captured Length" value="7a" size="122"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.438946000 JST" showname="Captured Time" value="1379477225.438946000" size="122"/> + </proto> + <proto name="frame" showname="Frame 46: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.438946000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.438946000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.438946000 seconds" size="0" pos="0" show="1379477225.438946000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000308000 seconds" size="0" pos="0" show="0.000308000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000308000 seconds" size="0" pos="0" show="0.000308000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.128224000 seconds" size="0" pos="0" show="0.128224000"/> + <field name="frame.number" showname="Frame Number: 46" size="0" pos="0" show="46"/> + <field name="frame.len" showname="Frame Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.cap_len" showname="Capture Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 108" size="2" pos="16" show="108" value="006c"/> + <field name="ip.id" showname="Identification: 0xe827 (59431)" size="2" pos="18" show="0xe827" value="e827"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5462 [correct]" size="2" pos="24" show="0x5462" value="5462"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5462"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5462"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 61, Ack: 69, Len: 56" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 56" hide="yes" size="1" pos="46" show="56" value="80"/> + <field name="tcp.seq" showname="Sequence number: 61 (relative sequence number)" size="4" pos="38" show="61" value="0cb6990a"/> + <field name="tcp.nxtseq" showname="Next sequence number: 117 (relative sequence number)" size="0" pos="34" show="117"/> + <field name="tcp.ack" showname="Acknowledgment number: 69 (relative ack number)" size="4" pos="42" show="69" value="ff63befc"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe60 [validation disabled]" size="2" pos="50" show="0xfe60" value="fe60"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe60"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe60"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:f6:5a:bb:70:f6" value="0101080a5abb70f65abb70f6"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233590, TSecr 1522233590" size="10" pos="56" value="080a5abb70f65abb70f6"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233590" size="4" pos="58" show="1522233590" value="5abb70f6"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233590" size="4" pos="62" show="1522233590" value="5abb70f6"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 45" size="0" pos="34" show="45"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000308000 seconds" size="0" pos="34" show="0.000308000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 56" size="0" pos="34" show="56"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 56" size="56" pos="66" show="56" value="00000038200080860000000100000001000000000000000200000000000000010000000f71656d753a2f2f2f73657373696f6e0000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="56" pos="66"> + <field name="libvirt.length" showname="length: 56" size="4" pos="66" show="56" value="00000038"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_open_args" showname="remote_connect_open_args" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_open_args.name" showname="name: (null)" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_connect_open_args.flags" showname="flags: 15" size="4" pos="98" show="15" value="0000000f"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="47" showname="Number" value="2f" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.444153000 JST" showname="Captured Time" value="1379477225.444153000" size="94"/> + </proto> + <proto name="frame" showname="Frame 47: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.444153000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.444153000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.444153000 seconds" size="0" pos="0" show="1379477225.444153000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.005207000 seconds" size="0" pos="0" show="0.005207000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.005207000 seconds" size="0" pos="0" show="0.005207000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.133431000 seconds" size="0" pos="0" show="0.133431000"/> + <field name="frame.number" showname="Frame Number: 47" size="0" pos="0" show="47"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xce5a (52826)" size="2" pos="18" show="0xce5a" value="ce5a"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e4b [correct]" size="2" pos="24" show="0x6e4b" value="6e4b"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e4b"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e4b"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 69, Ack: 117, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 69 (relative sequence number)" size="4" pos="38" show="69" value="ff63befc"/> + <field name="tcp.nxtseq" showname="Next sequence number: 97 (relative sequence number)" size="0" pos="34" show="97"/> + <field name="tcp.ack" showname="Acknowledgment number: 117 (relative ack number)" size="4" pos="42" show="117" value="0cb69942"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:70:fc:5a:bb:70:f6" value="0101080a5abb70fc5abb70f6"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233596, TSecr 1522233590" size="10" pos="56" value="080a5abb70fc5abb70f6"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233596" size="4" pos="58" show="1522233596" value="5abb70fc"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233590" size="4" pos="62" show="1522233590" value="5abb70f6"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 46" size="0" pos="34" show="46"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.005207000 seconds" size="0" pos="34" show="0.005207000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000001000000010000000200000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="48" showname="Number" value="30" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.457730000 JST" showname="Captured Time" value="1379477225.457730000" size="106"/> + </proto> + <proto name="frame" showname="Frame 48: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.457730000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.457730000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.457730000 seconds" size="0" pos="0" show="1379477225.457730000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.013577000 seconds" size="0" pos="0" show="0.013577000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.013577000 seconds" size="0" pos="0" show="0.013577000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.147008000 seconds" size="0" pos="0" show="0.147008000"/> + <field name="frame.number" showname="Frame Number: 48" size="0" pos="0" show="48"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xe828 (59432)" size="2" pos="18" show="0xe828" value="e828"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5471 [correct]" size="2" pos="24" show="0x5471" value="5471"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5471"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5471"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 117, Ack: 97, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 117 (relative sequence number)" size="4" pos="38" show="117" value="0cb69942"/> + <field name="tcp.nxtseq" showname="Next sequence number: 157 (relative sequence number)" size="0" pos="34" show="157"/> + <field name="tcp.ack" showname="Acknowledgment number: 97 (relative ack number)" size="4" pos="42" show="97" value="ff63bf18"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:09:5a:bb:70:fc" value="0101080a5abb71095abb70fc"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233609, TSecr 1522233596" size="10" pos="56" value="080a5abb71095abb70fc"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233609" size="4" pos="58" show="1522233609" value="5abb7109"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233596" size="4" pos="62" show="1522233596" value="5abb70fc"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 47" size="0" pos="34" show="47"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.013577000 seconds" size="0" pos="34" show="0.013577000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="0000002820008086000000010000001700000000000000030000000000000007646f6d61696e3100"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_LOOKUP_BY_NAME (23)" size="4" pos="78" show="23" value="00000017"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_lookup_by_name_args" showname="remote_domain_lookup_by_name_args" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_domain_lookup_by_name_args.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="126"> + <field name="num" pos="0" show="49" showname="Number" value="31" size="126"/> + <field name="len" pos="0" show="126" showname="Frame Length" value="7e" size="126"/> + <field name="caplen" pos="0" show="126" showname="Captured Length" value="7e" size="126"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.459820000 JST" showname="Captured Time" value="1379477225.459820000" size="126"/> + </proto> + <proto name="frame" showname="Frame 49: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0" size="126" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.459820000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.459820000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.459820000 seconds" size="0" pos="0" show="1379477225.459820000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.002090000 seconds" size="0" pos="0" show="0.002090000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.002090000 seconds" size="0" pos="0" show="0.002090000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.149098000 seconds" size="0" pos="0" show="0.149098000"/> + <field name="frame.number" showname="Frame Number: 49" size="0" pos="0" show="49"/> + <field name="frame.len" showname="Frame Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.cap_len" showname="Capture Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 112" size="2" pos="16" show="112" value="0070"/> + <field name="ip.id" showname="Identification: 0xce5b (52827)" size="2" pos="18" show="0xce5b" value="ce5b"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e2a [correct]" size="2" pos="24" show="0x6e2a" value="6e2a"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e2a"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e2a"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 97, Ack: 157, Len: 60" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 60" hide="yes" size="1" pos="46" show="60" value="80"/> + <field name="tcp.seq" showname="Sequence number: 97 (relative sequence number)" size="4" pos="38" show="97" value="ff63bf18"/> + <field name="tcp.nxtseq" showname="Next sequence number: 157 (relative sequence number)" size="0" pos="34" show="157"/> + <field name="tcp.ack" showname="Acknowledgment number: 157 (relative ack number)" size="4" pos="42" show="157" value="0cb6996a"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe64 [validation disabled]" size="2" pos="50" show="0xfe64" value="fe64"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe64"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe64"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:0b:5a:bb:71:09" value="0101080a5abb710b5abb7109"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233611, TSecr 1522233609" size="10" pos="56" value="080a5abb710b5abb7109"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233611" size="4" pos="58" show="1522233611" value="5abb710b"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233609" size="4" pos="62" show="1522233609" value="5abb7109"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 48" size="0" pos="34" show="48"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.002090000 seconds" size="0" pos="34" show="0.002090000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 60" size="0" pos="34" show="60"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 60" size="60" pos="66" show="60" value="0000003c20008086000000010000001700000001000000030000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="60" pos="66"> + <field name="libvirt.length" showname="length: 60" size="4" pos="66" show="60" value="0000003c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_LOOKUP_BY_NAME (23)" size="4" pos="78" show="23" value="00000017"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_lookup_by_name_ret" showname="remote_domain_lookup_by_name_ret" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_domain_lookup_by_name_ret.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="50" showname="Number" value="32" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.460059000 JST" showname="Captured Time" value="1379477225.460059000" size="106"/> + </proto> + <proto name="frame" showname="Frame 50: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.460059000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.460059000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.460059000 seconds" size="0" pos="0" show="1379477225.460059000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000239000 seconds" size="0" pos="0" show="0.000239000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000239000 seconds" size="0" pos="0" show="0.000239000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.149337000 seconds" size="0" pos="0" show="0.149337000"/> + <field name="frame.number" showname="Frame Number: 50" size="0" pos="0" show="50"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xe829 (59433)" size="2" pos="18" show="0xe829" value="e829"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5470 [correct]" size="2" pos="24" show="0x5470" value="5470"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5470"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5470"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 157, Ack: 157, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 157 (relative sequence number)" size="4" pos="38" show="157" value="0cb6996a"/> + <field name="tcp.nxtseq" showname="Next sequence number: 197 (relative sequence number)" size="0" pos="34" show="197"/> + <field name="tcp.ack" showname="Acknowledgment number: 157 (relative ack number)" size="4" pos="42" show="157" value="ff63bf54"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:0c:5a:bb:71:0b" value="0101080a5abb710c5abb710b"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233612, TSecr 1522233611" size="10" pos="56" value="080a5abb710c5abb710b"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233612" size="4" pos="58" show="1522233612" value="5abb710c"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233611" size="4" pos="62" show="1522233611" value="5abb710b"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 49" size="0" pos="34" show="49"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000239000 seconds" size="0" pos="34" show="0.000239000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="00000028200080860000000100000125000000000000000400000000000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: NODE_GET_CPU_MAP (293)" size="4" pos="78" show="293" value="00000125"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_args" showname="remote_node_get_cpu_map_args" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_node_get_cpu_map_args.need_map" showname="need_map: 0" size="4" pos="94" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_args.need_online" showname="need_online: 0" size="4" pos="98" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_args.flags" showname="flags: 0" size="4" pos="102" show="0" value="00000000"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="51" showname="Number" value="33" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.464280000 JST" showname="Captured Time" value="1379477225.464280000" size="106"/> + </proto> + <proto name="frame" showname="Frame 51: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.464280000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.464280000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.464280000 seconds" size="0" pos="0" show="1379477225.464280000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004221000 seconds" size="0" pos="0" show="0.004221000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004221000 seconds" size="0" pos="0" show="0.004221000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.153558000 seconds" size="0" pos="0" show="0.153558000"/> + <field name="frame.number" showname="Frame Number: 51" size="0" pos="0" show="51"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xce5c (52828)" size="2" pos="18" show="0xce5c" value="ce5c"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e3d [correct]" size="2" pos="24" show="0x6e3d" value="6e3d"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e3d"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e3d"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 157, Ack: 197, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 157 (relative sequence number)" size="4" pos="38" show="157" value="ff63bf54"/> + <field name="tcp.nxtseq" showname="Next sequence number: 197 (relative sequence number)" size="0" pos="34" show="197"/> + <field name="tcp.ack" showname="Acknowledgment number: 197 (relative ack number)" size="4" pos="42" show="197" value="0cb69992"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:10:5a:bb:71:0c" value="0101080a5abb71105abb710c"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233616, TSecr 1522233612" size="10" pos="56" value="080a5abb71105abb710c"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233616" size="4" pos="58" show="1522233616" value="5abb7110"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233612" size="4" pos="62" show="1522233612" value="5abb710c"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 50" size="0" pos="34" show="50"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004221000 seconds" size="0" pos="34" show="0.004221000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="00000028200080860000000100000125000000010000000400000000000000000000000000000008"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: NODE_GET_CPU_MAP (293)" size="4" pos="78" show="293" value="00000125"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_ret" showname="remote_node_get_cpu_map_ret" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_node_get_cpu_map_ret.cpumap" showname="cpumap: " size="4" pos="94" show="00:00:00:00" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_ret.online" showname="online: 0" size="4" pos="98" show="0" value="00000000"/> + <field name="libvirt.remote_node_get_cpu_map_ret.ret" showname="ret: 8" size="4" pos="102" show="8" value="00000008"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="126"> + <field name="num" pos="0" show="52" showname="Number" value="34" size="126"/> + <field name="len" pos="0" show="126" showname="Frame Length" value="7e" size="126"/> + <field name="caplen" pos="0" show="126" showname="Captured Length" value="7e" size="126"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.473575000 JST" showname="Captured Time" value="1379477225.473575000" size="126"/> + </proto> + <proto name="frame" showname="Frame 52: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0" size="126" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.473575000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.473575000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.473575000 seconds" size="0" pos="0" show="1379477225.473575000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.009295000 seconds" size="0" pos="0" show="0.009295000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.009295000 seconds" size="0" pos="0" show="0.009295000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.162853000 seconds" size="0" pos="0" show="0.162853000"/> + <field name="frame.number" showname="Frame Number: 52" size="0" pos="0" show="52"/> + <field name="frame.len" showname="Frame Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.cap_len" showname="Capture Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 112" size="2" pos="16" show="112" value="0070"/> + <field name="ip.id" showname="Identification: 0xe82a (59434)" size="2" pos="18" show="0xe82a" value="e82a"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x545b [correct]" size="2" pos="24" show="0x545b" value="545b"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="545b"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="545b"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 197, Ack: 197, Len: 60" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 60" hide="yes" size="1" pos="46" show="60" value="80"/> + <field name="tcp.seq" showname="Sequence number: 197 (relative sequence number)" size="4" pos="38" show="197" value="0cb69992"/> + <field name="tcp.nxtseq" showname="Next sequence number: 257 (relative sequence number)" size="0" pos="34" show="257"/> + <field name="tcp.ack" showname="Acknowledgment number: 197 (relative ack number)" size="4" pos="42" show="197" value="ff63bf7c"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe64 [validation disabled]" size="2" pos="50" show="0xfe64" value="fe64"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe64"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe64"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:19:5a:bb:71:10" value="0101080a5abb71195abb7110"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233625, TSecr 1522233616" size="10" pos="56" value="080a5abb71195abb7110"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233625" size="4" pos="58" show="1522233625" value="5abb7119"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233616" size="4" pos="62" show="1522233616" value="5abb7110"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 51" size="0" pos="34" show="51"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.009295000 seconds" size="0" pos="34" show="0.009295000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 60" size="0" pos="34" show="60"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 60" size="60" pos="66" show="60" value="0000003c20008086000000010000001000000000000000050000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="60" pos="66"> + <field name="libvirt.length" showname="length: 60" size="4" pos="66" show="60" value="0000003c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_INFO (16)" size="4" pos="78" show="16" value="00000010"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 5" size="4" pos="86" show="5" value="00000005"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_info_args" showname="remote_domain_get_info_args" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_info_args.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="126"> + <field name="num" pos="0" show="53" showname="Number" value="35" size="126"/> + <field name="len" pos="0" show="126" showname="Frame Length" value="7e" size="126"/> + <field name="caplen" pos="0" show="126" showname="Captured Length" value="7e" size="126"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.475229000 JST" showname="Captured Time" value="1379477225.475229000" size="126"/> + </proto> + <proto name="frame" showname="Frame 53: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0" size="126" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.475229000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.475229000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.475229000 seconds" size="0" pos="0" show="1379477225.475229000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.001654000 seconds" size="0" pos="0" show="0.001654000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.001654000 seconds" size="0" pos="0" show="0.001654000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.164507000 seconds" size="0" pos="0" show="0.164507000"/> + <field name="frame.number" showname="Frame Number: 53" size="0" pos="0" show="53"/> + <field name="frame.len" showname="Frame Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.cap_len" showname="Capture Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 112" size="2" pos="16" show="112" value="0070"/> + <field name="ip.id" showname="Identification: 0xce5d (52829)" size="2" pos="18" show="0xce5d" value="ce5d"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e28 [correct]" size="2" pos="24" show="0x6e28" value="6e28"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e28"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e28"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 197, Ack: 257, Len: 60" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 60" hide="yes" size="1" pos="46" show="60" value="80"/> + <field name="tcp.seq" showname="Sequence number: 197 (relative sequence number)" size="4" pos="38" show="197" value="ff63bf7c"/> + <field name="tcp.nxtseq" showname="Next sequence number: 257 (relative sequence number)" size="0" pos="34" show="257"/> + <field name="tcp.ack" showname="Acknowledgment number: 257 (relative ack number)" size="4" pos="42" show="257" value="0cb699ce"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe64 [validation disabled]" size="2" pos="50" show="0xfe64" value="fe64"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe64"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe64"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:1b:5a:bb:71:19" value="0101080a5abb711b5abb7119"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233627, TSecr 1522233625" size="10" pos="56" value="080a5abb711b5abb7119"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233627" size="4" pos="58" show="1522233627" value="5abb711b"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233625" size="4" pos="62" show="1522233625" value="5abb7119"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 52" size="0" pos="34" show="52"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.001654000 seconds" size="0" pos="34" show="0.001654000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 60" size="0" pos="34" show="60"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 60" size="60" pos="66" show="60" value="0000003c2000808600000001000000100000000100000005000000000000000500000000000800000000000000080000000000010000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="60" pos="66"> + <field name="libvirt.length" showname="length: 60" size="4" pos="66" show="60" value="0000003c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_INFO (16)" size="4" pos="78" show="16" value="00000010"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 5" size="4" pos="86" show="5" value="00000005"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_info_ret" showname="remote_domain_get_info_ret" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_info_ret.state" showname="state: 5" size="4" pos="94" show="5" value="00000005"/> + <field name="libvirt.remote_domain_get_info_ret.maxMem" showname="maxMem: 524288" size="8" pos="98" show="524288" value="0000000000080000"/> + <field name="libvirt.remote_domain_get_info_ret.memory" showname="memory: 524288" size="8" pos="106" show="524288" value="0000000000080000"/> + <field name="libvirt.remote_domain_get_info_ret.nrVirtCpu" showname="nrVirtCpu: 1" size="4" pos="114" show="1" value="00000001"/> + <field name="libvirt.remote_domain_get_info_ret.cpuTime" showname="cpuTime: 0" size="8" pos="118" show="0" value="0000000000000000"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="134"> + <field name="num" pos="0" show="54" showname="Number" value="36" size="134"/> + <field name="len" pos="0" show="134" showname="Frame Length" value="86" size="134"/> + <field name="caplen" pos="0" show="134" showname="Captured Length" value="86" size="134"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.475853000 JST" showname="Captured Time" value="1379477225.475853000" size="134"/> + </proto> + <proto name="frame" showname="Frame 54: 134 bytes on wire (1072 bits), 134 bytes captured (1072 bits) on interface 0" size="134" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.475853000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.475853000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.475853000 seconds" size="0" pos="0" show="1379477225.475853000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000624000 seconds" size="0" pos="0" show="0.000624000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000624000 seconds" size="0" pos="0" show="0.000624000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.165131000 seconds" size="0" pos="0" show="0.165131000"/> + <field name="frame.number" showname="Frame Number: 54" size="0" pos="0" show="54"/> + <field name="frame.len" showname="Frame Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.cap_len" showname="Capture Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 120" size="2" pos="16" show="120" value="0078"/> + <field name="ip.id" showname="Identification: 0xe82b (59435)" size="2" pos="18" show="0xe82b" value="e82b"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5452 [correct]" size="2" pos="24" show="0x5452" value="5452"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5452"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5452"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 257, Ack: 257, Len: 68" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 68" hide="yes" size="1" pos="46" show="68" value="80"/> + <field name="tcp.seq" showname="Sequence number: 257 (relative sequence number)" size="4" pos="38" show="257" value="0cb699ce"/> + <field name="tcp.nxtseq" showname="Next sequence number: 325 (relative sequence number)" size="0" pos="34" show="325"/> + <field name="tcp.ack" showname="Acknowledgment number: 257 (relative ack number)" size="4" pos="42" show="257" value="ff63bfb8"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe6c [validation disabled]" size="2" pos="50" show="0xfe6c" value="fe6c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:1b:5a:bb:71:1b" value="0101080a5abb711b5abb711b"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233627, TSecr 1522233627" size="10" pos="56" value="080a5abb711b5abb711b"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233627" size="4" pos="58" show="1522233627" value="5abb711b"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233627" size="4" pos="62" show="1522233627" value="5abb711b"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 53" size="0" pos="34" show="53"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000624000 seconds" size="0" pos="34" show="0.000624000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 68" size="0" pos="34" show="68"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 68" size="68" pos="66" show="68" value="0000004420008086000000010000001400000000000000060000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff0000000100000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="68" pos="66"> + <field name="libvirt.length" showname="length: 68" size="4" pos="66" show="68" value="00000044"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_VCPUS (20)" size="4" pos="78" show="20" value="00000014"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 6" size="4" pos="86" show="6" value="00000006"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_vcpus_args" showname="remote_domain_get_vcpus_args" size="40" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_vcpus_args.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + <field name="libvirt.remote_domain_get_vcpus_args.maxinfo" showname="maxinfo: 1" size="4" pos="126" show="1" value="00000001"/> + <field name="libvirt.remote_domain_get_vcpus_args.maplen" showname="maplen: 1" size="4" pos="130" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="426"> + <field name="num" pos="0" show="55" showname="Number" value="37" size="426"/> + <field name="len" pos="0" show="426" showname="Frame Length" value="1aa" size="426"/> + <field name="caplen" pos="0" show="426" showname="Captured Length" value="1aa" size="426"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.480977000 JST" showname="Captured Time" value="1379477225.480977000" size="426"/> + </proto> + <proto name="frame" showname="Frame 55: 426 bytes on wire (3408 bits), 426 bytes captured (3408 bits) on interface 0" size="426" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.480977000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.480977000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.480977000 seconds" size="0" pos="0" show="1379477225.480977000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.005124000 seconds" size="0" pos="0" show="0.005124000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.005124000 seconds" size="0" pos="0" show="0.005124000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.170255000 seconds" size="0" pos="0" show="0.170255000"/> + <field name="frame.number" showname="Frame Number: 55" size="0" pos="0" show="55"/> + <field name="frame.len" showname="Frame Length: 426 bytes (3408 bits)" size="0" pos="0" show="426"/> + <field name="frame.cap_len" showname="Capture Length: 426 bytes (3408 bits)" size="0" pos="0" show="426"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 412" size="2" pos="16" show="412" value="019c"/> + <field name="ip.id" showname="Identification: 0xce5e (52830)" size="2" pos="18" show="0xce5e" value="ce5e"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6cfb [correct]" size="2" pos="24" show="0x6cfb" value="6cfb"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6cfb"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6cfb"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 257, Ack: 325, Len: 360" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 360" hide="yes" size="1" pos="46" show="360" value="80"/> + <field name="tcp.seq" showname="Sequence number: 257 (relative sequence number)" size="4" pos="38" show="257" value="ff63bfb8"/> + <field name="tcp.nxtseq" showname="Next sequence number: 617 (relative sequence number)" size="0" pos="34" show="617"/> + <field name="tcp.ack" showname="Acknowledgment number: 325 (relative ack number)" size="4" pos="42" show="325" value="0cb69a12"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xff90 [validation disabled]" size="2" pos="50" show="0xff90" value="ff90"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="ff90"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="ff90"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:20:5a:bb:71:1b" value="0101080a5abb71205abb711b"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233632, TSecr 1522233627" size="10" pos="56" value="080a5abb71205abb711b"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233632" size="4" pos="58" show="1522233632" value="5abb7120"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233627" size="4" pos="62" show="1522233627" value="5abb711b"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 54" size="0" pos="34" show="54"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.005124000 seconds" size="0" pos="34" show="0.005124000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 360" size="0" pos="34" show="360"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 360" size="360" pos="66" show="360" value="00000168200080860000000100000014000000010000000600000001000000370000000a0000000100000088e8a681e6b182e38195e3828ce3819fe6938de4bd9ce381afe69c89e58ab9e381a7e381afe38182e3828ae381bee3819be382933a20e4bc91e6ada2e78ab6e6858be381aee38389e383a1e382a4e383b3e381aee4bbaee683b32043505520e38394e3838be383b3e382b0e38292e4b880e8a6a7e8a1a8e7a4bae381a7e3818de381bee3819be3829300000002000000000000000100000037e8a681e6b182e38195e3828ce3819fe6938de4bd9ce381afe69c89e58ab9e381a7e381afe38182e3828ae381bee3819be382933a202573000000000100000053e4bc91e6ada2e78ab6e6858be381aee38389e383a1e382a4e383b3e381aee4bbaee683b32043505520e38394e3838be383b3e382b0e38292e4b880e8a6a7e8a1a8e7a4bae381a7e3818de381bee3819be382930000000000ffffffffffffffff00000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="360" pos="66"> + <field name="libvirt.length" showname="length: 360" size="4" pos="66" show="360" value="00000168"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_VCPUS (20)" size="4" pos="78" show="20" value="00000014"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 6" size="4" pos="86" show="6" value="00000006"/> + <field name="libvirt.status" showname="status: ERROR (1)" size="4" pos="90" show="1" value="00000001"/> + <field name="libvirt.remote_error" showname="remote_error" size="44" pos="94" show="" value=""> + <field name="libvirt.remote_error.code" showname="code: 55" size="4" pos="94" show="55" value="00000037"/> + <field name="libvirt.remote_error.domain" showname="domain: 10" size="4" pos="98" show="10" value="0000000a"/> + <field name="libvirt.remote_error.message" showname="message: (null)" size="4" pos="102" show="" value=""/> + <field name="libvirt.remote_error.level" showname="level: 136" size="4" pos="106" show="136" value="00000088"/> + <field name="libvirt.remote_error.dom" showname="dom: (null)" size="4" pos="110" show="" value=""/> + <field name="libvirt.remote_error.str1" showname="str1: (null)" size="4" pos="114" show="" value=""/> + <field name="libvirt.remote_error.str2" showname="str2: (null)" size="4" pos="118" show="" value=""/> + <field name="libvirt.remote_error.str3" showname="str3: (null)" size="4" pos="122" show="" value=""/> + <field name="libvirt.remote_error.int1" showname="int1: -1819417411" size="4" pos="126" show="-1819417411" value="938de4bd"/> + <field name="libvirt.remote_error.int2" showname="int2: -1662811729" size="4" pos="130" show="-1662811729" value="9ce381af"/> + <field name="libvirt.remote_error.net" showname="net: (null)" size="4" pos="134" show="" value=""/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="138"> + <field name="num" pos="0" show="56" showname="Number" value="38" size="138"/> + <field name="len" pos="0" show="138" showname="Frame Length" value="8a" size="138"/> + <field name="caplen" pos="0" show="138" showname="Captured Length" value="8a" size="138"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.481283000 JST" showname="Captured Time" value="1379477225.481283000" size="138"/> + </proto> + <proto name="frame" showname="Frame 56: 138 bytes on wire (1104 bits), 138 bytes captured (1104 bits) on interface 0" size="138" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.481283000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.481283000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.481283000 seconds" size="0" pos="0" show="1379477225.481283000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000306000 seconds" size="0" pos="0" show="0.000306000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000306000 seconds" size="0" pos="0" show="0.000306000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.170561000 seconds" size="0" pos="0" show="0.170561000"/> + <field name="frame.number" showname="Frame Number: 56" size="0" pos="0" show="56"/> + <field name="frame.len" showname="Frame Length: 138 bytes (1104 bits)" size="0" pos="0" show="138"/> + <field name="frame.cap_len" showname="Capture Length: 138 bytes (1104 bits)" size="0" pos="0" show="138"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 124" size="2" pos="16" show="124" value="007c"/> + <field name="ip.id" showname="Identification: 0xe82c (59436)" size="2" pos="18" show="0xe82c" value="e82c"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x544d [correct]" size="2" pos="24" show="0x544d" value="544d"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="544d"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="544d"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 325, Ack: 617, Len: 72" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 72" hide="yes" size="1" pos="46" show="72" value="80"/> + <field name="tcp.seq" showname="Sequence number: 325 (relative sequence number)" size="4" pos="38" show="325" value="0cb69a12"/> + <field name="tcp.nxtseq" showname="Next sequence number: 397 (relative sequence number)" size="0" pos="34" show="397"/> + <field name="tcp.ack" showname="Acknowledgment number: 617 (relative ack number)" size="4" pos="42" show="617" value="ff63c120"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 350" size="2" pos="48" show="350" value="015e"/> + <field name="tcp.window_size" showname="Calculated window size: 44800" size="2" pos="48" show="44800" value="015e"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="015e"/> + <field name="tcp.checksum" showname="Checksum: 0xfe70 [validation disabled]" size="2" pos="50" show="0xfe70" value="fe70"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe70"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe70"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:21:5a:bb:71:20" value="0101080a5abb71215abb7120"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233633, TSecr 1522233632" size="10" pos="56" value="080a5abb71215abb7120"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233633" size="4" pos="58" show="1522233633" value="5abb7121"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233632" size="4" pos="62" show="1522233632" value="5abb7120"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 55" size="0" pos="34" show="55"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000306000 seconds" size="0" pos="34" show="0.000306000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 72" size="0" pos="34" show="72"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 72" size="72" pos="66" show="72" value="000000482000808600000001000000e600000000000000070000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff000000010000000100000002"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="72" pos="66"> + <field name="libvirt.length" showname="length: 72" size="4" pos="66" show="72" value="00000048"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_VCPU_PIN_INFO (230)" size="4" pos="78" show="230" value="000000e6"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 7" size="4" pos="86" show="7" value="00000007"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_vcpu_pin_info_args" showname="remote_domain_get_vcpu_pin_info_args" size="44" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_vcpu_pin_info_args.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + <field name="libvirt.remote_domain_get_vcpu_pin_info_args.ncpumaps" showname="ncpumaps: 1" size="4" pos="126" show="1" value="00000001"/> + <field name="libvirt.remote_domain_get_vcpu_pin_info_args.maplen" showname="maplen: 1" size="4" pos="130" show="1" value="00000001"/> + <field name="libvirt.remote_domain_get_vcpu_pin_info_args.flags" showname="flags: 2" size="4" pos="134" show="2" value="00000002"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="57" showname="Number" value="39" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.484963000 JST" showname="Captured Time" value="1379477225.484963000" size="106"/> + </proto> + <proto name="frame" showname="Frame 57: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.484963000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.484963000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.484963000 seconds" size="0" pos="0" show="1379477225.484963000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.003680000 seconds" size="0" pos="0" show="0.003680000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.003680000 seconds" size="0" pos="0" show="0.003680000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.174241000 seconds" size="0" pos="0" show="0.174241000"/> + <field name="frame.number" showname="Frame Number: 57" size="0" pos="0" show="57"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xce5f (52831)" size="2" pos="18" show="0xce5f" value="ce5f"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e3a [correct]" size="2" pos="24" show="0x6e3a" value="6e3a"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e3a"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e3a"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 617, Ack: 397, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 617 (relative sequence number)" size="4" pos="38" show="617" value="ff63c120"/> + <field name="tcp.nxtseq" showname="Next sequence number: 657 (relative sequence number)" size="0" pos="34" show="657"/> + <field name="tcp.ack" showname="Acknowledgment number: 397 (relative ack number)" size="4" pos="42" show="397" value="0cb69a5a"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:24:5a:bb:71:21" value="0101080a5abb71245abb7121"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233636, TSecr 1522233633" size="10" pos="56" value="080a5abb71245abb7121"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233636" size="4" pos="58" show="1522233636" value="5abb7124"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233633" size="4" pos="62" show="1522233633" value="5abb7121"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 56" size="0" pos="34" show="56"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.003680000 seconds" size="0" pos="34" show="0.003680000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="000000282000808600000001000000e600000001000000070000000000000001ff00000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_VCPU_PIN_INFO (230)" size="4" pos="78" show="230" value="000000e6"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 7" size="4" pos="86" show="7" value="00000007"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_vcpu_pin_info_ret" showname="remote_domain_get_vcpu_pin_info_ret" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_vcpu_pin_info_ret.cpumaps" showname="cpumaps: ff" size="8" pos="94" show="00:00:00:01:ff:00:00:00" value="00000001ff000000"/> + <field name="libvirt.remote_domain_get_vcpu_pin_info_ret.num" showname="num: 1" size="4" pos="102" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="58" showname="Number" value="3a" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.501386000 JST" showname="Captured Time" value="1379477225.501386000" size="94"/> + </proto> + <proto name="frame" showname="Frame 58: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.501386000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.501386000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.501386000 seconds" size="0" pos="0" show="1379477225.501386000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.016423000 seconds" size="0" pos="0" show="0.016423000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.016423000 seconds" size="0" pos="0" show="0.016423000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.190664000 seconds" size="0" pos="0" show="0.190664000"/> + <field name="frame.number" showname="Frame Number: 58" size="0" pos="0" show="58"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xe82d (59437)" size="2" pos="18" show="0xe82d" value="e82d"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x5478 [correct]" size="2" pos="24" show="0x5478" value="5478"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="5478"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="5478"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55130 (55130), Dst Port: 16509 (16509), Seq: 397, Ack: 657, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55130 (55130)" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="34" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 397 (relative sequence number)" size="4" pos="38" show="397" value="0cb69a5a"/> + <field name="tcp.nxtseq" showname="Next sequence number: 425 (relative sequence number)" size="0" pos="34" show="425"/> + <field name="tcp.ack" showname="Acknowledgment number: 657 (relative ack number)" size="4" pos="42" show="657" value="ff63c148"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 350" size="2" pos="48" show="350" value="015e"/> + <field name="tcp.window_size" showname="Calculated window size: 44800" size="2" pos="48" show="44800" value="015e"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="015e"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:35:5a:bb:71:24" value="0101080a5abb71355abb7124"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233653, TSecr 1522233636" size="10" pos="56" value="080a5abb71355abb7124"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233653" size="4" pos="58" show="1522233653" value="5abb7135"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233636" size="4" pos="62" show="1522233636" value="5abb7124"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 57" size="0" pos="34" show="57"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.016423000 seconds" size="0" pos="34" show="0.016423000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000000000000800000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 8" size="4" pos="86" show="8" value="00000008"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="59" showname="Number" value="3b" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.503201000 JST" showname="Captured Time" value="1379477225.503201000" size="94"/> + </proto> + <proto name="frame" showname="Frame 59: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.503201000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.503201000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.503201000 seconds" size="0" pos="0" show="1379477225.503201000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.001815000 seconds" size="0" pos="0" show="0.001815000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.001815000 seconds" size="0" pos="0" show="0.001815000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.192479000 seconds" size="0" pos="0" show="0.192479000"/> + <field name="frame.number" showname="Frame Number: 59" size="0" pos="0" show="59"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xce60 (52832)" size="2" pos="18" show="0xce60" value="ce60"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x6e45 [correct]" size="2" pos="24" show="0x6e45" value="6e45"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="6e45"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="6e45"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55130 (55130), Seq: 657, Ack: 425, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55130 (55130)" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55130" hide="yes" size="2" pos="36" show="55130" value="d75a"/> + <field name="tcp.stream" showname="Stream index: 2" size="0" pos="34" show="2"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 657 (relative sequence number)" size="4" pos="38" show="657" value="ff63c148"/> + <field name="tcp.nxtseq" showname="Next sequence number: 685 (relative sequence number)" size="0" pos="34" show="685"/> + <field name="tcp.ack" showname="Acknowledgment number: 425 (relative ack number)" size="4" pos="42" show="425" value="0cb69a76"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:37:5a:bb:71:35" value="0101080a5abb71375abb7135"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233655, TSecr 1522233653" size="10" pos="56" value="080a5abb71375abb7135"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233655" size="4" pos="58" show="1522233655" value="5abb7137"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233653" size="4" pos="62" show="1522233653" value="5abb7135"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 58" size="0" pos="34" show="58"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.001815000 seconds" size="0" pos="34" show="0.001815000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000010000000800000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 8" size="4" pos="86" show="8" value="00000008"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="66" showname="Number" value="42" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.515204000 JST" showname="Captured Time" value="1379477225.515204000" size="94"/> + </proto> + <proto name="frame" showname="Frame 66: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.515204000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.515204000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.515204000 seconds" size="0" pos="0" show="1379477225.515204000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000309000 seconds" size="0" pos="0" show="0.000309000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.012003000 seconds" size="0" pos="0" show="0.012003000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.204482000 seconds" size="0" pos="0" show="0.204482000"/> + <field name="frame.number" showname="Frame Number: 66" size="0" pos="0" show="66"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xe8a8 (59560)" size="2" pos="18" show="0xe8a8" value="e8a8"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53fd [correct]" size="2" pos="24" show="0x53fd" value="53fd"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53fd"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53fd"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 1, Ack: 1, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="069b99e5"/> + <field name="tcp.nxtseq" showname="Next sequence number: 29 (relative sequence number)" size="0" pos="34" show="29"/> + <field name="tcp.ack" showname="Acknowledgment number: 1 (relative ack number)" size="4" pos="42" show="1" value="1869d70f"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:43:5a:bb:71:42" value="0101080a5abb71435abb7142"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233667, TSecr 1522233666" size="10" pos="56" value="080a5abb71435abb7142"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233667" size="4" pos="58" show="1522233667" value="5abb7143"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233666" size="4" pos="62" show="1522233666" value="5abb7142"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000042000000000000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="68" showname="Number" value="44" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.517697000 JST" showname="Captured Time" value="1379477225.517697000" size="102"/> + </proto> + <proto name="frame" showname="Frame 68: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.517697000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.517697000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.517697000 seconds" size="0" pos="0" show="1379477225.517697000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.002481000 seconds" size="0" pos="0" show="0.002481000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.002493000 seconds" size="0" pos="0" show="0.002493000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.206975000 seconds" size="0" pos="0" show="0.206975000"/> + <field name="frame.number" showname="Frame Number: 68" size="0" pos="0" show="68"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0xa64e (42574)" size="2" pos="18" show="0xa64e" value="a64e"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x964f [correct]" size="2" pos="24" show="0x964f" value="964f"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="964f"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="964f"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 1, Ack: 29, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 1 (relative sequence number)" size="4" pos="38" show="1" value="1869d70f"/> + <field name="tcp.nxtseq" showname="Next sequence number: 37 (relative sequence number)" size="0" pos="34" show="37"/> + <field name="tcp.ack" showname="Acknowledgment number: 29 (relative ack number)" size="4" pos="42" show="29" value="069b9a01"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:45:5a:bb:71:43" value="0101080a5abb71455abb7143"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233669, TSecr 1522233667" size="10" pos="56" value="080a5abb71455abb7143"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233669" size="4" pos="58" show="1522233669" value="5abb7145"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233667" size="4" pos="62" show="1522233667" value="5abb7143"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000000420000000100000000000000000000000100000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: AUTH_LIST (66)" size="4" pos="78" show="66" value="00000042"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 0" size="4" pos="86" show="0" value="00000000"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_auth_list_ret" showname="remote_auth_list_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types" showname="types :: remote_auth_type&lt;1&gt;" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_auth_list_ret.types.types" showname="types: REMOTE_AUTH_NONE(0)" size="4" pos="98" show="0" value="00000000"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="70" showname="Number" value="46" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.517946000 JST" showname="Captured Time" value="1379477225.517946000" size="98"/> + </proto> + <proto name="frame" showname="Frame 70: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.517946000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.517946000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.517946000 seconds" size="0" pos="0" show="1379477225.517946000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000220000 seconds" size="0" pos="0" show="0.000220000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000249000 seconds" size="0" pos="0" show="0.000249000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.207224000 seconds" size="0" pos="0" show="0.207224000"/> + <field name="frame.number" showname="Frame Number: 70" size="0" pos="0" show="70"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xe8aa (59562)" size="2" pos="18" show="0xe8aa" value="e8aa"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53f7 [correct]" size="2" pos="24" show="0x53f7" value="53f7"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53f7"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53f7"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 29, Ack: 37, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 29 (relative sequence number)" size="4" pos="38" show="29" value="069b9a01"/> + <field name="tcp.nxtseq" showname="Next sequence number: 61 (relative sequence number)" size="0" pos="34" show="61"/> + <field name="tcp.ack" showname="Acknowledgment number: 37 (relative ack number)" size="4" pos="42" show="37" value="1869d733"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:45:5a:bb:71:45" value="0101080a5abb71455abb7145"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233669, TSecr 1522233669" size="10" pos="56" value="080a5abb71455abb7145"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233669" size="4" pos="58" show="1522233669" value="5abb7145"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233669" size="4" pos="62" show="1522233669" value="5abb7145"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c0000000000000001000000000000000a"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 10" size="4" pos="94" show="10" value="0000000a"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="71" showname="Number" value="47" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.522522000 JST" showname="Captured Time" value="1379477225.522522000" size="98"/> + </proto> + <proto name="frame" showname="Frame 71: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.522522000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.522522000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.522522000 seconds" size="0" pos="0" show="1379477225.522522000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004576000 seconds" size="0" pos="0" show="0.004576000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004576000 seconds" size="0" pos="0" show="0.004576000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.211800000 seconds" size="0" pos="0" show="0.211800000"/> + <field name="frame.number" showname="Frame Number: 71" size="0" pos="0" show="71"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xa64f (42575)" size="2" pos="18" show="0xa64f" value="a64f"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x9652 [correct]" size="2" pos="24" show="0x9652" value="9652"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="9652"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="9652"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 37, Ack: 61, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 37 (relative sequence number)" size="4" pos="38" show="37" value="1869d733"/> + <field name="tcp.nxtseq" showname="Next sequence number: 69 (relative sequence number)" size="0" pos="34" show="69"/> + <field name="tcp.ack" showname="Acknowledgment number: 61 (relative ack number)" size="4" pos="42" show="61" value="069b9a21"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:4a:5a:bb:71:45" value="0101080a5abb714a5abb7145"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233674, TSecr 1522233669" size="10" pos="56" value="080a5abb714a5abb7145"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233674" size="4" pos="58" show="1522233674" value="5abb714a"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233669" size="4" pos="62" show="1522233669" value="5abb7145"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 70" size="0" pos="34" show="70"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004576000 seconds" size="0" pos="34" show="0.004576000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000010000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 1" size="4" pos="86" show="1" value="00000001"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="122"> + <field name="num" pos="0" show="72" showname="Number" value="48" size="122"/> + <field name="len" pos="0" show="122" showname="Frame Length" value="7a" size="122"/> + <field name="caplen" pos="0" show="122" showname="Captured Length" value="7a" size="122"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.522810000 JST" showname="Captured Time" value="1379477225.522810000" size="122"/> + </proto> + <proto name="frame" showname="Frame 72: 122 bytes on wire (976 bits), 122 bytes captured (976 bits) on interface 0" size="122" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.522810000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.522810000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.522810000 seconds" size="0" pos="0" show="1379477225.522810000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000288000 seconds" size="0" pos="0" show="0.000288000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000288000 seconds" size="0" pos="0" show="0.000288000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.212088000 seconds" size="0" pos="0" show="0.212088000"/> + <field name="frame.number" showname="Frame Number: 72" size="0" pos="0" show="72"/> + <field name="frame.len" showname="Frame Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.cap_len" showname="Capture Length: 122 bytes (976 bits)" size="0" pos="0" show="122"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 108" size="2" pos="16" show="108" value="006c"/> + <field name="ip.id" showname="Identification: 0xe8ab (59563)" size="2" pos="18" show="0xe8ab" value="e8ab"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53de [correct]" size="2" pos="24" show="0x53de" value="53de"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53de"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53de"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 61, Ack: 69, Len: 56" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 56" hide="yes" size="1" pos="46" show="56" value="80"/> + <field name="tcp.seq" showname="Sequence number: 61 (relative sequence number)" size="4" pos="38" show="61" value="069b9a21"/> + <field name="tcp.nxtseq" showname="Next sequence number: 117 (relative sequence number)" size="0" pos="34" show="117"/> + <field name="tcp.ack" showname="Acknowledgment number: 69 (relative ack number)" size="4" pos="42" show="69" value="1869d753"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe60 [validation disabled]" size="2" pos="50" show="0xfe60" value="fe60"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe60"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe60"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:4a:5a:bb:71:4a" value="0101080a5abb714a5abb714a"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233674, TSecr 1522233674" size="10" pos="56" value="080a5abb714a5abb714a"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233674" size="4" pos="58" show="1522233674" value="5abb714a"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233674" size="4" pos="62" show="1522233674" value="5abb714a"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 71" size="0" pos="34" show="71"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000288000 seconds" size="0" pos="34" show="0.000288000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 56" size="0" pos="34" show="56"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 56" size="56" pos="66" show="56" value="00000038200080860000000100000001000000000000000200000000000000010000000f71656d753a2f2f2f73657373696f6e0000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="56" pos="66"> + <field name="libvirt.length" showname="length: 56" size="4" pos="66" show="56" value="00000038"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_open_args" showname="remote_connect_open_args" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_connect_open_args.name" showname="name: (null)" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_connect_open_args.flags" showname="flags: 15" size="4" pos="98" show="15" value="0000000f"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="73" showname="Number" value="49" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.527095000 JST" showname="Captured Time" value="1379477225.527095000" size="94"/> + </proto> + <proto name="frame" showname="Frame 73: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.527095000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.527095000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.527095000 seconds" size="0" pos="0" show="1379477225.527095000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004285000 seconds" size="0" pos="0" show="0.004285000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004285000 seconds" size="0" pos="0" show="0.004285000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.216373000 seconds" size="0" pos="0" show="0.216373000"/> + <field name="frame.number" showname="Frame Number: 73" size="0" pos="0" show="73"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xa650 (42576)" size="2" pos="18" show="0xa650" value="a650"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x9655 [correct]" size="2" pos="24" show="0x9655" value="9655"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="9655"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="9655"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 69, Ack: 117, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 69 (relative sequence number)" size="4" pos="38" show="69" value="1869d753"/> + <field name="tcp.nxtseq" showname="Next sequence number: 97 (relative sequence number)" size="0" pos="34" show="97"/> + <field name="tcp.ack" showname="Acknowledgment number: 117 (relative ack number)" size="4" pos="42" show="117" value="069b9a59"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:4f:5a:bb:71:4a" value="0101080a5abb714f5abb714a"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233679, TSecr 1522233674" size="10" pos="56" value="080a5abb714f5abb714a"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233679" size="4" pos="58" show="1522233679" value="5abb714f"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233674" size="4" pos="62" show="1522233674" value="5abb714a"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 72" size="0" pos="34" show="72"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004285000 seconds" size="0" pos="34" show="0.004285000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000001000000010000000200000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_OPEN (1)" size="4" pos="78" show="1" value="00000001"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 2" size="4" pos="86" show="2" value="00000002"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="106"> + <field name="num" pos="0" show="74" showname="Number" value="4a" size="106"/> + <field name="len" pos="0" show="106" showname="Frame Length" value="6a" size="106"/> + <field name="caplen" pos="0" show="106" showname="Captured Length" value="6a" size="106"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.527349000 JST" showname="Captured Time" value="1379477225.527349000" size="106"/> + </proto> + <proto name="frame" showname="Frame 74: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0" size="106" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.527349000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.527349000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.527349000 seconds" size="0" pos="0" show="1379477225.527349000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000254000 seconds" size="0" pos="0" show="0.000254000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000254000 seconds" size="0" pos="0" show="0.000254000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.216627000 seconds" size="0" pos="0" show="0.216627000"/> + <field name="frame.number" showname="Frame Number: 74" size="0" pos="0" show="74"/> + <field name="frame.len" showname="Frame Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.cap_len" showname="Capture Length: 106 bytes (848 bits)" size="0" pos="0" show="106"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 92" size="2" pos="16" show="92" value="005c"/> + <field name="ip.id" showname="Identification: 0xe8ac (59564)" size="2" pos="18" show="0xe8ac" value="e8ac"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53ed [correct]" size="2" pos="24" show="0x53ed" value="53ed"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53ed"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53ed"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 117, Ack: 97, Len: 40" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 40" hide="yes" size="1" pos="46" show="40" value="80"/> + <field name="tcp.seq" showname="Sequence number: 117 (relative sequence number)" size="4" pos="38" show="117" value="069b9a59"/> + <field name="tcp.nxtseq" showname="Next sequence number: 157 (relative sequence number)" size="0" pos="34" show="157"/> + <field name="tcp.ack" showname="Acknowledgment number: 97 (relative ack number)" size="4" pos="42" show="97" value="1869d76f"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe50 [validation disabled]" size="2" pos="50" show="0xfe50" value="fe50"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe50"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe50"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:4f:5a:bb:71:4f" value="0101080a5abb714f5abb714f"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233679, TSecr 1522233679" size="10" pos="56" value="080a5abb714f5abb714f"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233679" size="4" pos="58" show="1522233679" value="5abb714f"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233679" size="4" pos="62" show="1522233679" value="5abb714f"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 73" size="0" pos="34" show="73"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000254000 seconds" size="0" pos="34" show="0.000254000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 40" size="0" pos="34" show="40"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 40" size="40" pos="66" show="40" value="0000002820008086000000010000001700000000000000030000000000000007646f6d61696e3100"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="40" pos="66"> + <field name="libvirt.length" showname="length: 40" size="4" pos="66" show="40" value="00000028"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_LOOKUP_BY_NAME (23)" size="4" pos="78" show="23" value="00000017"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_lookup_by_name_args" showname="remote_domain_lookup_by_name_args" size="12" pos="94" show="" value=""> + <field name="libvirt.remote_domain_lookup_by_name_args.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="126"> + <field name="num" pos="0" show="75" showname="Number" value="4b" size="126"/> + <field name="len" pos="0" show="126" showname="Frame Length" value="7e" size="126"/> + <field name="caplen" pos="0" show="126" showname="Captured Length" value="7e" size="126"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.531593000 JST" showname="Captured Time" value="1379477225.531593000" size="126"/> + </proto> + <proto name="frame" showname="Frame 75: 126 bytes on wire (1008 bits), 126 bytes captured (1008 bits) on interface 0" size="126" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.531593000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.531593000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.531593000 seconds" size="0" pos="0" show="1379477225.531593000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004244000 seconds" size="0" pos="0" show="0.004244000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004244000 seconds" size="0" pos="0" show="0.004244000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.220871000 seconds" size="0" pos="0" show="0.220871000"/> + <field name="frame.number" showname="Frame Number: 75" size="0" pos="0" show="75"/> + <field name="frame.len" showname="Frame Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.cap_len" showname="Capture Length: 126 bytes (1008 bits)" size="0" pos="0" show="126"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 112" size="2" pos="16" show="112" value="0070"/> + <field name="ip.id" showname="Identification: 0xa651 (42577)" size="2" pos="18" show="0xa651" value="a651"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x9634 [correct]" size="2" pos="24" show="0x9634" value="9634"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="9634"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="9634"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 97, Ack: 157, Len: 60" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 60" hide="yes" size="1" pos="46" show="60" value="80"/> + <field name="tcp.seq" showname="Sequence number: 97 (relative sequence number)" size="4" pos="38" show="97" value="1869d76f"/> + <field name="tcp.nxtseq" showname="Next sequence number: 157 (relative sequence number)" size="0" pos="34" show="157"/> + <field name="tcp.ack" showname="Acknowledgment number: 157 (relative ack number)" size="4" pos="42" show="157" value="069b9a81"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe64 [validation disabled]" size="2" pos="50" show="0xfe64" value="fe64"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe64"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe64"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:53:5a:bb:71:4f" value="0101080a5abb71535abb714f"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233683, TSecr 1522233679" size="10" pos="56" value="080a5abb71535abb714f"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233683" size="4" pos="58" show="1522233683" value="5abb7153"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233679" size="4" pos="62" show="1522233679" value="5abb714f"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 74" size="0" pos="34" show="74"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004244000 seconds" size="0" pos="34" show="0.004244000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 60" size="0" pos="34" show="60"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 60" size="60" pos="66" show="60" value="0000003c20008086000000010000001700000001000000030000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="60" pos="66"> + <field name="libvirt.length" showname="length: 60" size="4" pos="66" show="60" value="0000003c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_LOOKUP_BY_NAME (23)" size="4" pos="78" show="23" value="00000017"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 3" size="4" pos="86" show="3" value="00000003"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_lookup_by_name_ret" showname="remote_domain_lookup_by_name_ret" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_domain_lookup_by_name_ret.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="76" showname="Number" value="4c" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.531730000 JST" showname="Captured Time" value="1379477225.531730000" size="98"/> + </proto> + <proto name="frame" showname="Frame 76: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.531730000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.531730000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.531730000 seconds" size="0" pos="0" show="1379477225.531730000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000137000 seconds" size="0" pos="0" show="0.000137000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000137000 seconds" size="0" pos="0" show="0.000137000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.221008000 seconds" size="0" pos="0" show="0.221008000"/> + <field name="frame.number" showname="Frame Number: 76" size="0" pos="0" show="76"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xe8ad (59565)" size="2" pos="18" show="0xe8ad" value="e8ad"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53f4 [correct]" size="2" pos="24" show="0x53f4" value="53f4"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53f4"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53f4"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 157, Ack: 157, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 157 (relative sequence number)" size="4" pos="38" show="157" value="069b9a81"/> + <field name="tcp.nxtseq" showname="Next sequence number: 189 (relative sequence number)" size="0" pos="34" show="189"/> + <field name="tcp.ack" showname="Acknowledgment number: 157 (relative ack number)" size="4" pos="42" show="157" value="1869d7ab"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:53:5a:bb:71:53" value="0101080a5abb71535abb7153"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233683, TSecr 1522233683" size="10" pos="56" value="080a5abb71535abb7153"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233683" size="4" pos="58" show="1522233683" value="5abb7153"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233683" size="4" pos="62" show="1522233683" value="5abb7153"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 75" size="0" pos="34" show="75"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000137000 seconds" size="0" pos="34" show="0.000137000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000000000000040000000000000009"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 9" size="4" pos="94" show="9" value="00000009"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="77" showname="Number" value="4d" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.535951000 JST" showname="Captured Time" value="1379477225.535951000" size="98"/> + </proto> + <proto name="frame" showname="Frame 77: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.535951000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.535951000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.535951000 seconds" size="0" pos="0" show="1379477225.535951000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004221000 seconds" size="0" pos="0" show="0.004221000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004221000 seconds" size="0" pos="0" show="0.004221000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.225229000 seconds" size="0" pos="0" show="0.225229000"/> + <field name="frame.number" showname="Frame Number: 77" size="0" pos="0" show="77"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xa652 (42578)" size="2" pos="18" show="0xa652" value="a652"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x964f [correct]" size="2" pos="24" show="0x964f" value="964f"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="964f"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="964f"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 157, Ack: 189, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 157 (relative sequence number)" size="4" pos="38" show="157" value="1869d7ab"/> + <field name="tcp.nxtseq" showname="Next sequence number: 189 (relative sequence number)" size="0" pos="34" show="189"/> + <field name="tcp.ack" showname="Acknowledgment number: 189 (relative ack number)" size="4" pos="42" show="189" value="069b9aa1"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:57:5a:bb:71:53" value="0101080a5abb71575abb7153"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233687, TSecr 1522233683" size="10" pos="56" value="080a5abb71575abb7153"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233687" size="4" pos="58" show="1522233687" value="5abb7157"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233683" size="4" pos="62" show="1522233683" value="5abb7153"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 76" size="0" pos="34" show="76"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004221000 seconds" size="0" pos="34" show="0.004221000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000040000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 4" size="4" pos="86" show="4" value="00000004"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="134"> + <field name="num" pos="0" show="78" showname="Number" value="4e" size="134"/> + <field name="len" pos="0" show="134" showname="Frame Length" value="86" size="134"/> + <field name="caplen" pos="0" show="134" showname="Captured Length" value="86" size="134"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.536149000 JST" showname="Captured Time" value="1379477225.536149000" size="134"/> + </proto> + <proto name="frame" showname="Frame 78: 134 bytes on wire (1072 bits), 134 bytes captured (1072 bits) on interface 0" size="134" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.536149000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.536149000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.536149000 seconds" size="0" pos="0" show="1379477225.536149000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000198000 seconds" size="0" pos="0" show="0.000198000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000198000 seconds" size="0" pos="0" show="0.000198000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.225427000 seconds" size="0" pos="0" show="0.225427000"/> + <field name="frame.number" showname="Frame Number: 78" size="0" pos="0" show="78"/> + <field name="frame.len" showname="Frame Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.cap_len" showname="Capture Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 120" size="2" pos="16" show="120" value="0078"/> + <field name="ip.id" showname="Identification: 0xe8ae (59566)" size="2" pos="18" show="0xe8ae" value="e8ae"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53cf [correct]" size="2" pos="24" show="0x53cf" value="53cf"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53cf"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53cf"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 189, Ack: 189, Len: 68" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 68" hide="yes" size="1" pos="46" show="68" value="80"/> + <field name="tcp.seq" showname="Sequence number: 189 (relative sequence number)" size="4" pos="38" show="189" value="069b9aa1"/> + <field name="tcp.nxtseq" showname="Next sequence number: 257 (relative sequence number)" size="0" pos="34" show="257"/> + <field name="tcp.ack" showname="Acknowledgment number: 189 (relative ack number)" size="4" pos="42" show="189" value="1869d7cb"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe6c [validation disabled]" size="2" pos="50" show="0xfe6c" value="fe6c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:58:5a:bb:71:57" value="0101080a5abb71585abb7157"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233688, TSecr 1522233687" size="10" pos="56" value="080a5abb71585abb7157"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233688" size="4" pos="58" show="1522233688" value="5abb7158"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233687" size="4" pos="62" show="1522233687" value="5abb7157"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 77" size="0" pos="34" show="77"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000198000 seconds" size="0" pos="34" show="0.000198000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 68" size="0" pos="34" show="68"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 68" size="68" pos="66" show="68" value="000000442000808600000001000000ce00000000000000050000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff0000000000000004"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="68" pos="66"> + <field name="libvirt.length" showname="length: 68" size="4" pos="66" show="68" value="00000044"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_BLKIO_PARAMETERS (206)" size="4" pos="78" show="206" value="000000ce"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 5" size="4" pos="86" show="5" value="00000005"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_blkio_parameters_args" showname="remote_domain_get_blkio_parameters_args" size="40" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_blkio_parameters_args.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + <field name="libvirt.remote_domain_get_blkio_parameters_args.nparams" showname="nparams: 0" size="4" pos="126" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_blkio_parameters_args.flags" showname="flags: 4" size="4" pos="130" show="4" value="00000004"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="102"> + <field name="num" pos="0" show="79" showname="Number" value="4f" size="102"/> + <field name="len" pos="0" show="102" showname="Frame Length" value="66" size="102"/> + <field name="caplen" pos="0" show="102" showname="Captured Length" value="66" size="102"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.540042000 JST" showname="Captured Time" value="1379477225.540042000" size="102"/> + </proto> + <proto name="frame" showname="Frame 79: 102 bytes on wire (816 bits), 102 bytes captured (816 bits) on interface 0" size="102" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.540042000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.540042000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.540042000 seconds" size="0" pos="0" show="1379477225.540042000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.003893000 seconds" size="0" pos="0" show="0.003893000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.003893000 seconds" size="0" pos="0" show="0.003893000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.229320000 seconds" size="0" pos="0" show="0.229320000"/> + <field name="frame.number" showname="Frame Number: 79" size="0" pos="0" show="79"/> + <field name="frame.len" showname="Frame Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.cap_len" showname="Capture Length: 102 bytes (816 bits)" size="0" pos="0" show="102"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 88" size="2" pos="16" show="88" value="0058"/> + <field name="ip.id" showname="Identification: 0xa653 (42579)" size="2" pos="18" show="0xa653" value="a653"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x964a [correct]" size="2" pos="24" show="0x964a" value="964a"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="964a"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="964a"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 189, Ack: 257, Len: 36" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 36" hide="yes" size="1" pos="46" show="36" value="80"/> + <field name="tcp.seq" showname="Sequence number: 189 (relative sequence number)" size="4" pos="38" show="189" value="1869d7cb"/> + <field name="tcp.nxtseq" showname="Next sequence number: 225 (relative sequence number)" size="0" pos="34" show="225"/> + <field name="tcp.ack" showname="Acknowledgment number: 257 (relative ack number)" size="4" pos="42" show="257" value="069b9ae5"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe4c [validation disabled]" size="2" pos="50" show="0xfe4c" value="fe4c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe4c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:5c:5a:bb:71:58" value="0101080a5abb715c5abb7158"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233692, TSecr 1522233688" size="10" pos="56" value="080a5abb715c5abb7158"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233692" size="4" pos="58" show="1522233692" value="5abb715c"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233688" size="4" pos="62" show="1522233688" value="5abb7158"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 78" size="0" pos="34" show="78"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.003893000 seconds" size="0" pos="34" show="0.003893000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 36" size="0" pos="34" show="36"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 36" size="36" pos="66" show="36" value="000000242000808600000001000000ce0000000100000005000000000000000000000002"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="36" pos="66"> + <field name="libvirt.length" showname="length: 36" size="4" pos="66" show="36" value="00000024"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_BLKIO_PARAMETERS (206)" size="4" pos="78" show="206" value="000000ce"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 5" size="4" pos="86" show="5" value="00000005"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_blkio_parameters_ret" showname="remote_domain_get_blkio_parameters_ret" size="8" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.params" showname="params :: remote_typed_param&lt;0&gt;" size="4" pos="94" show="" value=""/> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.nparams" showname="nparams: 2" size="4" pos="98" show="2" value="00000002"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="80" showname="Number" value="50" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.540189000 JST" showname="Captured Time" value="1379477225.540189000" size="98"/> + </proto> + <proto name="frame" showname="Frame 80: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.540189000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.540189000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.540189000 seconds" size="0" pos="0" show="1379477225.540189000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000147000 seconds" size="0" pos="0" show="0.000147000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000147000 seconds" size="0" pos="0" show="0.000147000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.229467000 seconds" size="0" pos="0" show="0.229467000"/> + <field name="frame.number" showname="Frame Number: 80" size="0" pos="0" show="80"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xe8af (59567)" size="2" pos="18" show="0xe8af" value="e8af"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53f2 [correct]" size="2" pos="24" show="0x53f2" value="53f2"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53f2"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53f2"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 257, Ack: 225, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 257 (relative sequence number)" size="4" pos="38" show="257" value="069b9ae5"/> + <field name="tcp.nxtseq" showname="Next sequence number: 289 (relative sequence number)" size="0" pos="34" show="289"/> + <field name="tcp.ack" showname="Acknowledgment number: 225 (relative ack number)" size="4" pos="42" show="225" value="1869d7ef"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:5c:5a:bb:71:5c" value="0101080a5abb715c5abb715c"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233692, TSecr 1522233692" size="10" pos="56" value="080a5abb715c5abb715c"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233692" size="4" pos="58" show="1522233692" value="5abb715c"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233692" size="4" pos="62" show="1522233692" value="5abb715c"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 79" size="0" pos="34" show="79"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000147000 seconds" size="0" pos="34" show="0.000147000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000000000000060000000000000009"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 6" size="4" pos="86" show="6" value="00000006"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_args" showname="remote_connect_supports_feature_args" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_args.feature" showname="feature: 9" size="4" pos="94" show="9" value="00000009"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="98"> + <field name="num" pos="0" show="81" showname="Number" value="51" size="98"/> + <field name="len" pos="0" show="98" showname="Frame Length" value="62" size="98"/> + <field name="caplen" pos="0" show="98" showname="Captured Length" value="62" size="98"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.544510000 JST" showname="Captured Time" value="1379477225.544510000" size="98"/> + </proto> + <proto name="frame" showname="Frame 81: 98 bytes on wire (784 bits), 98 bytes captured (784 bits) on interface 0" size="98" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.544510000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.544510000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.544510000 seconds" size="0" pos="0" show="1379477225.544510000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.004321000 seconds" size="0" pos="0" show="0.004321000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.004321000 seconds" size="0" pos="0" show="0.004321000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.233788000 seconds" size="0" pos="0" show="0.233788000"/> + <field name="frame.number" showname="Frame Number: 81" size="0" pos="0" show="81"/> + <field name="frame.len" showname="Frame Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.cap_len" showname="Capture Length: 98 bytes (784 bits)" size="0" pos="0" show="98"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 84" size="2" pos="16" show="84" value="0054"/> + <field name="ip.id" showname="Identification: 0xa654 (42580)" size="2" pos="18" show="0xa654" value="a654"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x964d [correct]" size="2" pos="24" show="0x964d" value="964d"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="964d"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="964d"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 225, Ack: 289, Len: 32" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 32" hide="yes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.seq" showname="Sequence number: 225 (relative sequence number)" size="4" pos="38" show="225" value="1869d7ef"/> + <field name="tcp.nxtseq" showname="Next sequence number: 257 (relative sequence number)" size="0" pos="34" show="257"/> + <field name="tcp.ack" showname="Acknowledgment number: 289 (relative ack number)" size="4" pos="42" show="289" value="069b9b05"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe48 [validation disabled]" size="2" pos="50" show="0xfe48" value="fe48"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe48"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe48"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:60:5a:bb:71:5c" value="0101080a5abb71605abb715c"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233696, TSecr 1522233692" size="10" pos="56" value="080a5abb71605abb715c"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233696" size="4" pos="58" show="1522233696" value="5abb7160"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233692" size="4" pos="62" show="1522233692" value="5abb715c"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 80" size="0" pos="34" show="80"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.004321000 seconds" size="0" pos="34" show="0.004321000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 32" size="0" pos="34" show="32"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 32" size="32" pos="66" show="32" value="0000002020008086000000010000003c00000001000000060000000000000001"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="32" pos="66"> + <field name="libvirt.length" showname="length: 32" size="4" pos="66" show="32" value="00000020"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_SUPPORTS_FEATURE (60)" size="4" pos="78" show="60" value="0000003c"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 6" size="4" pos="86" show="6" value="00000006"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_connect_supports_feature_ret" showname="remote_connect_supports_feature_ret" size="4" pos="94" show="" value=""> + <field name="libvirt.remote_connect_supports_feature_ret.supported" showname="supported: 1" size="4" pos="94" show="1" value="00000001"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="134"> + <field name="num" pos="0" show="82" showname="Number" value="52" size="134"/> + <field name="len" pos="0" show="134" showname="Frame Length" value="86" size="134"/> + <field name="caplen" pos="0" show="134" showname="Captured Length" value="86" size="134"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.544665000 JST" showname="Captured Time" value="1379477225.544665000" size="134"/> + </proto> + <proto name="frame" showname="Frame 82: 134 bytes on wire (1072 bits), 134 bytes captured (1072 bits) on interface 0" size="134" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.544665000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.544665000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.544665000 seconds" size="0" pos="0" show="1379477225.544665000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000155000 seconds" size="0" pos="0" show="0.000155000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000155000 seconds" size="0" pos="0" show="0.000155000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.233943000 seconds" size="0" pos="0" show="0.233943000"/> + <field name="frame.number" showname="Frame Number: 82" size="0" pos="0" show="82"/> + <field name="frame.len" showname="Frame Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.cap_len" showname="Capture Length: 134 bytes (1072 bits)" size="0" pos="0" show="134"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 120" size="2" pos="16" show="120" value="0078"/> + <field name="ip.id" showname="Identification: 0xe8b0 (59568)" size="2" pos="18" show="0xe8b0" value="e8b0"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53cd [correct]" size="2" pos="24" show="0x53cd" value="53cd"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53cd"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53cd"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 289, Ack: 257, Len: 68" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 68" hide="yes" size="1" pos="46" show="68" value="80"/> + <field name="tcp.seq" showname="Sequence number: 289 (relative sequence number)" size="4" pos="38" show="289" value="069b9b05"/> + <field name="tcp.nxtseq" showname="Next sequence number: 357 (relative sequence number)" size="0" pos="34" show="357"/> + <field name="tcp.ack" showname="Acknowledgment number: 257 (relative ack number)" size="4" pos="42" show="257" value="1869d80f"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe6c [validation disabled]" size="2" pos="50" show="0xfe6c" value="fe6c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe6c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:60:5a:bb:71:60" value="0101080a5abb71605abb7160"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233696, TSecr 1522233696" size="10" pos="56" value="080a5abb71605abb7160"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233696" size="4" pos="58" show="1522233696" value="5abb7160"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233696" size="4" pos="62" show="1522233696" value="5abb7160"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 81" size="0" pos="34" show="81"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000155000 seconds" size="0" pos="34" show="0.000155000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 68" size="0" pos="34" show="68"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 68" size="68" pos="66" show="68" value="000000442000808600000001000000ce00000000000000070000000000000007646f6d61696e31004c8b6b6d0a2907334b8398a02c3a4710ffffffff0000000200000004"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="68" pos="66"> + <field name="libvirt.length" showname="length: 68" size="4" pos="66" show="68" value="00000044"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_BLKIO_PARAMETERS (206)" size="4" pos="78" show="206" value="000000ce"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 7" size="4" pos="86" show="7" value="00000007"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_blkio_parameters_args" showname="remote_domain_get_blkio_parameters_args" size="40" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_blkio_parameters_args.dom" showname="dom :: remote_nonnull_domain" size="32" pos="94" show="" value=""> + <field name="libvirt.remote_nonnull_domain.name" showname="name: domain1" size="12" pos="94" show="domain1" value="00000007646f6d61696e3100"/> + <field name="libvirt.remote_nonnull_domain.uuid" showname="uuid: 4c8b6b6d0a2907334b8398a02c3a4710" size="16" pos="106" show="4c:8b:6b:6d:0a:29:07:33:4b:83:98:a0:2c:3a:47:10" value="4c8b6b6d0a2907334b8398a02c3a4710"/> + <field name="libvirt.remote_nonnull_domain.id" showname="id: -1" size="4" pos="122" show="-1" value="ffffffff"/> + </field> + <field name="libvirt.remote_domain_get_blkio_parameters_args.nparams" showname="nparams: 2" size="4" pos="126" show="2" value="00000002"/> + <field name="libvirt.remote_domain_get_blkio_parameters_args.flags" showname="flags: 4" size="4" pos="130" show="4" value="00000004"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="150"> + <field name="num" pos="0" show="83" showname="Number" value="53" size="150"/> + <field name="len" pos="0" show="150" showname="Frame Length" value="96" size="150"/> + <field name="caplen" pos="0" show="150" showname="Captured Length" value="96" size="150"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.551347000 JST" showname="Captured Time" value="1379477225.551347000" size="150"/> + </proto> + <proto name="frame" showname="Frame 83: 150 bytes on wire (1200 bits), 150 bytes captured (1200 bits) on interface 0" size="150" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.551347000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.551347000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.551347000 seconds" size="0" pos="0" show="1379477225.551347000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.006682000 seconds" size="0" pos="0" show="0.006682000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.006682000 seconds" size="0" pos="0" show="0.006682000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.240625000 seconds" size="0" pos="0" show="0.240625000"/> + <field name="frame.number" showname="Frame Number: 83" size="0" pos="0" show="83"/> + <field name="frame.len" showname="Frame Length: 150 bytes (1200 bits)" size="0" pos="0" show="150"/> + <field name="frame.cap_len" showname="Capture Length: 150 bytes (1200 bits)" size="0" pos="0" show="150"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 136" size="2" pos="16" show="136" value="0088"/> + <field name="ip.id" showname="Identification: 0xa655 (42581)" size="2" pos="18" show="0xa655" value="a655"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x9618 [correct]" size="2" pos="24" show="0x9618" value="9618"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="9618"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="9618"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 257, Ack: 357, Len: 84" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 84" hide="yes" size="1" pos="46" show="84" value="80"/> + <field name="tcp.seq" showname="Sequence number: 257 (relative sequence number)" size="4" pos="38" show="257" value="1869d80f"/> + <field name="tcp.nxtseq" showname="Next sequence number: 341 (relative sequence number)" size="0" pos="34" show="341"/> + <field name="tcp.ack" showname="Acknowledgment number: 357 (relative ack number)" size="4" pos="42" show="357" value="069b9b49"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe7c [validation disabled]" size="2" pos="50" show="0xfe7c" value="fe7c"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe7c"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe7c"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:67:5a:bb:71:60" value="0101080a5abb71675abb7160"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233703, TSecr 1522233696" size="10" pos="56" value="080a5abb71675abb7160"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233703" size="4" pos="58" show="1522233703" value="5abb7167"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233696" size="4" pos="62" show="1522233696" value="5abb7160"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 82" size="0" pos="34" show="82"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.006682000 seconds" size="0" pos="34" show="0.006682000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 84" size="0" pos="34" show="84"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 84" size="84" pos="66" show="84" value="000000542000808600000001000000ce0000000100000007000000000000000200000006776569676874000000000002000000000000000d6465766963655f776569676874000000000000070000000000000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="84" pos="66"> + <field name="libvirt.length" showname="length: 84" size="4" pos="66" show="84" value="00000054"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: DOMAIN_GET_BLKIO_PARAMETERS (206)" size="4" pos="78" show="206" value="000000ce"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 7" size="4" pos="86" show="7" value="00000007"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + <field name="libvirt.remote_domain_get_blkio_parameters_ret" showname="remote_domain_get_blkio_parameters_ret" size="56" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.params" showname="params :: remote_typed_param&lt;2&gt;" size="52" pos="94" show="" value=""> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.params.params" showname="params :: remote_typed_param" size="20" pos="98" show="" value=""> + <field name="libvirt.remote_typed_param.field" showname="field: weight" size="12" pos="98" show="weight" value="000000067765696768740000"/> + <field name="libvirt.remote_typed_param_value.ui" showname="ui: 0" size="4" pos="114" show="0" value="00000000"/> + </field> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.params.params" showname="params :: remote_typed_param" size="28" pos="118" show="" value=""> + <field name="libvirt.remote_typed_param.field" showname="field: device_weight" size="20" pos="118" show="device_weight" value="0000000d6465766963655f776569676874000000"/> + <field name="libvirt.remote_typed_param_value.s" showname="s: " size="4" pos="142" show="" value="00000000"/> + </field> + </field> + <field name="libvirt.remote_domain_get_blkio_parameters_ret.nparams" showname="nparams: 0" size="4" pos="146" show="0" value="00000000"/> + </field> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="84" showname="Number" value="54" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.551763000 JST" showname="Captured Time" value="1379477225.551763000" size="94"/> + </proto> + <proto name="frame" showname="Frame 84: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.551763000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.551763000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.551763000 seconds" size="0" pos="0" show="1379477225.551763000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.000416000 seconds" size="0" pos="0" show="0.000416000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.000416000 seconds" size="0" pos="0" show="0.000416000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.241041000 seconds" size="0" pos="0" show="0.241041000"/> + <field name="frame.number" showname="Frame Number: 84" size="0" pos="0" show="84"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xe8b1 (59569)" size="2" pos="18" show="0xe8b1" value="e8b1"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x53f4 [correct]" size="2" pos="24" show="0x53f4" value="53f4"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="53f4"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="53f4"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 55131 (55131), Dst Port: 16509 (16509), Seq: 357, Ack: 341, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 55131 (55131)" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.dstport" showname="Destination port: 16509 (16509)" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="34" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="36" show="16509" value="407d"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 357 (relative sequence number)" size="4" pos="38" show="357" value="069b9b49"/> + <field name="tcp.nxtseq" showname="Next sequence number: 385 (relative sequence number)" size="0" pos="34" show="385"/> + <field name="tcp.ack" showname="Acknowledgment number: 341 (relative ack number)" size="4" pos="42" show="341" value="1869d863"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:67:5a:bb:71:67" value="0101080a5abb71675abb7167"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233703, TSecr 1522233703" size="10" pos="56" value="080a5abb71675abb7167"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233703" size="4" pos="58" show="1522233703" value="5abb7167"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233703" size="4" pos="62" show="1522233703" value="5abb7167"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 83" size="0" pos="34" show="83"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.000416000 seconds" size="0" pos="34" show="0.000416000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000000000000800000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: CALL (0)" size="4" pos="82" show="0" value="00000000"/> + <field name="libvirt.serial" showname="serial: 8" size="4" pos="86" show="8" value="00000008"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +<packet> + <proto name="geninfo" pos="0" showname="General information" size="94"> + <field name="num" pos="0" show="85" showname="Number" value="55" size="94"/> + <field name="len" pos="0" show="94" showname="Frame Length" value="5e" size="94"/> + <field name="caplen" pos="0" show="94" showname="Captured Length" value="5e" size="94"/> + <field name="timestamp" pos="0" show="Sep 18, 2013 13:07:05.553341000 JST" showname="Captured Time" value="1379477225.553341000" size="94"/> + </proto> + <proto name="frame" showname="Frame 85: 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface 0" size="94" pos="0"> + <field name="frame.interface_id" showname="Interface id: 0" size="0" pos="0" show="0"/> + <field name="frame.encap_type" showname="Encapsulation type: Ethernet (1)" size="0" pos="0" show="1"/> + <field name="frame.time" showname="Arrival Time: Sep 18, 2013 13:07:05.553341000 JST" size="0" pos="0" show="Sep 18, 2013 13:07:05.553341000"/> + <field name="frame.offset_shift" showname="Time shift for this packet: 0.000000000 seconds" size="0" pos="0" show="0.000000000"/> + <field name="frame.time_epoch" showname="Epoch Time: 1379477225.553341000 seconds" size="0" pos="0" show="1379477225.553341000"/> + <field name="frame.time_delta" showname="Time delta from previous captured frame: 0.001578000 seconds" size="0" pos="0" show="0.001578000"/> + <field name="frame.time_delta_displayed" showname="Time delta from previous displayed frame: 0.001578000 seconds" size="0" pos="0" show="0.001578000"/> + <field name="frame.time_relative" showname="Time since reference or first frame: 0.242619000 seconds" size="0" pos="0" show="0.242619000"/> + <field name="frame.number" showname="Frame Number: 85" size="0" pos="0" show="85"/> + <field name="frame.len" showname="Frame Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.cap_len" showname="Capture Length: 94 bytes (752 bits)" size="0" pos="0" show="94"/> + <field name="frame.marked" showname="Frame is marked: False" size="0" pos="0" show="0"/> + <field name="frame.ignored" showname="Frame is ignored: False" size="0" pos="0" show="0"/> + <field name="frame.protocols" showname="Protocols in frame: eth:ip:tcp:libvirt" size="0" pos="0" show="eth:ip:tcp:libvirt"/> + </proto> + <proto name="eth" showname="Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="14" pos="0"> + <field name="eth.dst" showname="Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="0" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="0" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.src" showname="Source: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"> + <field name="eth.addr" showname="Address: 00:00:00_00:00:00 (00:00:00:00:00:00)" size="6" pos="6" show="00:00:00:00:00:00" value="000000000000"/> + <field name="eth.lg" showname=".... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + <field name="eth.ig" showname=".... ...0 .... .... .... .... = IG bit: Individual address (unicast)" size="3" pos="6" show="0" value="0" unmaskedvalue="000000"/> + </field> + <field name="eth.type" showname="Type: IP (0x0800)" size="2" pos="12" show="0x0800" value="0800"/> + </proto> + <proto name="ip" showname="Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)" size="20" pos="14"> + <field name="ip.version" showname="Version: 4" size="1" pos="14" show="4" value="45"/> + <field name="ip.hdr_len" showname="Header length: 20 bytes" size="1" pos="14" show="20" value="45"/> + <field name="ip.dsfield" showname="Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))" size="1" pos="15" show="0" value="00"> + <field name="ip.dsfield.dscp" showname="0000 00.. = Differentiated Services Codepoint: Default (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + <field name="ip.dsfield.ecn" showname=".... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)" size="1" pos="15" show="0x00" value="0" unmaskedvalue="00"/> + </field> + <field name="ip.len" showname="Total Length: 80" size="2" pos="16" show="80" value="0050"/> + <field name="ip.id" showname="Identification: 0xa656 (42582)" size="2" pos="18" show="0xa656" value="a656"/> + <field name="ip.flags" showname="Flags: 0x02 (Don&apos;t Fragment)" size="1" pos="20" show="0x02" value="40"> + <field name="ip.flags.rb" showname="0... .... = Reserved bit: Not set" size="1" pos="20" show="0" value="40"/> + <field name="ip.flags.df" showname=".1.. .... = Don&apos;t fragment: Set" size="1" pos="20" show="1" value="40"/> + <field name="ip.flags.mf" showname="..0. .... = More fragments: Not set" size="1" pos="20" show="0" value="40"/> + </field> + <field name="ip.frag_offset" showname="Fragment offset: 0" size="2" pos="20" show="0" value="4000"/> + <field name="ip.ttl" showname="Time to live: 64" size="1" pos="22" show="64" value="40"/> + <field name="ip.proto" showname="Protocol: TCP (6)" size="1" pos="23" show="6" value="06"/> + <field name="ip.checksum" showname="Header checksum: 0x964f [correct]" size="2" pos="24" show="0x964f" value="964f"> + <field name="ip.checksum_good" showname="Good: True" size="2" pos="24" show="1" value="964f"/> + <field name="ip.checksum_bad" showname="Bad: False" size="2" pos="24" show="0" value="964f"/> + </field> + <field name="ip.src" showname="Source: 127.0.0.1 (127.0.0.1)" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.src_host" showname="Source Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="26" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst" showname="Destination: 127.0.0.1 (127.0.0.1)" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.addr" showname="Source or Destination Address: 127.0.0.1 (127.0.0.1)" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.dst_host" showname="Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="ip.host" showname="Source or Destination Host: 127.0.0.1" hide="yes" size="4" pos="30" show="127.0.0.1" value="7f000001"/> + <field name="" show="Source GeoIP: Unknown" size="4" pos="26" value="7f000001"/> + <field name="" show="Destination GeoIP: Unknown" size="4" pos="30" value="7f000001"/> + </proto> + <proto name="tcp" showname="Transmission Control Protocol, Src Port: 16509 (16509), Dst Port: 55131 (55131), Seq: 341, Ack: 385, Len: 28" size="32" pos="34"> + <field name="tcp.srcport" showname="Source port: 16509 (16509)" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.dstport" showname="Destination port: 55131 (55131)" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.port" showname="Source or Destination Port: 16509" hide="yes" size="2" pos="34" show="16509" value="407d"/> + <field name="tcp.port" showname="Source or Destination Port: 55131" hide="yes" size="2" pos="36" show="55131" value="d75b"/> + <field name="tcp.stream" showname="Stream index: 3" size="0" pos="34" show="3"/> + <field name="tcp.len" showname="TCP Segment Len: 28" hide="yes" size="1" pos="46" show="28" value="80"/> + <field name="tcp.seq" showname="Sequence number: 341 (relative sequence number)" size="4" pos="38" show="341" value="1869d863"/> + <field name="tcp.nxtseq" showname="Next sequence number: 369 (relative sequence number)" size="0" pos="34" show="369"/> + <field name="tcp.ack" showname="Acknowledgment number: 385 (relative ack number)" size="4" pos="42" show="385" value="069b9b65"/> + <field name="tcp.hdr_len" showname="Header length: 32 bytes" size="1" pos="46" show="32" value="80"/> + <field name="tcp.flags" showname="Flags: 0x018 (PSH, ACK)" size="2" pos="46" show="0x0018" value="18" unmaskedvalue="8018"> + <field name="tcp.flags.res" showname="000. .... .... = Reserved: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.ns" showname="...0 .... .... = Nonce: Not set" size="1" pos="46" show="0" value="0" unmaskedvalue="80"/> + <field name="tcp.flags.cwr" showname=".... 0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ecn" showname=".... .0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.urg" showname=".... ..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.ack" showname=".... ...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.push" showname=".... .... 1... = Push: Set" size="1" pos="47" show="1" value="1" unmaskedvalue="18"/> + <field name="tcp.flags.reset" showname=".... .... .0.. = Reset: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.syn" showname=".... .... ..0. = Syn: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + <field name="tcp.flags.fin" showname=".... .... ...0 = Fin: Not set" size="1" pos="47" show="0" value="0" unmaskedvalue="18"/> + </field> + <field name="tcp.window_size_value" showname="Window size value: 342" size="2" pos="48" show="342" value="0156"/> + <field name="tcp.window_size" showname="Calculated window size: 43776" size="2" pos="48" show="43776" value="0156"/> + <field name="tcp.window_size_scalefactor" showname="Window size scaling factor: 128" size="2" pos="48" show="128" value="0156"/> + <field name="tcp.checksum" showname="Checksum: 0xfe44 [validation disabled]" size="2" pos="50" show="0xfe44" value="fe44"> + <field name="tcp.checksum_good" showname="Good Checksum: False" size="2" pos="50" show="0" value="fe44"/> + <field name="tcp.checksum_bad" showname="Bad Checksum: False" size="2" pos="50" show="0" value="fe44"/> + </field> + <field name="tcp.options" showname="Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps" size="12" pos="54" show="01:01:08:0a:5a:bb:71:69:5a:bb:71:67" value="0101080a5abb71695abb7167"> + <field name="" show="No-Operation (NOP)" size="1" pos="54" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="54" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="54" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="54" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="No-Operation (NOP)" size="1" pos="55" value="01"> + <field name="tcp.options.type" showname="Type: 1" size="1" pos="55" show="1" value="01"> + <field name="tcp.options.type.copy" showname="0... .... = Copy on fragmentation: No" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.class" showname=".00. .... = Class: Control (0)" size="1" pos="55" show="0" value="0" unmaskedvalue="01"/> + <field name="tcp.options.type.number" showname="...0 0001 = Number: No-Operation (NOP) (1)" size="1" pos="55" show="1" value="1" unmaskedvalue="01"/> + </field> + </field> + <field name="" show="Timestamps: TSval 1522233705, TSecr 1522233703" size="10" pos="56" value="080a5abb71695abb7167"> + <field name="tcp.option_kind" showname="Kind: Timestamp (8)" size="1" pos="56" show="8" value="08"/> + <field name="tcp.option_len" showname="Length: 10" size="1" pos="57" show="10" value="0a"/> + <field name="tcp.options.timestamp.tsval" showname="Timestamp value: 1522233705" size="4" pos="58" show="1522233705" value="5abb7169"/> + <field name="tcp.options.timestamp.tsecr" showname="Timestamp echo reply: 1522233703" size="4" pos="62" show="1522233703" value="5abb7167"/> + </field> + </field> + <field name="tcp.analysis" showname="SEQ/ACK analysis" size="0" pos="34" show="" value=""> + <field name="tcp.analysis.acks_frame" showname="This is an ACK to the segment in frame: 84" size="0" pos="34" show="84"/> + <field name="tcp.analysis.ack_rtt" showname="The RTT to ACK the segment was: 0.001578000 seconds" size="0" pos="34" show="0.001578000"/> + <field name="tcp.analysis.bytes_in_flight" showname="Bytes in flight: 28" size="0" pos="34" show="28"/> + </field> + <field name="tcp.pdu.size" showname="PDU Size: 28" size="28" pos="66" show="28" value="0000001c200080860000000100000002000000010000000800000000"/> + </proto> + <proto name="libvirt" showname="Libvirt" size="28" pos="66"> + <field name="libvirt.length" showname="length: 28" size="4" pos="66" show="28" value="0000001c"/> + <field name="libvirt.program" showname="program: REMOTE (0x20008086)" size="4" pos="70" show="0x20008086" value="20008086"/> + <field name="libvirt.version" showname="version: 1" size="4" pos="74" show="1" value="00000001"/> + <field name="libvirt.procedure" showname="procedure: CONNECT_CLOSE (2)" size="4" pos="78" show="2" value="00000002"/> + <field name="libvirt.type" showname="type: REPLY (1)" size="4" pos="82" show="1" value="00000001"/> + <field name="libvirt.serial" showname="serial: 8" size="4" pos="86" show="8" value="00000008"/> + <field name="libvirt.status" showname="status: OK (0)" size="4" pos="90" show="0" value="00000000"/> + </proto> +</packet> + + +</pdml> -- 1.8.1.5