Re: Interesting netflow entry

6 Feb 2006

      Here is another pattern, sourced off of one the destinations:

2006-02-06 10:37:17.392    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       68     1
2006-02-06 10:50:39.474    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 11:03:11.280    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 11:15:23.199    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 11:28:45.129    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 11:42:07.032    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 11:54:08.761    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 12:06:10.524    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 12:19:22.706    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 12:31:24.340    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 12:42:36.161    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 12:54:38.112    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 13:06:50.198    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 13:20:12.772    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 13:32:14.626    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1
2006-02-06 13:44:16.608    0.000 UDP  10.XX.XX.99:1204  ->  
BB.BB.BB.BB:15989        1       69     1

Looks like it atempts to hit every 10 minutes or so. I was able to grab 
a few packets, here they are:

No.     Time        Source                Destination           Protocol 
Info
   3047 3.587459    10.XX.XX.99       AA.AA.AA.AA         UDP      
Source port: 1204  Destination port: 33255

Frame 3047 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:55:20.087322000
    Time delta from previous packet: 3.587459000 seconds
    Time since reference or first frame: 3.587459000 seconds
    Frame Number: 3047
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
AA.AA.AA.AA (AA.AA.AA.AA)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x2254 (8788)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x748d (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: AA.AA.AA.AA (AA.AA.AA.AA)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 33255 (33255)
    Source port: 1204 (1204)
    Destination port: 33255 (33255)
    Length: 105
    Checksum: 0xb250 (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 54 00 00 80 11 74 8d c0 a8 cf cc 42 d7   .}"T....t.....B.
0020  d0 42 04 b4 81 e7 00 69 b2 50 c2 d3 02 96 e1 7d   .B.....i.P.....}
0030  27 ee 2f cb ab aa 64 67 d5 43 d6 b7 d7 54 22 41   './...dg.C...T"A
0040  f8 4f d3 cb 04 48 f8 33 20 a5 cf 1d f4 15 51 9e   .O...H.3 .....Q.
0050  9e 57 35 ca e4 76 54 06 54 67 7a 26 35 01 1d 5b   .W5..vT.Tgz&5..[
0060  70 b3 cf c3 20 e2 d6 30 8d df 0b ab 62 66 39 84   p... ..0....bf9.
0070  8d d2 f8 e5 9f ef 59 68 4c e3 7f 0c 19 65 6d 9b   ......YhL....em.
0080  cb 37 58 3e 2e 74 33 8e b9 4a c4                  .7X>.t3..J.

No.     Time        Source                Destination           Protocol 
Info
   3048 3.587463    10.XX.XX.99       BB.BB.BB.BB          UDP      
Source port: 1204  Destination port: 29717

Frame 3048 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:55:20.087326000
    Time delta from previous packet: 0.000004000 seconds
    Time since reference or first frame: 3.587463000 seconds
    Frame Number: 3048
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
BB.BB.BB.BB (BB.BB.BB.BB)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x2255 (8789)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xcf1c (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: BB.BB.BB.BB (BB.BB.BB.BB)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 29717 (29717)
    Source port: 1204 (1204)
    Destination port: 29717 (29717)
    Length: 105
    Checksum: 0x4535 (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 55 00 00 80 11 cf 1c c0 a8 cf cc 80 08   .}"U............
0020  38 81 04 b4 74 15 00 69 45 35 c2 d5 02 c3 13 75   8...t..iE5.....u
0030  ac 4f f8 39 72 d8 44 e3 92 6c 37 cf b5 58 fc 02   .O.9r.D..l7..X..
0040  26 14 f6 47 ae b0 82 d4 76 5a ec fe e2 4f 3e 80   &..G....vZ...O>.
0050  23 85 1f 60 6a 9c a3 a9 9e 0d cc 43 4c 94 f3 fa   #..`j......CL...
0060  b6 8a b5 b0 fe 49 b1 e1 82 6d b4 11 2f ac 23 75   .....I...m../.#u
0070  6a 1f 2c 63 73 88 bf 1a ce 00 23 66 87 68 01 c7   j.,cs.....#f.h..
0080  b9 fc ea 2f 00 ae 52 c8 b8 b5 df                  .../..R....

No.     Time        Source                Destination           Protocol 
Info
  19911 23.649703   10.XX.XX.99       CC.CC.CC.CC          UDP      
Source port: 1204  Destination port: 20797

Frame 19911 (146 bytes on wire, 146 bytes captured)
    Arrival Time: Feb  6, 2006 10:55:40.149566000
    Time delta from previous packet: 20.062240000 seconds
    Time since reference or first frame: 23.649703000 seconds
    Frame Number: 19911
    Packet Length: 146 bytes
    Capture Length: 146 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
CC.CC.CC.CC (CC.CC.CC.CC)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 132
    Identification: 0x228f (8847)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x8c04 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: CC.CC.CC.CC (CC.CC.CC.CC)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 20797 (20797)
    Source port: 1204 (1204)
    Destination port: 20797 (20797)
    Length: 112
    Checksum: 0x15fc (correct)
Data (104 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 84 22 8f 00 00 80 11 8c 04 c0 a8 cf cc dd 55   .."............U
0020  1e 0b 04 b4 51 3d 00 70 15 fc c2 d9 02 a9 3b 39   ....Q=.p......;9
0030  2d d1 01 58 c7 a7 23 ab d6 56 d4 ad cb fa b3 22   -..X..#..V....."
0040  54 93 1e cc bb 0f e4 e8 bf 0a 29 4a 1d 6a 20 63   T.........)J.j c
0050  f4 5c ee f2 5d 76 89 0d 07 38 1b 9c 42 f1 87 a5   .\..]v...8..B...
0060  01 d4 fd 33 9d aa 19 53 9b fd 2d 05 0a 86 79 9b   ...3...S..-...y.
0070  e7 f1 3c 58 d9 2c 4c 1e fc 40 22 ca 2a 55 bc 11   ..<X.,L..@".*U..
0080  36 15 32 d1 3f 76 65 b2 88 8c e5 54 7d 65 8f 5a   6.2.?ve....T}e.Z
0090  f6 55                                             .U

No.     Time        Source                Destination           Protocol 
Info
  27041 33.697119   10.XX.XX.99       DD.DD.DD.DD        UDP      Source 
port: 1204  Destination port: 52566

Frame 27041 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:55:50.196982000
    Time delta from previous packet: 10.047416000 seconds
    Time since reference or first frame: 33.697119000 seconds
    Frame Number: 27041
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
DD.DD.DD.DD (DD.DD.DD.DD)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x229d (8861)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xb7ea (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: DD.DD.DD.DD (DD.DD.DD.DD)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 52566 (52566)
    Source port: 1204 (1204)
    Destination port: 52566 (52566)
    Length: 105
    Checksum: 0xb8db (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 9d 00 00 80 11 b7 ea c0 a8 cf cc 47 c2   .}"...........G.
0020  87 b1 04 b4 cd 56 00 69 b8 db c2 dc 02 bf 81 54   .....V.i.......T
0030  7a 08 6e b9 51 9f 12 01 c4 d2 a1 53 27 f4 8c 6d   z.n.Q......S'..m
0040  05 dc 98 ab 5c a4 58 b5 e4 c8 65 a6 56 5c bf c8   ....\.X...e.V\..
0050  3d a9 49 01 7d ac 80 30 99 c6 bc 66 45 30 70 4a   =.I.}..0...fE0pJ
0060  7a 9d 94 f9 f9 b6 7f 16 32 d6 ed 3f 68 d2 b6 27   z.......2..?h..'
0070  b9 f8 d5 04 1d 68 79 76 81 f3 2d ad ef 48 a8 50   .....hyv..-..H.P
0080  ae 8f d6 b0 48 71 00 46 eb 49 34                  ....Hq.F.I4

No.     Time        Source                Destination           Protocol 
Info
  27042 33.697123   10.XX.XX.99       EE.EE.EE.EE         UDP      
Source port: 1204  Destination port: 20820

Frame 27042 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:55:50.196986000
    Time delta from previous packet: 0.000004000 seconds
    Time since reference or first frame: 33.697123000 seconds
    Frame Number: 27042
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
EE.EE.EE.EE (EE.EE.EE.EE)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x229e (8862)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x8829 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: EE.EE.EE.EE (EE.EE.EE.EE)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 20820 (20820)
    Source port: 1204 (1204)
    Destination port: 20820 (20820)
    Length: 105
    Checksum: 0x61dd (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 9e 00 00 80 11 88 29 c0 a8 cf cc 46 50   .}"......)....FP
0020  b8 e3 04 b4 51 54 00 69 61 dd c2 de 02 40 55 1a   ....QT.ia....@U.
0030  23 42 81 46 99 2f f6 96 fe fa e6 c6 11 79 3a 53   #B.F./.......y:S
0040  10 67 97 f8 34 ff 31 bd 6b 44 d2 db 52 d2 87 61   .g..4.1.kD..R..a
0050  59 f6 54 dd 3c 9a 0e 84 d5 63 86 0f f6 67 c6 b6   Y.T.<....c...g..
0060  61 d2 1e ba 7b 02 5d 5b 34 96 ca 35 f0 94 0a 29   a...{.][4..5...)
0070  56 02 5b cb 51 d5 7e 39 fc 77 e3 07 ff 69 cf b1   V.[.Q.~9.w...i..
0080  e4 98 fa b5 0f 97 ec 12 90 9d 0f                  ...........

No.     Time        Source                Destination           Protocol 
Info
  35007 43.728000   10.XX.XX.99       FF.FF.FF.FF          UDP      
Source port: 1204  Destination port: 12492

Frame 35007 (143 bytes on wire, 143 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:00.227863000
    Time delta from previous packet: 10.030877000 seconds
    Time since reference or first frame: 43.728000000 seconds
    Frame Number: 35007
    Packet Length: 143 bytes
    Capture Length: 143 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
FF.FF.FF.FF (FF.FF.FF.FF)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 129
    Identification: 0x22a1 (8865)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x8ab6 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: FF.FF.FF.FF (FF.FF.FF.FF)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 12492 (12492)
    Source port: 1204 (1204)
    Destination port: 12492 (12492)
    Length: 109
    Checksum: 0x5625 (correct)
Data (101 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 81 22 a1 00 00 80 11 8a b6 c0 a8 cf cc db 49   .."............I
0020  21 56 04 b4 30 cc 00 6d 56 25 c2 e0 02 f0 9c f7   !V..0..mV%......
0030  78 a7 a3 bf 8b 25 00 c5 a9 b3 cb 6e 54 3a 10 3b   x....%.....nT:.;
0040  ae c0 98 ca 52 93 49 ac df 5a f6 c5 c0 2b f6 42   ....R.I..Z...+.B
0050  04 85 b0 42 cb 47 d6 31 4f d0 b9 1a 4a 37 a6 a7   ...B.G.1O...J7..
0060  70 c0 d8 8c 52 55 b7 d4 06 5c cd ec c5 46 18 96   p...RU...\...F..
0070  39 92 b0 02 28 a7 43 ad e4 dd f3 cf b9 35 3b 99   9...(.C......5;.
0080  a6 2c 0c eb a5 a0 ec 91 fb b7 fb f5 1b 46 c0      .,...........F.

No.     Time        Source                Destination           Protocol 
Info
  36900 45.727218   10.XX.XX.99       FF.FF.FF.FF          UDP      
Source port: 1204  Destination port: 12492

Frame 36900 (143 bytes on wire, 143 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:02.227081000
    Time delta from previous packet: 1.999218000 seconds
    Time since reference or first frame: 45.727218000 seconds
    Frame Number: 36900
    Packet Length: 143 bytes
    Capture Length: 143 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
FF.FF.FF.FF (FF.FF.FF.FF)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 129
    Identification: 0x22aa (8874)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x8aad (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: FF.FF.FF.FF (FF.FF.FF.FF)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 12492 (12492)
    Source port: 1204 (1204)
    Destination port: 12492 (12492)
    Length: 109
    Checksum: 0xa8ab (correct)
Data (101 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 81 22 aa 00 00 80 11 8a ad c0 a8 cf cc db 49   .."............I
0020  21 56 04 b4 30 cc 00 6d a8 ab c2 e0 02 9d bb 85   !V..0..m........
0030  89 a7 a3 bf 8b cb 2e cb fd bc 69 68 47 0b 65 72   ..........ihG.er
0040  f4 b8 dd 06 1c 1d 49 4a 9f 63 eb fa 78 02 33 69   ......IJ.c..x.3i
0050  ce 38 2a 82 9c 55 b4 63 7e 06 0b 11 cb c2 fa 6c   .8*..U.c~......l
0060  89 d3 05 30 1e 0f 16 b5 99 1c 9c 01 e9 52 4c de   ...0.........RL.
0070  00 89 93 cf 33 2b e4 8a 13 47 54 c4 02 a3 54 c1   ....3+...GT...T.
0080  e4 42 2d 07 10 7d 68 8c 2d fa 63 d5 03 c9 56      .B-..}h.-.c...V

No.     Time        Source                Destination           Protocol 
Info
  41917 49.729064   10.XX.XX.99       FF.FF.FF.FF          UDP      
Source port: 1204  Destination port: 12492

Frame 41917 (143 bytes on wire, 143 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:06.228927000
    Time delta from previous packet: 4.001846000 seconds
    Time since reference or first frame: 49.729064000 seconds
    Frame Number: 41917
    Packet Length: 143 bytes
    Capture Length: 143 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
FF.FF.FF.FF (FF.FF.FF.FF)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 129
    Identification: 0x22ab (8875)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x8aac (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: FF.FF.FF.FF (FF.FF.FF.FF)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 12492 (12492)
    Source port: 1204 (1204)
    Destination port: 12492 (12492)
    Length: 109
    Checksum: 0x33fc (correct)
Data (101 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 81 22 ab 00 00 80 11 8a ac c0 a8 cf cc db 49   .."............I
0020  21 56 04 b4 30 cc 00 6d 33 fc c2 e0 02 5a 7b 26   !V..0..m3....Z{&
0030  26 a7 a3 bf 8b 68 93 61 f5 6a f9 81 15 08 ee cc   &....h.a.j......
0040  58 e6 9d fc 65 34 c3 f8 be 11 05 12 da ec 61 8a   X...e4........a.
0050  ed 23 0a 12 0d e6 7c 7a 65 8a dc 9e 80 b4 87 2c   .#....|ze......,
0060  ce 17 4f e0 51 19 2c 70 a8 56 a8 4e 34 02 a3 64   ..O.Q.,p.V.N4..d
0070  9b cb 82 12 6d 7d 2b 04 89 9d 2e 94 e9 53 9c b3   ....m}+......S..
0080  08 74 7d 35 e9 63 58 1b dd af c0 f9 df e9 03      .t}5.cX........

No.     Time        Source                Destination           Protocol 
Info
  46877 53.727996   10.XX.XX.99       GG.GG.GG.GG        UDP      Source 
port: 1204  Destination port: 31923

Frame 46877 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:10.227859000
    Time delta from previous packet: 3.998932000 seconds
    Time since reference or first frame: 53.727996000 seconds
    Frame Number: 46877
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
GG.GG.GG.GG (GG.GG.GG.GG)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x22ad (8877)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x5480 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: GG.GG.GG.GG (GG.GG.GG.GG)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 31923 (31923)
    Source port: 1204 (1204)
    Destination port: 31923 (31923)
    Length: 105
    Checksum: 0xebdc (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 ad 00 00 80 11 54 80 c0 a8 cf cc 8c 71   .}".....T......q
0020  a6 5c 04 b4 7c b3 00 69 eb dc c2 e2 02 db b3 bc   .\..|..i........
0030  df 3d 5c 9c cb da 78 92 9c 57 06 8d dc c7 f5 75   .=\...x..W.....u
0040  b0 f7 c2 34 2d d1 3d ac 80 cc b9 c3 3d e3 1c 2e   ...4-.=.....=...
0050  e0 cd 6d be 6a 14 be c9 b4 39 b1 9a 83 1e 62 25   ..m.j....9....b%
0060  27 f6 b4 aa 59 3c 86 da f0 e1 7a 5b 2c f5 0d fa   '...Y<....z[,...
0070  34 28 81 bb 61 3d f0 a5 d8 21 a9 e3 be 5a 99 f0   4(..a=...!...Z..
0080  04 33 db 92 ea 2a 3a db 1b 19 c5                  .3...*:....

No.     Time        Source                Destination           Protocol 
Info
  54612 63.727988   10.XX.XX.99       HH.HH.HH.HH        UDP      Source 
port: 1204  Destination port: 24692

Frame 54612 (139 bytes on wire, 139 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:20.227851000
    Time delta from previous packet: 9.999992000 seconds
    Time since reference or first frame: 63.727988000 seconds
    Frame Number: 54612
    Packet Length: 139 bytes
    Capture Length: 139 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
HH.HH.HH.HH (HH.HH.HH.HH)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 125
    Identification: 0x22b2 (8882)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xc826 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: HH.HH.HH.HH (HH.HH.HH.HH)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 24692 (24692)
    Source port: 1204 (1204)
    Destination port: 24692 (24692)
    Length: 105
    Checksum: 0xe9cb (correct)
Data (97 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7d 22 b2 00 00 80 11 c8 26 c0 a8 cf cc 48 80   .}"......&....H.
0020  76 a2 04 b4 60 74 00 69 e9 cb c2 e4 02 cc 64 d4   v...`t.i......d.
0030  04 26 d4 bc 18 fe 58 06 ed ce 6d 7f ad e4 fe fc   .&....X...m.....
0040  98 0f 78 b3 35 38 2f 13 44 23 0e f9 bc 33 99 56   ..x.58/.D#...3.V
0050  66 bb 34 40 bd b1 bf ff a0 78 68 1e 52 ee ef 8e   f.4@.....xh.R...
0060  50 94 1e ab 02 69 5e 9f de 41 8d 7a 34 54 cd 50   P....i^..A.z4T.P
0070  34 82 19 43 28 79 38 00 ed da f2 ae 60 12 64 08   4..C(y8.....`.d.
0080  6f bc 48 e8 eb 9f e3 3d 13 6e 37                  o.H....=.n7

No.     Time        Source                Destination           Protocol 
Info
  62647 73.762311   10.XX.XX.99       II.II.II.II        UDP      Source 
port: 1204  Destination port: 62233

Frame 62647 (143 bytes on wire, 143 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:30.262174000
    Time delta from previous packet: 10.034323000 seconds
    Time since reference or first frame: 73.762311000 seconds
    Frame Number: 62647
    Packet Length: 143 bytes
    Capture Length: 143 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
II.II.II.II (II.II.II.II)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 129
    Identification: 0x22b5 (8885)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x7f3c (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: II.II.II.II (II.II.II.II)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 62233 (62233)
    Source port: 1204 (1204)
    Destination port: 62233 (62233)
    Length: 109
    Checksum: 0x0d32 (correct)
Data (101 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 81 22 b5 00 00 80 11 7f 3c c0 a8 cf cc 80 c3   .."......<......
0020  87 42 04 b4 f3 19 00 6d 0d 32 c2 e6 02 9f 86 3d   .B.....m.2.....=
0030  a5 de 64 df d3 98 38 a8 75 8e 24 97 b9 cd 9a f3   ..d...8.u.$.....
0040  5a 0e 01 8a 26 2f 03 1f 9e 3b 41 97 d0 be 4a 7e   Z...&/...;A...J~
0050  b4 92 2e b0 28 92 67 81 36 b7 78 38 24 10 9c 03   ....(.g.6.x8$...
0060  e9 cc 34 d6 59 58 2f b8 53 b2 45 cd ca e4 bf 18   ..4.YX/.S.E.....
0070  61 a1 f6 1c 5b 61 62 35 b3 6b e7 29 a6 0e c3 ac   a...[ab5.k.)....
0080  31 12 c0 5b a0 f7 21 35 f4 82 c5 1a 9a 8f c1      1..[..!5.......

No.     Time        Source                Destination           Protocol 
Info
  70287 83.790717   10.XX.XX.99       JJ.JJ.JJ.JJ       UDP      Source 
port: 1204  Destination port: 17152

Frame 70287 (148 bytes on wire, 148 bytes captured)
    Arrival Time: Feb  6, 2006 10:56:40.290580000
    Time delta from previous packet: 10.028406000 seconds
    Time since reference or first frame: 83.790717000 seconds
    Frame Number: 70287
    Packet Length: 148 bytes
    Capture Length: 148 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
JJ.JJ.JJ.JJ (JJ.JJ.JJ.JJ)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 134
    Identification: 0x22bb (8891)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x4ca3 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: JJ.JJ.JJ.JJ (JJ.JJ.JJ.JJ)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 17152 (17152)
    Source port: 1204 (1204)
    Destination port: 17152 (17152)
    Length: 114
    Checksum: 0xf481 (correct)
Data (106 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 86 22 bb 00 00 80 11 4c a3 c0 a8 cf cc 8a ed   ..".....L.......
0020  af a6 04 b4 43 00 00 72 f4 81 c2 e8 02 cd 46 00   ....C..r......F.
0030  92 03 e6 9d 78 f4 a9 9c 58 f3 38 29 e2 e3 cc 61   ....x...X.8)...a
0040  24 29 90 67 76 f6 2d fe b1 b7 9d a5 0f a2 89 77   $).gv.-........w
0050  46 a7 a5 d6 8a 61 e0 57 04 01 b8 ed db 02 ef cc   F....a.W........
0060  3c 07 67 43 3b 26 52 9c cf 86 83 61 86 e5 d3 71   <.gC;&R....a...q
0070  c4 74 13 6c 6d 62 7e e2 97 11 98 3f 39 cf a1 88   .t.lmb~....?9...
0080  96 6d a7 ec 15 2d b6 32 4d 43 56 20 d7 db 46 67   .m...-.2MCV ..Fg
0090  58 a4 1e 6d                                       X..m

No.     Time        Source                Destination           Protocol 
Info
  85194 103.821590  10.XX.XX.99       KK.KK.KK.KK        UDP      Source 
port: 1204  Destination port: 21163

Frame 85194 (144 bytes on wire, 144 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:00.321453000
    Time delta from previous packet: 20.030873000 seconds
    Time since reference or first frame: 103.821590000 seconds
    Frame Number: 85194
    Packet Length: 144 bytes
    Capture Length: 144 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
KK.KK.KK.KK (KK.KK.KK.KK)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 130
    Identification: 0x22c5 (8901)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x9aad (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: KK.KK.KK.KK (KK.KK.KK.KK)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 21163 (21163)
    Source port: 1204 (1204)
    Destination port: 21163 (21163)
    Length: 110
    Checksum: 0x1a44 (correct)
Data (102 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 82 22 c5 00 00 80 11 9a ad c0 a8 cf cc 45 fb   .."...........E.
0020  a6 88 04 b4 52 ab 00 6e 1a 44 c2 ea 02 ef a8 21   ....R..n.D.....!
0030  5b ed 71 5e 8d a8 56 e0 5b dc ad da f0 c5 b8 7f   [.q^..V.[.......
0040  08 61 38 6c 9a fb 40 50 71 05 ac f0 4f 13 b5 d7   .a8l..@Pq...O...
0050  d1 71 61 48 0f 0a 10 10 be 69 25 7d 21 49 3f 02   .qaH.....i%}!I?.
0060  e5 d8 f7 da de d8 38 7f 33 1e 17 5c c0 55 9d 4f   ......8.3..\.U.O
0070  47 78 d7 db a8 48 e7 df 50 99 2c a9 33 7c ea 78   Gx...H..P.,.3|.x
0080  8d c8 f9 3a fa c9 f6 36 98 6f a6 bf e3 fb e5 98   ...:...6.o......

No.     Time        Source                Destination           Protocol 
Info
  92757 113.925668  10.XX.XX.99       LL.LL.LL.LL          UDP      
Source port: 1204  Destination port: 47756

Frame 92757 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:10.425531000
    Time delta from previous packet: 10.104078000 seconds
    Time since reference or first frame: 113.925668000 seconds
    Frame Number: 92757
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
LL.LL.LL.LL (LL.LL.LL.LL)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22cc (8908)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x691a (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: LL.LL.LL.LL (LL.LL.LL.LL)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 47756 (47756)
    Source port: 1204 (1204)
    Destination port: 47756 (47756)
    Length: 40
    Checksum: 0x5d43 (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 cc 00 00 80 11 69 1a c0 a8 cf cc 44 46   .<".....i.....DF
0020  da 0f 04 b4 ba 8c 00 28 5d 43 c2 ee 02 94 af 97   .......(]C......
0030  50 93 9e ae 35 51 fa b9 2b cf 93 f6 94 96 15 95   P...5Q..+.......
0040  cc 30 21 a9 15 1d 2b f6 07 09                     .0!...+...

No.     Time        Source                Destination           Protocol 
Info
  93939 115.930237  10.XX.XX.99       LL.LL.LL.LL          UDP      
Source port: 1204  Destination port: 47756

Frame 93939 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:12.430100000
    Time delta from previous packet: 2.004569000 seconds
    Time since reference or first frame: 115.930237000 seconds
    Frame Number: 93939
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
LL.LL.LL.LL (LL.LL.LL.LL)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22cf (8911)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x6917 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: LL.LL.LL.LL (LL.LL.LL.LL)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 47756 (47756)
    Source port: 1204 (1204)
    Destination port: 47756 (47756)
    Length: 40
    Checksum: 0xa6ec (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 cf 00 00 80 11 69 17 c0 a8 cf cc 44 46   .<".....i.....DF
0020  da 0f 04 b4 ba 8c 00 28 a6 ec c2 ee 02 92 9b 7d   .......(.......}
0030  81 93 9e ae 35 bc 79 a7 36 ed d3 e4 cd 6d bb 50   ....5.y.6....m.P
0040  e2 14 39 74 3d 84 46 8b 86 d8                     ..9t=.F...

No.     Time        Source                Destination           Protocol 
Info
  96712 119.945946  10.XX.XX.99       LL.LL.LL.LL          UDP      
Source port: 1204  Destination port: 47756

Frame 96712 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:16.445809000
    Time delta from previous packet: 4.015709000 seconds
    Time since reference or first frame: 119.945946000 seconds
    Frame Number: 96712
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
LL.LL.LL.LL (LL.LL.LL.LL)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22d3 (8915)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x6913 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: LL.LL.LL.LL (LL.LL.LL.LL)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 47756 (47756)
    Source port: 1204 (1204)
    Destination port: 47756 (47756)
    Length: 40
    Checksum: 0xbdb6 (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 d3 00 00 80 11 69 13 c0 a8 cf cc 44 46   .<".....i.....DF
0020  da 0f 04 b4 ba 8c 00 28 bd b6 c2 ee 02 c9 64 4f   .......(......dO
0030  be 93 9e ae 35 a4 cf ed 47 51 02 b2 10 23 3a 3a   ....5...GQ...#::
0040  a6 d1 48 06 48 1b c7 98 b4 13                     ..H.H.....

No.     Time        Source                Destination           Protocol 
Info
  99713 123.915702  10.XX.XX.99       LL.LL.LL.LL          UDP      
Source port: 1204  Destination port: 47756

Frame 99713 (138 bytes on wire, 138 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:20.415565000
    Time delta from previous packet: 3.969756000 seconds
    Time since reference or first frame: 123.915702000 seconds
    Frame Number: 99713
    Packet Length: 138 bytes
    Capture Length: 138 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
LL.LL.LL.LL (LL.LL.LL.LL)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 124
    Identification: 0x22d6 (8918)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x68d0 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: LL.LL.LL.LL (LL.LL.LL.LL)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 47756 (47756)
    Source port: 1204 (1204)
    Destination port: 47756 (47756)
    Length: 104
    Checksum: 0x733e (correct)
Data (96 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 7c 22 d6 00 00 80 11 68 d0 c0 a8 cf cc 44 46   .|".....h.....DF
0020  da 0f 04 b4 ba 8c 00 68 73 3e c2 f0 02 ad 1e c3   .......hs>......
0030  97 f1 df 58 8f 9c 69 12 55 8b a7 90 f0 e3 6b 32   ...X..i.U.....k2
0040  82 6a 86 43 99 8f 2d bf 4d 56 24 51 cc 7a e3 d0   .j.C..-.MV$Q.z..
0050  f0 9e 3e 4d a8 46 99 4e ac d4 6e c9 63 f4 a1 14   ..>M.F.N..n.c...
0060  2d 01 d7 9c 24 e4 7e d9 6a 7b b2 d7 ec 29 05 91   -...$.~.j{...)..
0070  72 d5 9e 0d e8 7e a9 97 3a 99 85 6d dd 25 1d f9   r....~..:..m.%..
0080  fd c1 38 4e 74 e4 be e9 6d c7                     ..8Nt...m.

No.     Time        Source                Destination           Protocol 
Info
 107611 133.962136  10.XX.XX.99       MM.MM.MM.MM        UDP      Source 
port: 1204  Destination port: 64099

Frame 107611 (73 bytes on wire, 73 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:30.461999000
    Time delta from previous packet: 10.046434000 seconds
    Time since reference or first frame: 133.962136000 seconds
    Frame Number: 107611
    Packet Length: 73 bytes
    Capture Length: 73 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
MM.MM.MM.MM (MM.MM.MM.MM)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 59
    Identification: 0x22d9 (8921)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x4570 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: MM.MM.MM.MM (MM.MM.MM.MM)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 64099 (64099)
    Source port: 1204 (1204)
    Destination port: 64099 (64099)
    Length: 39
    Checksum: 0xc2cc (correct)
Data (31 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3b 22 d9 00 00 80 11 45 70 c0 a8 cf cc 89 63   .;".....Ep.....c
0020  b8 90 04 b4 fa 63 00 27 c2 cc c2 f2 02 f5 28 8d   .....c.'......(.
0030  5c 5d 0b c7 8a 03 b3 d6 12 89 14 d2 e8 d9 57 24   \]............W$
0040  f9 d2 a9 54 63 63 fa f9 6e                        ...Tcc..n

No.     Time        Source                Destination           Protocol 
Info
 107612 133.962140  10.XX.XX.99       MM.MM.MM.MM        UDP      Source 
port: 1204  Destination port: 64099

Frame 107612 (73 bytes on wire, 73 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:30.462003000
    Time delta from previous packet: 0.000004000 seconds
    Time since reference or first frame: 133.962140000 seconds
    Frame Number: 107612
    Packet Length: 73 bytes
    Capture Length: 73 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
MM.MM.MM.MM (MM.MM.MM.MM)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 59
    Identification: 0x22d9 (8921)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x4570 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: MM.MM.MM.MM (MM.MM.MM.MM)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 64099 (64099)
    Source port: 1204 (1204)
    Destination port: 64099 (64099)
    Length: 39
    Checksum: 0xc2cc (correct)
Data (31 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3b 22 d9 00 00 80 11 45 70 c0 a8 cf cc 89 63   .;".....Ep.....c
0020  b8 90 04 b4 fa 63 00 27 c2 cc c2 f2 02 f5 28 8d   .....c.'......(.
0030  5c 5d 0b c7 8a 03 b3 d6 12 89 14 d2 e8 d9 57 24   \]............W$
0040  f9 d2 a9 54 63 63 fa f9 6e                        ...Tcc..n

No.     Time        Source                Destination           Protocol 
Info
 114626 143.993502  10.XX.XX.99       NN.NN.NN.NN        UDP      Source 
port: 1204  Destination port: 59448

Frame 114626 (72 bytes on wire, 72 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:40.493365000
    Time delta from previous packet: 10.031362000 seconds
    Time since reference or first frame: 143.993502000 seconds
    Frame Number: 114626
    Packet Length: 72 bytes
    Capture Length: 72 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
NN.NN.NN.NN (NN.NN.NN.NN)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 58
    Identification: 0x22e1 (8929)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x9c37 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: NN.NN.NN.NN (NN.NN.NN.NN)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 59448 (59448)
    Source port: 1204 (1204)
    Destination port: 59448 (59448)
    Length: 38
    Checksum: 0x1de0 (correct)
Data (30 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3a 22 e1 00 00 80 11 9c 37 c0 a8 cf cc 42 82   .:"......7....B.
0020  a8 a3 04 b4 e8 38 00 26 1d e0 c2 f4 02 ee 03 21   .....8.&.......!
0030  1d c5 15 68 43 8b 7e a9 3d 96 ad 9b 99 d0 9b 33   ...hC.~.=......3
0040  85 c1 ed 79 93 6a 93 f8                           ...y.j..

No.     Time        Source                Destination           Protocol 
Info
 114627 143.993505  10.XX.XX.99       NN.NN.NN.NN        UDP      Source 
port: 1204  Destination port: 59448

Frame 114627 (72 bytes on wire, 72 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:40.493368000
    Time delta from previous packet: 0.000003000 seconds
    Time since reference or first frame: 143.993505000 seconds
    Frame Number: 114627
    Packet Length: 72 bytes
    Capture Length: 72 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
NN.NN.NN.NN (NN.NN.NN.NN)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 58
    Identification: 0x22e1 (8929)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x9c37 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: NN.NN.NN.NN (NN.NN.NN.NN)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 59448 (59448)
    Source port: 1204 (1204)
    Destination port: 59448 (59448)
    Length: 38
    Checksum: 0x1de0 (correct)
Data (30 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3a 22 e1 00 00 80 11 9c 37 c0 a8 cf cc 42 82   .:"......7....B.
0020  a8 a3 04 b4 e8 38 00 26 1d e0 c2 f4 02 ee 03 21   .....8.&.......!
0030  1d c5 15 68 43 8b 7e a9 3d 96 ad 9b 99 d0 9b 33   ...hC.~.=......3
0040  85 c1 ed 79 93 6a 93 f8                           ...y.j..

No.     Time        Source                Destination           Protocol 
Info
 122447 154.000312  10.XX.XX.99       OO.OO.OO.OO         UDP      
Source port: 1204  Destination port: 19454

Frame 122447 (75 bytes on wire, 75 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:50.500175000
    Time delta from previous packet: 10.006807000 seconds
    Time since reference or first frame: 154.000312000 seconds
    Frame Number: 122447
    Packet Length: 75 bytes
    Capture Length: 75 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
OO.OO.OO.OO (OO.OO.OO.OO)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 61
    Identification: 0x22ea (8938)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xd283 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: OO.OO.OO.OO (OO.OO.OO.OO)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 19454 (19454)
    Source port: 1204 (1204)
    Destination port: 19454 (19454)
    Length: 41
    Checksum: 0x92f6 (correct)
Data (33 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3d 22 ea 00 00 80 11 d2 83 c0 a8 cf cc 3b bd   .="...........;.
0020  79 10 04 b4 4b fe 00 29 92 f6 c2 f6 02 e2 4d 3f   y...K..)......M?
0030  aa fc d7 9c 3f e2 31 4a 9b d3 5f c7 75 9d 91 db   ....?.1J.._.u...
0040  56 44 db 24 4f b8 ab 8e 10 0e 90                  VD.$O......

No.     Time        Source                Destination           Protocol 
Info
 122448 154.000314  10.XX.XX.99       OO.OO.OO.OO         UDP      
Source port: 1204  Destination port: 19454

Frame 122448 (75 bytes on wire, 75 bytes captured)
    Arrival Time: Feb  6, 2006 10:57:50.500177000
    Time delta from previous packet: 0.000002000 seconds
    Time since reference or first frame: 154.000314000 seconds
    Frame Number: 122448
    Packet Length: 75 bytes
    Capture Length: 75 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
OO.OO.OO.OO (OO.OO.OO.OO)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 61
    Identification: 0x22ea (8938)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0xd283 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: OO.OO.OO.OO (OO.OO.OO.OO)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 19454 (19454)
    Source port: 1204 (1204)
    Destination port: 19454 (19454)
    Length: 41
    Checksum: 0x92f6 (correct)
Data (33 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3d 22 ea 00 00 80 11 d2 83 c0 a8 cf cc 3b bd   .="...........;.
0020  79 10 04 b4 4b fe 00 29 92 f6 c2 f6 02 e2 4d 3f   y...K..)......M?
0030  aa fc d7 9c 3f e2 31 4a 9b d3 5f c7 75 9d 91 db   ....?.1J.._.u...
0040  56 44 db 24 4f b8 ab 8e 10 0e 90                  VD.$O......

No.     Time        Source                Destination           Protocol 
Info
 129495 164.099765  10.XX.XX.99       PP.PP.PP.PP           UDP      
Source port: 1204  Destination port: 1258

Frame 129495 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:58:00.599628000
    Time delta from previous packet: 10.099451000 seconds
    Time since reference or first frame: 164.099765000 seconds
    Frame Number: 129495
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
PP.PP.PP.PP (PP.PP.PP.PP)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22f0 (8944)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x2f7c (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: PP.PP.PP.PP (PP.PP.PP.PP)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 1258 (1258)
    Source port: 1204 (1204)
    Destination port: 1258 (1258)
    Length: 40
    Checksum: 0x8aee (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 f0 00 00 80 11 2f 7c c0 a8 cf cc 52 0a   .<"...../|....R.
0020  05 c6 04 b4 04 ea 00 28 8a ee c2 fa 02 63 c1 df   .......(.....c..
0030  93 e7 3f 82 59 c6 df 5c 2b 6e 50 18 dd 11 7a 77   ..?.Y..\+nP...zw
0040  e7 39 ee 85 da 33 63 01 08 fd                     .9...3c...

No.     Time        Source                Destination           Protocol 
Info
 129496 164.099769  10.XX.XX.99       PP.PP.PP.PP           UDP      
Source port: 1204  Destination port: 1258

Frame 129496 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:58:00.599632000
    Time delta from previous packet: 0.000004000 seconds
    Time since reference or first frame: 164.099769000 seconds
    Frame Number: 129496
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
PP.PP.PP.PP (PP.PP.PP.PP)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22f0 (8944)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x2f7c (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: PP.PP.PP.PP (PP.PP.PP.PP)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 1258 (1258)
    Source port: 1204 (1204)
    Destination port: 1258 (1258)
    Length: 40
    Checksum: 0x8aee (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 f0 00 00 80 11 2f 7c c0 a8 cf cc 52 0a   .<"...../|....R.
0020  05 c6 04 b4 04 ea 00 28 8a ee c2 fa 02 63 c1 df   .......(.....c..
0030  93 e7 3f 82 59 c6 df 5c 2b 6e 50 18 dd 11 7a 77   ..?.Y..\+nP...zw
0040  e7 39 ee 85 da 33 63 01 08 fd                     .9...3c...

No.     Time        Source                Destination           Protocol 
Info
 130806 166.086581  10.XX.XX.99       PP.PP.PP.PP           UDP      
Source port: 1204  Destination port: 1258

Frame 130806 (74 bytes on wire, 74 bytes captured)
    Arrival Time: Feb  6, 2006 10:58:02.586444000
    Time delta from previous packet: 1.986812000 seconds
    Time since reference or first frame: 166.086581000 seconds
    Frame Number: 130806
    Packet Length: 74 bytes
    Capture Length: 74 bytes
Ethernet II, Src: 00:12:3f:34:b1:8d, Dst: 00:00:0c:07:ac:cf
    Destination: 00:00:0c:07:ac:cf (10.XX.XX.1)
    Source: 00:12:3f:34:b1:8d (10.XX.XX.99)
    Type: IP (0x0800)
Internet Protocol, Src Addr: 10.XX.XX.99 (10.XX.XX.99), Dst Addr: 
PP.PP.PP.PP (PP.PP.PP.PP)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 60
    Identification: 0x22f4 (8948)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x2f78 (correct)
    Source: 10.XX.XX.99 (10.XX.XX.99)
    Destination: PP.PP.PP.PP (PP.PP.PP.PP)
User Datagram Protocol, Src Port: 1204 (1204), Dst Port: 1258 (1258)
    Source port: 1204 (1204)
    Destination port: 1258 (1258)
    Length: 40
    Checksum: 0x8b56 (correct)
Data (32 bytes)

0000  00 00 0c 07 ac cf 00 12 3f 34 b1 8d 08 00 45 00   ........?4....E.
0010  00 3c 22 f4 00 00 80 11 2f 78 c0 a8 cf cc 52 0a   .<"...../x....R.
0020  05 c6 04 b4 04 ea 00 28 8b 56 c2 fa 02 9a 2d c2   .......(.V....-.
0030  28 e7 3f 82 59 47 85 d8 67 3e 42 04 46 46 e4 63   (.?.YG..g>B.FF.c
0040  ac d0 51 d3 f0 a6 42 57 41 f5                     ..Q...BWA.

Re: Interesting netflow entry

Wil Schultz