# ICMP coding question for Utility



## Kreij (Jul 24, 2008)

I am writing a utility to do a lot of useful things, network-wise, encompassed in a GUI.

Part of the program runs a trace route. 
I am doing the standard increment of time-to-live to get the router information in between the destination and the local machine. This works fine.

The problem is that when a router returns a TTL expired message (which I use to get the host that sent it) I cannot get valid round trip (millisecond) information on the response. If the PingReply status is not "Success" then it returns nulls in most of the class properties.

So what I do is after the router returns the TTL expired message, I do an echo request to the router itself.  The MS tracert command also uses ICMP requests.

I get timeouts for a ton of routers, but the tracert program returns round trip times.
From everything that I have read the tracert program does not switch to UDP datagrams to try to correct for this (similar to some of the Unix traceroute commands).

I've tried allowing fragmented packets in case the routers are not configured correctly, but that did not help.

Any thoughts on this?  I am not sure why the command line tracert program will return times, but my echo requests time out even when they are set to very high levels (10 seconds or more).

Added : I also noticed that a windows command line ping will time out, but tracert will not. What the heck is tracert doing ? LOL

Thanks.


----------



## Oliver_FF (Jul 24, 2008)

tracert takes a very... interesting... view of a network when it establishes where packets are heading. It's actually a pretty stone-age idea but works great 

The basic principle lies in the the ICMP Time Exceeded responses - when an ICMP packet's TTL reaches 0 whichever host is currently holding the packet sends back this response saying "Look, we've passed this packet around for ages - don't think it's ever going to get where you want it to...". This response does however contain the address of the host that it timed out on. So, how do you work out a packets route over a network?

Easy - start with a TTL of 1. Send it on it's way. Wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired...

So how do you know the round trip time? It's simply the difference between the time you sent the ICMP message and the time you recieved the TTLExpired 

Now, tracert sends not 1 but 3 packets at each stage. I'm not 100% sure, but pretty confident that by sending 3 the chances of getting to a far-out host are increased as more routes between you and them are covered - on a network there is no easy way of knowing that forwarding a packet to XXX instead of YYY will result in a packet arriving or not arriving...

A ping might timeout because it's only 4 attempts going in the same direction? Whereas tracert sends 3 packets over and over until it gets what it wants or passes 255 hops... Thats a lot more packets  4 vs 765 - most of the latter might be headed in different directions too!


----------



## Kreij (Jul 24, 2008)

Oliver_FF said:


> tracert takes a very... interesting... view of a network when it establishes where packets are heading. It's actually a pretty stone-age idea but works great
> 
> The basic principle lies in the the ICMP Time Exceeded responses - when an ICMP packet's TTL reaches 0 whichever host is currently holding the packet sends back this response saying "Look, we've passed this packet around for ages - don't think it's ever going to get where you want it to...". This response does however contain the address of the host that it timed out on. So, how do you work out a packets route over a network?
> 
> Easy - start with a TTL of 1. Send it on it's way. Wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired. Increase the TTL by 1, send it on it's way, wait for the TTLExpired...



That is what my code does. Starts with TTL of 1 and increments to get all of the routers between host and destination. That works great. I get all of the routers between my location and the TPU servers.

There is a little wierdness with the MS methods, however.

If you use the current GetHostEntry method...

```
IPHostEntry IpHost = Dns.GetHostEntry(IpAddress);
```

 ... on some routers the code will kick back a socket exception. If you trap the exception
and call the now obsoleted method GetHostByAddress() it works. Something is amiss in the new methods.

So like ...

```
IPHostEntry ipHost;

try
{
    ipHost = Dns.GetHostEntry(IPAddress);
}
catch (SocketException se)
{
    try
    {
        ipHost = Dns.GetHostByAddress(IPAddress);  // This call is obsoleted
    }
    catch (Exception e)
    {
        // Total failure
    }
}
```



> So how do you know the round trip time? It's simply the difference between the time you sent the ICMP message and the time you recieved the TTLExpired



LOL ... I know that it's just that the Ping.Send() method does not return a RoundTrip value on anything other than a status of Success. (TTLExpired returns 0 in the RoundTrip property).



> Now, tracert sends not 1 but 3 packets at each stage. I'm not 100% sure, but pretty confident that by sending 3 the chances of getting to a far-out host are increased as more routes between you and them are covered - on a network there is no easy way of knowing that forwarding a packet to XXX instead of YYY will result in a packet arriving or not arriving...



That all depends on the route that they are taking. If all three packets use the same route, then there chance of success (or failure) is the same. There is also the issue of return routes. The packets may get to the router, but depending on how they are routed back will determine if they arrive or not. 



> A ping might timeout because it's only 4 attempts going in the same direction? Whereas tracert sends 3 packets over and over until it gets what it wants or passes 255 hops... Thats a lot more packets  4 vs 765 - most of the latter might be headed in different directions too!



Well hops aren't the issue as from here to TPU is only 20 hops. I understand that some of the routers may be blocking direct ICMP Echo requests (causing a ping to timeout), but I know that tracert is using ICMP and it works. I can always trap the failed ping and try a UDP datagram packet to port 33434 (the typical one datagrams use when looking for unused ports) but I shouldn't have to do that.

It's probably something in the new methods and I'll probably end up having to write my own packet construction class and custom echo request methods. !$##$#!@#$!@


----------



## Oliver_FF (Jul 24, 2008)

My main point was that although TTLExpired doesn't give you the round trip time, you can simply calculate it using a timer and forgo trying to ping stuff to get it to time it for you 


```
IPHostEntry IpHost = Dns.GetHostEntry(IpAddress);
```
It's interesting that if the new function doesn't return the obsolete one works... Might be interesting to browse the source code for it - isn't .NET open source at the moment? Or heading in that direction?



> If all three packets use the same route, then there chance of success (or failure) is the same.


Yes, the -chance- of success is the same. Suppose it's 33%. That's one packet in three  It's common place for packets to just disappear - that's why most things are based on TCP and it's sliding window. The network is not reliable. Especially when not using TCP XD


----------



## Kreij (Jul 24, 2008)

Yeah, I took the easy way out and just used Enviroment.TickCount

```
start = Environment.TickCount;
PingReply pingReply = ping.Send(thisHost, 1000, buffer, pingOptions);
end = Environment.TickCount;
```

I wonder what else tracert is doing? Even though I am only sending one packet, my program runs about 50 times faster than tracert. 
Although, I do get more fluctuation in the results on a given run due to latency at the particular time. 
I wonder if they are doing more packets than three and introducing some kind of averaging.


----------



## Oliver_FF (Jul 24, 2008)

I'll sniff it out in a second, take a look at what it sends - although i'll only get a hold of the replies.


```
C:\Users\Oliver>tracert www.techpowerup.com

Tracing route to www.techpowerup.com [74.86.91.2]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.0.1
  2    14 ms    14 ms    14 ms  217.47.90.xxx
  3    15 ms    14 ms    13 ms  217.47.90.161
  4    13 ms    13 ms    14 ms  217.47.45.170
  5    13 ms    12 ms    14 ms  217.41.177.9
  6    14 ms    14 ms    13 ms  217.41.177.66
  7    14 ms    13 ms     *     217.41.177.142
  8    14 ms    14 ms    13 ms  217.41.177.38
  9    13 ms    13 ms    14 ms  217.47.93.49
 10    14 ms    14 ms    13 ms  core1-pos5-6.faraday.ukcore.bt.net [194.72.4.17]
 11    14 ms    14 ms    14 ms  core1-pos0-1-1-0.ilford.ukcore.bt.net [62.6.204.73]
 12    13 ms    14 ms    14 ms  transit2-gig8/0/0.ilford.ukcore.bt.net [194.74.77.178]
 13    13 ms    14 ms    14 ms  t2c2-ge14-0-0.uk-ilf.eu.bt.net [166.49.168.121]
 14    14 ms    13 ms    14 ms  t2c2-p5-0-0.uk-lon2.eu.bt.net [166.49.195.138]
 15    22 ms    20 ms    21 ms  t2c2-p1-0.nl-ams2.eu.bt.net [166.49.208.129]
 16    20 ms    20 ms    22 ms  t2a7-prc2.nl-ams2.eu.bt.net [166.49.200.33]
 17    21 ms    20 ms    21 ms  acr1-ge-5-3-0.Amsterdamamx.savvis.net [195.69.145.60]
 18    22 ms    21 ms    21 ms  dcr1-so-1-0-0.amsterdamamx.savvis.net [204.70.193.146]
 19     *        *      159 ms  cr2-loopback.dan.savvis.net [208.172.130.71]
 20   152 ms   152 ms   152 ms  dpr1-ge-4-0-0.dallasequinix.savvis.net [204.70.196.30]
 21   140 ms   141 ms   139 ms  er1-te-2-1.dallasequinix.savvis.net [204.70.204.145]
 22   151 ms   153 ms   151 ms  te1-1.cer02.dal01.dallas-datacenter.com [208.175.175.10]
 23   140 ms   141 ms   140 ms  po2.dar01.dal01.dallas-datacenter.com [66.228.118.205]
 24   140 ms   140 ms   140 ms  po1.fcr02.dal01.dallas-datacenter.com [66.228.118.178]
 25   141 ms   142 ms   143 ms  www1.techpowerup.com [74.86.91.2]

Trace complete.
```


```
Welcome to Eyeball!
Useage...
eyeball [IP-address] [packet-count] (ml) (o)
eg... eyeball 192.168.0.2 0 m
--> eyeball 192.168.0.2 0 m

Socket created!
Options set!
Socket bound to 192.168.0.2!
IO controls set!
Waiting for 0 packets...


Packet 0: at 1216915728
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 120bytes, Id: 13025
Fragment: 0, TTL: 255, HL: 5wds, Protocol: 1
Source: 192.168.0.1, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[137][0][0]
[1][1][19][22][192][168][0][2]JV[[2][8][0][247]
[244][0][1][0]
[0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0]
------------------Packet Ends------------------


Packet 1: at 1216915728
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 120bytes, Id: 13026
Fragment: 0, TTL: 255, HL: 5wds, Protocol: 1
Source: 192.168.0.1, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[138][0][0]
[1][1][19][21][192][168][0][2]JV[[2][8][0][247]
[243][0][1][0][11][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0]
------------------Packet Ends------------------


Packet 2: at 1216915728
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 120bytes, Id: 13027
Fragment: 0, TTL: 255, HL: 5wds, Protocol: 1
Source: 192.168.0.1, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[139][0][0]
[1][1][19][20][192][168][0][2]JV[[2][8][0][247]
[242][0][1][0][12][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0]
------------------Packet Ends------------------


Packet 3: at 1216915734
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 126, HL: 5wds, Protocol: 1
Source: 217.47.90.250, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[143][0][0]
[1][1][19][16][192][168][0][2]JV[[2][8][0][247]
[241][0][1][0]
------------------Packet Ends------------------


Packet 4: at 1216915734
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 126, HL: 5wds, Protocol: 1
Source: 217.47.90.250, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[144][0][0]
[1][1][19][15][192][168][0][2]JV[[2][8][0][247]
[240][0][1][0][14]
------------------Packet Ends------------------


Packet 5: at 1216915734
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 126, HL: 5wds, Protocol: 1
Source: 217.47.90.250, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[145][0][0]
[1][1][19][14][192][168][0][2]JV[[2][8][0][247]
[239][0][1][0][15]
------------------Packet Ends------------------


Packet 6: at 1216915739
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 52393
Fragment: 0, TTL: 253, HL: 5wds, Protocol: 1
Source: 217.47.90.161, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[149][0][0]
[1][1][19]
[192][168][0][2]JV[[2][8][0][247][238]
[0][1][0][16]
------------------Packet Ends------------------


Packet 7: at 1216915739
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 52394
Fragment: 0, TTL: 253, HL: 5wds, Protocol: 1
Source: 217.47.90.161, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[150][0][0]
[1][1][19][9][192][168][0][2]JV[[2][8][0][247][237]
[0][1][0][17]
------------------Packet Ends------------------


Packet 8: at 1216915739
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 52395
Fragment: 0, TTL: 253, HL: 5wds, Protocol: 1
Source: 217.47.90.161, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[151][0][0]
[1][1][19][8][192][168][0][2]JV[[2][8][0][247][236]
[0][1][0][18]
------------------Packet Ends------------------


Packet 9: at 1216915745
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50555
Fragment: 0, TTL: 244, HL: 5wds, Protocol: 1
Source: 217.47.45.170, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[155][0][0]
[1][1][19][4][192][168][0][2]JV[[2][8][0][247][235]
[0][1][0][19]
------------------Packet Ends------------------


Packet 10: at 1216915745
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50559
Fragment: 0, TTL: 244, HL: 5wds, Protocol: 1
Source: 217.47.45.170, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[156][0][0]
[1][1][19][3][192][168][0][2]JV[[2][8][0][247][234]
[0][1][0][20]
------------------Packet Ends------------------


Packet 11: at 1216915745
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50560
Fragment: 0, TTL: 244, HL: 5wds, Protocol: 1
Source: 217.47.45.170, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[157][0][0]
[1][1][19][2][192][168][0][2]JV[[2][8][0][247][233]
[0][1][0][21]
------------------Packet Ends------------------


Packet 12: at 1216915751
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 72bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 59421
Length: 52, Checksum: 99
     -------------Data Begins-------------
&[245][129][2][0][1][0][0][0][0][0][0][3]170[2]
45[2]47[3]217[7]in-addr[4]arpa[0][0][12][0][1]
------------------Packet Ends------------------


Packet 13: at 1216915756
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50641
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.9, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[165][0][0]
[1][1][18][250][192][168][0][2]JV[[2][8][0][247]
[232][0][1][0][22]
------------------Packet Ends------------------


Packet 14: at 1216915756
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50642
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.9, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[166][0][0]
[1][1][18][249][192][168][0][2]JV[[2][8][0][247]
[231][0][1][0][23]
------------------Packet Ends------------------


Packet 15: at 1216915756
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 50644
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.9, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[167][0][0]
[1][1][18][248][192][168][0][2]JV[[2][8][0][247]
[230][0][1][0][24]
------------------Packet Ends------------------


Packet 16: at 1216915761
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 71bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 63857
Length: 51, Checksum: 7522
     -------------Data Begins-------------
[194]
[129][2][0][1][0][0][0][0][0][0][1]9[3]17
7[2]41[3]217[7]in-addr[4]arpa[0][0][12][0][1]
------------------Packet Ends------------------


Packet 17: at 1216915767
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 16014
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.66, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[175][0][0]
[1][1][18][240][192][168][0][2]JV[[2][8][0][247]
[229][0][1][0][25]
------------------Packet Ends------------------


Packet 18: at 1216915767
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 16017
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.66, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[176][0][0]
[1][1][18][239][192][168][0][2]JV[[2][8][0][247]
[228][0][1][0][26]
------------------Packet Ends------------------


Packet 19: at 1216915767
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 16018
Fragment: 0, TTL: 251, HL: 5wds, Protocol: 1
Source: 217.41.177.66, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[177][0][0]
[1][1][18][238][192][168][0][2]JV[[2][8][0][247]
[227][0][1][0][27]
------------------Packet Ends------------------


Packet 20: at 1216915773
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 72bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 59669
Length: 52, Checksum: 17589
     -------------Data Begins-------------
[178][213][129][2][0][1][0][0][0][0][0][0][2]66
[3]177[2]41[3]217[7]in-addr[4]arpa[0][0][12][0]
[1]
------------------Packet Ends------------------


Packet 21: at 1216915779
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 9594
Fragment: 0, TTL: 250, HL: 5wds, Protocol: 1
Source: 217.41.177.142, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[185][0][0]
[1][1][18][230][192][168][0][2]JV[[2][8][0][247]
[226][0][1][0][28]
------------------Packet Ends------------------


Packet 22: at 1216915779
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 9598
Fragment: 0, TTL: 250, HL: 5wds, Protocol: 1
Source: 217.41.177.142, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[186][0][0]
[1][1][18][229][192][168][0][2]JV[[2][8][0][247]
[225][0][1][0][29]
------------------Packet Ends------------------


Packet 23: at 1216915787
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 73bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 49566
Length: 53, Checksum: 25709
     -------------Data Begins-------------
[124][164][129][2][0][1][0][0][0][0][0][0][3]14
2[3]177[2]41[3]217[7]in-addr[4]arpa[0][0][12][0]
[1]
------------------Packet Ends------------------


Packet 24: at 1216915792
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 31897
Fragment: 0, TTL: 244, HL: 5wds, Protocol: 1
Source: 217.41.177.38, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[195][0][0]
[1][1][18][220][192][168][0][2]JV[[2][8][0][247]
[223][0][1][0]▼
------------------Packet Ends------------------


Packet 25: at 1216915792
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 31898
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 217.41.177.38, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[196][0][0]
[1][1][18][219][192][168][0][2]JV[[2][8][0][247]
[222][0][1][0]
------------------Packet Ends------------------


Packet 26: at 1216915792
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 31899
Fragment: 0, TTL: 244, HL: 5wds, Protocol: 1
Source: 217.41.177.38, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[197][0][0]
[1][1][18][218][192][168][0][2]JV[[2][8][0][247]
[221][0][1][0]!
------------------Packet Ends------------------


Packet 27: at 1216915798
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 72bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 58163
Length: 52, Checksum: 56032
     -------------Data Begins-------------
 [143][129][2][0][1][0][0][0][0][0][0][2]38[3]1
77[2]41[3]217[7]in-addr[4]arpa[0][0][12][0][1]
------------------Packet Ends------------------


Packet 28: at 1216915804
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 217.47.93.49, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[205][0][0]
[1][1][18][210][192][168][0][2]JV[[2][8][0][247]
[220][0][1][0]"
------------------Packet Ends------------------


Packet 29: at 1216915804
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 217.47.93.49, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[206][0][0]
[1][1][18][209][192][168][0][2]JV[[2][8][0][247]
[219][0][1][0]#
------------------Packet Ends------------------


Packet 30: at 1216915804
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 217.47.93.49, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[207][0][0]
[1][1][18][208][192][168][0][2]JV[[2][8][0][247]
[218][0][1][0]$
------------------Packet Ends------------------


Packet 31: at 1216915809
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 71bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 59727
Length: 51, Checksum: 36151
     -------------Data Begins-------------
#[143][129][2][0][1][0][0][0][0][0][0][2]49[2]9
3[2]47[3]217[7]in-addr[4]arpa[0][0][12][0][1]
------------------Packet Ends------------------


Packet 32: at 1216915814
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 247, HL: 5wds, Protocol: 1
Source: 194.72.4.17, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[215][0][0]
[1][1][18][200][192][168][0][2]JV[[2][8][0][247]
[217][0][1][0]%
------------------Packet Ends------------------


Packet 33: at 1216915814
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 247, HL: 5wds, Protocol: 1
Source: 194.72.4.17, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[216][0][0]
[1][1][18][199][192][168][0][2]JV[[2][8][0][247]
[216][0][1][0]&
------------------Packet Ends------------------


Packet 34: at 1216915814
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 247, HL: 5wds, Protocol: 1
Source: 194.72.4.17, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[217][0][0]
[1][1][18][198][192][168][0][2]JV[[2][8][0][247]
[215][0][1][0]'
------------------Packet Ends------------------


Packet 35: at 1216915814
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 118bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 64634
Length: 98, Checksum: 14647
     -------------Data Begins-------------
}@[129][128][0][1][0][1][0][0][0][0][2]17[1]4[2]
72[3]194[7]in-addr[4]arpa[0][0][12][0][1][192][12]
[0][12][0][1][0][1]Q[128][0]$[12]core1-pos5-6[7]
faraday[6]ukcore[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 36: at 1216915815
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 36482
Fragment: 0, TTL: 246, HL: 5wds, Protocol: 1
Source: 62.6.204.73, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0]([187][234][203][225]xE[0][0]\@[219][0][0]
[1][1][18][196][192][168][0][2]JV[[2][8][0][247]
[214][0][1][0](
------------------Packet Ends------------------


Packet 37: at 1216915815
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 36483
Fragment: 0, TTL: 246, HL: 5wds, Protocol: 1
Source: 62.6.204.73, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0]t[249][234][205][149]8E[0][0]\@[220][0][0]
[1][1][18][195][192][168][0][2]JV[[2][8][0][247]
[213][0][1][0])
------------------Packet Ends------------------


Packet 38: at 1216915815
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 36484
Fragment: 0, TTL: 246, HL: 5wds, Protocol: 1
Source: 62.6.204.73, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0]([187][234][203][225]xE[0][0]\@[221][0][0]
[1][1][18][194][192][168][0][2]JV[[2][8][0][247]
[212][0][1][0]*
------------------Packet Ends------------------


Packet 39: at 1216915815
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 121bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 49349
Length: 101, Checksum: 54975
     -------------Data Begins-------------
[159][136][129][128][0][1][0][1][0][0][0][0][2]
73[3]204[1]6[2]62[7]in-addr[4]arpa[0][0][12][0]
[1][192][12][0][12][0][1][0][1]Q[128][0]'[16]co
re1-pos0-1-1-0[6]ilford[6]ukcore[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 40: at 1216915816
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 194.74.77.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[223][0][0]
[1][1][18][192][192][168][0][2]JV[[2][8][0][247]
[211][0][1][0]+
------------------Packet Ends------------------


Packet 41: at 1216915816
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 194.74.77.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[224][0][0]
[1][1][18][191][192][168][0][2]JV[[2][8][0][247]
[210][0][1][0],
------------------Packet Ends------------------


Packet 42: at 1216915816
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 245, HL: 5wds, Protocol: 1
Source: 194.74.77.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[225][0][0]
[1][1][18][190][192][168][0][2]JV[[2][8][0][247]
[209][0][1][0]-
------------------Packet Ends------------------


Packet 43: at 1216915816
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 124bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 60684
Length: 104, Checksum: 5477
     -------------Data Begins-------------
H[21][129][128][0][1][0][1][0][0][0][0][3]178[2]
77[2]74[3]194[7]in-addr[4]arpa[0][0][12][0][1][192]
[12][0][12][0][1][0][1]Q[128][0]([17]transit2-g
ig8/0/0[6]ilford[6]ukcore[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 44: at 1216915817
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.168.121, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[227][0][0]
[1][1][18][188][192][168][0][2]JV[[2][8][0][247]
[208][0][1][0].
------------------Packet Ends------------------


Packet 45: at 1216915817
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.168.121, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[228][0][0]
[1][1][18][187][192][168][0][2]JV[[2][8][0][247]
[207][0][1][0]/
------------------Packet Ends------------------


Packet 46: at 1216915817
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.168.121, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[229][0][0]
[1][1][18][186][192][168][0][2]JV[[2][8][0][247]
[206][0][1][0]0
------------------Packet Ends------------------


Packet 47: at 1216915818
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 117bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 62589
Length: 97, Checksum: 19181
     -------------Data Begins-------------
[197]6[129][128][0][1][0][1][0][0][0][0][3]121[3]
168[2]49[3]166[7]in-addr[4]arpa[0][0][12][0][1]
t2c2-g12][0][12][0][1][0][0][14][16][0]
e14-0-0[6]uk-ilf[2]eu[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 48: at 1216915818
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 40bytes, Id: 6692
Fragment: 1024, TTL: 51, HL: 5wds, Protocol: 6
Source: 88.221.26.98, Destination: 192.168.0.2
Source Port: 80, Destination Port: 53172
Sequence: 2028020807, Acknowledgment: 336865579
TCPHdr Size: 5, Flags: FIN ACK
     -------------Data Begins-------------

------------------Packet Ends------------------


Packet 49: at 1216915818
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 40bytes, Id: 25740
Fragment: 1024, TTL: 51, HL: 5wds, Protocol: 6
Source: 88.221.26.80, Destination: 192.168.0.2
Source Port: 80, Destination Port: 53178
Sequence: 2040307934, Acknowledgment: 421083342
TCPHdr Size: 5, Flags: FIN ACK
     -------------Data Begins-------------

------------------Packet Ends------------------


Packet 50: at 1216915819
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.195.138, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[235][0][0]
[1][1][18][180][192][168][0][2]JV[[2][8][0][247]
[205][0][1][0]1
------------------Packet Ends------------------


Packet 51: at 1216915819
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.195.138, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[236][0][0]
[1][1][18][179][192][168][0][2]JV[[2][8][0][247]
[204][0][1][0]2
------------------Packet Ends------------------


Packet 52: at 1216915819
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 243, HL: 5wds, Protocol: 1
Source: 166.49.195.138, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[237][0][0]
[1][1][18][178][192][168][0][2]JV[[2][8][0][247]
[203][0][1][0]3
------------------Packet Ends------------------


Packet 53: at 1216915819
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 116bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 50796
Length: 96, Checksum: 47139
     -------------Data Begins-------------
6[169][129][128][0][1][0][1][0][0][0][0][3]138[3]
195[2]49[3]166[7]in-addr[4]arpa[0][0][12][0][1]
[192][12][0][12][0][1][0][0][14][16][0]▼[11]t2c
2-p5-0-0[7]uk-lon2[2]eu[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 54: at 1216915820
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 242, HL: 5wds, Protocol: 1
Source: 166.49.208.129, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[239][0][0]
[1][1][18][176][192][168][0][2]JV[[2][8][0][247]
[202][0][1][0]4
------------------Packet Ends------------------


Packet 55: at 1216915820
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 242, HL: 5wds, Protocol: 1
Source: 166.49.208.129, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[240][0][0]
[1][1][18][175][192][168][0][2]JV[[2][8][0][247]
[201][0][1][0]5
------------------Packet Ends------------------


Packet 56: at 1216915820
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 242, HL: 5wds, Protocol: 1
Source: 166.49.208.129, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[241][0][0]
[1][1][18][174][192][168][0][2]JV[[2][8][0][247]
[200][0][1][0]6
------------------Packet Ends------------------


Packet 57: at 1216915820
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 114bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 65373
Length: 94, Checksum: 52067
     -------------Data Begins-------------
3[171][129][128][0][1][0][1][0][0][0][0][3]129[3]
208[2]49[3]166[7]in-addr[4]arpa[0][0][12][0][1]
[192][12][0][12][0][1][0][0][14][16][0][29][9]t
2c2-p1-0[7]nl-ams2[2]eu[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 58: at 1216915821
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 241, HL: 5wds, Protocol: 1
Source: 166.49.200.33, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[243][0][0]
[1][1][18][172][192][168][0][2]JV[[2][8][0][247]
[199][0][1][0]7
------------------Packet Ends------------------


Packet 59: at 1216915821
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 241, HL: 5wds, Protocol: 1
Source: 166.49.200.33, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[244][0][0]
[1][1][18][171][192][168][0][2]JV[[2][8][0][247]
[198][0][1][0]8
------------------Packet Ends------------------


Packet 60: at 1216915821
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 241, HL: 5wds, Protocol: 1
Source: 166.49.200.33, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[245][0][0]
[1][1][18][170][192][168][0][2]JV[[2][8][0][247]
[197][0][1][0]9
------------------Packet Ends------------------


Packet 61: at 1216915821
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 113bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 52123
Length: 93, Checksum: 41728
     -------------Data Begins-------------
[213]O[129][128][0][1][0][1][0][0][0][0][2]33[3]
200[2]49[3]166[7]in-addr[4]arpa[0][0][12][0][1]
[192][12][0][12][0][1][0][0][14][16][0][29][9]t
2a7-prc2[7]nl-ams2[2]eu[2]bt[3]net[0]
------------------Packet Ends------------------


Packet 62: at 1216915822
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 195.69.145.60, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[247][0][0]
[1][1][18][168][192][168][0][2]JV[[2][8][0][247]
[196][0][1][0]:
------------------Packet Ends------------------


Packet 63: at 1216915822
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 195.69.145.60, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[248][0][0]
[1][1][18][167][192][168][0][2]JV[[2][8][0][247]
[195][0][1][0];
------------------Packet Ends------------------


Packet 64: at 1216915822
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 195.69.145.60, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[249][0][0]
[1][1][18][166][192][168][0][2]JV[[2][8][0][247]
[194][0][1][0]<
------------------Packet Ends------------------


Packet 65: at 1216915822
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 123bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 60302
Length: 103, Checksum: 6390
     -------------Data Begins-------------
[20]H[129][128][0][1][0][1][0][0][0][0][2]60[3]
145[2]69[3]195[7]in-addr[4]arpa[0][0][12][0][1]
acr1-ge-5[0][12][0][1][0][0][28] [0]'
-3-0[12]Amsterdamamx[6]savvis[3]net[0]
------------------Packet Ends------------------


Packet 66: at 1216915823
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 204.70.193.146, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[251][0][0]
[1][1][18][164][192][168][0][2]JV[[2][8][0][247]
[193][0][1][0]=
------------------Packet Ends------------------


Packet 67: at 1216915823
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 204.70.193.146, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[252][0][0]
[1][1][18][163][192][168][0][2]JV[[2][8][0][247]
[192][0][1][0]>
------------------Packet Ends------------------


Packet 68: at 1216915823
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 238, HL: 5wds, Protocol: 1
Source: 204.70.193.146, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\@[253][0][0]
[1][1][18][162][192][168][0][2]JV[[2][8][0][247]
[191][0][1][0]?
------------------Packet Ends------------------


Packet 69: at 1216915823
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 124bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 60375
Length: 104, Checksum: 39395
     -------------Data Begins-------------
[27]K[129][128][0][1][0][1][0][0][0][0][3]146[3]
193[2]70[3]204[7]in-addr[4]arpa[0][0][12][0][1]
dcr1-s12][0][12][0][1][0][0][14][16][0]'
o-1-0-0[12]amsterdamamx[6]savvis[3]net[0]
------------------Packet Ends------------------


Packet 70: at 1216915833
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 22805
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 208.172.130.71, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][186][7]H▼[242][216]E[0][0]\A[1][0][0][1]
[1][18][158][192][168][0][2]JV[[2][8][0][247][188]
[0][1][0]B
------------------Packet Ends------------------


Packet 71: at 1216915833
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 114bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 57243
Length: 94, Checksum: 58367
     -------------Data Begins-------------
s[231][129][128][0][1][0][1][0][0][0][0][2]71[3]
130[3]172[3]208[7]in-addr[4]arpa[0][0][12][0][1]
[192][12][0][12][0][1][0][0][14][16][0][29][12]
cr2-loopback[3]dan[6]savvis[3]net[0]
------------------Packet Ends------------------


Packet 72: at 1216915834
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 204.70.196.30, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[3][0][0]
[1][1][18][156][192][168][0][2]JV[[2][8][0][247]
[187][0][1][0]C
------------------Packet Ends------------------


Packet 73: at 1216915834
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 204.70.196.30, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[4][0][0]
[1][1][18][155][192][168][0][2]JV[[2][8][0][247]
[186][0][1][0]D
------------------Packet Ends------------------


Packet 74: at 1216915834
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 0
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 204.70.196.30, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[5][0][0]
[1][1][18][154][192][168][0][2]JV[[2][8][0][247]
[185][0][1][0]E
------------------Packet Ends------------------


Packet 75: at 1216915834
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 124bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 58589
Length: 104, Checksum: 19040
     -------------Data Begins-------------
XQ[129][128][0][1][0][1][0][0][0][0][2]30[3]196
[2]70[3]204[7]in-addr[4]arpa[0][0][12][0][1][192]
dal1-ge-4-0-0][1][0][0]8@[0](
lasequinix[6]savvis[3]net[0]
------------------Packet Ends------------------


Packet 76: at 1216915835
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 38688
Fragment: 0, TTL: 237, HL: 5wds, Protocol: 1
Source: 204.70.204.145, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[7][0][0]
[1][1][18][152][192][168][0][2]JV[[2][8][0][247]
[184][0][1][0]F
------------------Packet Ends------------------


Packet 77: at 1216915835
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 38690
Fragment: 0, TTL: 237, HL: 5wds, Protocol: 1
Source: 204.70.204.145, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[8][0][0]
[1][1][18][151][192][168][0][2]JV[[2][8][0][247]
[183][0][1][0]G
------------------Packet Ends------------------


Packet 78: at 1216915835
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 38696
Fragment: 0, TTL: 237, HL: 5wds, Protocol: 1
Source: 204.70.204.145, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[9][0][0]
[1][1][18][150][192][168][0][2]JV[[2][8][0][247]
[182][0][1][0]H
------------------Packet Ends------------------


Packet 79: at 1216915836
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 122bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 57080
Length: 102, Checksum: 5593
     -------------Data Begins-------------
[12][224][129][128][0][1][0][1][0][0][0][0][3]1
45[3]204[2]70[3]204[7]in-addr[4]arpa[0][0][12][0]
[1][192][12][0][12][0][1][0][0]8@[0]%
er1-te-2-
dallasequinix[6]savvis[3]net[0]
------------------Packet Ends------------------


Packet 80: at 1216915837
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 14523
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 208.175.175.10, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[11][0][0]
[1][1][18][148][192][168][0][2]JV[[2][8][0][247]
[181][0][1][0]I
------------------Packet Ends------------------


Packet 81: at 1216915837
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 14544
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 208.175.175.10, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[12][0][0]
[1][1][18][147][192][168][0][2]JV[[2][8][0][247]
[180][0][1][0]J
------------------Packet Ends------------------


Packet 82: at 1216915837
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 14553
Fragment: 0, TTL: 236, HL: 5wds, Protocol: 1
Source: 208.175.175.10, Destination: 192.168.0.2
     -------------Data Begins-------------
[0][0][1]44][255][0][0][0][0]E[0][0]\A
[1][18][146][192][168][0][2]JV[[2][8][0][247][179]
[0][1][0]K
------------------Packet Ends------------------


Packet 83: at 1216915837
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 126bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 56719
Length: 106, Checksum: 6514
     -------------Data Begins-------------
[222][178][129][128][0][1][0][1][0][0][0][0][2]
10[3]175[3]175[3]208[7]in-addr[4]arpa[0][0][12]
[0][1][192][12][0][12][0][1][0][0][14][16][0])[5]
te1-1[5]cer02[5]dal01[17]dallas-datacenter[3]co
m[0]
------------------Packet Ends------------------


Packet 84: at 1216915838
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 30651
Fragment: 0, TTL: 234, HL: 5wds, Protocol: 1
Source: 66.228.118.205, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[15][0][0]
[1][1][18][144][192][168][0][2]JV[[2][8][0][247]
[178][0][1][0]L
------------------Packet Ends------------------


Packet 85: at 1216915838
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 30654
Fragment: 0, TTL: 234, HL: 5wds, Protocol: 1
Source: 66.228.118.205, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[16][0][0]
[1][1][18][143][192][168][0][2]JV[[2][8][0][247]
[177][0][1][0]M
------------------Packet Ends------------------


Packet 86: at 1216915838
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 30662
Fragment: 0, TTL: 234, HL: 5wds, Protocol: 1
Source: 66.228.118.205, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[17][0][0]
[1][1][18][142][192][168][0][2]JV[[2][8][0][247]
[176][0][1][0]N
------------------Packet Ends------------------


Packet 87: at 1216915839
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 124bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 58803
Length: 104, Checksum: 50697
     -------------Data Begins-------------
[130]I[129][128][0][1][0][1][0][0][0][0][3]205[3]
118[3]228[2]66[7]in-addr[4]arpa[0][0][12][0][1]
[192][12][0][12][0][1][0][1]Q[128][0]'[3]po2[5]
dar01[5]dal01[17]dallas-datacenter[3]com[0]
------------------Packet Ends------------------


Packet 88: at 1216915840
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 56282
Fragment: 0, TTL: 232, HL: 5wds, Protocol: 1
Source: 66.228.118.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[19][0][0]
[1][1][18][140][192][168][0][2]JV[[2][8][0][247]
[175][0][1][0]O
------------------Packet Ends------------------


Packet 89: at 1216915840
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 56291
Fragment: 0, TTL: 232, HL: 5wds, Protocol: 1
Source: 66.228.118.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[20][0][0]
[1][1][18][139][192][168][0][2]JV[[2][8][0][247]
[174][0][1][0]P
------------------Packet Ends------------------


Packet 90: at 1216915840
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 56bytes, Id: 56297
Fragment: 0, TTL: 232, HL: 5wds, Protocol: 1
Source: 66.228.118.178, Destination: 192.168.0.2
     -------------Data Begins-------------
[11][0][244][255][0][0][0][0]E[0][0]\A[21][0][0]
[1][1][18][138][192][168][0][2]JV[[2][8][0][247]
[173][0][1][0]Q
------------------Packet Ends------------------


Packet 91: at 1216915840
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 124bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 56668
Length: 104, Checksum: 27543
     -------------Data Begins-------------
[220][14][129][128][0][1][0][1][0][0][0][0][3]1
78[3]118[3]228[2]66[7]in-addr[4]arpa[0][0][12][0]
[1][192][12][0][12][0][1][0][1]Q[128][0]'[3]po1
[5]fcr02[5]dal01[17]dallas-datacenter[3]com[0]
------------------Packet Ends------------------


Packet 92: at 1216915841
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 92bytes, Id: 32326
Fragment: 0, TTL: 40, HL: 5wds, Protocol: 1
Source: 74.86.91.2, Destination: 192.168.0.2
     -------------Data Begins-------------
[0][0][255][172][0][1][0]R[0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0]
------------------Packet Ends------------------


Packet 93: at 1216915841
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 92bytes, Id: 32327
Fragment: 0, TTL: 40, HL: 5wds, Protocol: 1
Source: 74.86.91.2, Destination: 192.168.0.2
     -------------Data Begins-------------
[0][0][255][171][0][1][0]S[0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0]
------------------Packet Ends------------------


Packet 94: at 1216915841
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 92bytes, Id: 32328
Fragment: 0, TTL: 40, HL: 5wds, Protocol: 1
Source: 74.86.91.2, Destination: 192.168.0.2
     -------------Data Begins-------------
[0][0][255][170][0][1][0]T[0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0][0][0][0][0][0][0][0]
[0][0][0][0][0][0][0][0][0]
------------------Packet Ends------------------


Packet 95: at 1216915842
-----------------Packet Begins-----------------
IP Version: 4, Packet Size: 103bytes, Id: 0
Fragment: 1024, TTL: 64, HL: 5wds, Protocol: 17
Source: 192.168.0.1, Destination: 192.168.0.2
Source Port: 53, Destination Port: 60920
Length: 83, Checksum: 34400
     -------------Data Begins-------------
b[196][129][128][0][1][0][1][0][0][0][0][1]2[2]
91[2]86[2]74[7]in-addr[4]arpa[0][0][12][0][1][192]
[12][0][12][0][1][0][1]Q[128][0][22][4]www1[11]
techpowerup[3]com[0]
------------------Packet Ends------------------
```

If you look you can see the 3 packets firing off with Protocol:1, then there's one UDP response Protocol:17 every time the address gets resolved. Everything in []'s are undisplayable characters btw

For the packets with Protocol:1, the initial [11] means that it's a TTLExpired thing, if it's followed by [0] it means the TTL expired in transit. The rest is just checksums, IDs and general fluff.

I wonder why it doesn't even attempt to resolve the first 10...


----------



## Kreij (Jul 24, 2008)

@Oliver_FF : Thanks for the sniff info. I read numerous posts that said tracert did not use any UDP. I guess they were wrong.
I wonder if tracert is doing syncronous sends, one after another, or if they are using threaded async ones?

So far my utility app does;
1) Single machine pings with adjustable buffer (packet data) size and multiple iterations.
2) Trace route (up to 128 hops).
3) Subnet node discovery (subnet walking) with variable node count from initial address (so you can type in 192.168.0.10 and tell it to walk the next 10 nodes to see if anything is there), adjustable echo timeouts, local or remote subnets and the ability to only display found nodes (as opposed to displaying all addresses, even the ones with nothing on them) if you like. Currently working on getting the netbios names from local subnet computers. It's not as straightforward as it could be. I think I will have to use WMI.

I am thinking of adding more WMI capabilites for getting information on remote computers (process, hardware, software, etc.).

I was also contemplating putting in a port checker, so you can see which posts are open in other computers on a subnet. I think that would be useful to keep an eye on system security.

In addition, I was pondering adding a packet sniffer and outsourcing the code dev to Oliver_FF 

Anyone have any other ideas for additional functionality in the existing parts or new stuff for either administration or security ?

PS. I aptly named the utility, "Snoop".


----------



## Oliver_FF (Jul 25, 2008)

Sweet, this sounds pretty cool 

To throw in my 2-cents i'd say that after doing a traceroute you should store the results for a little while and use them to generate like a network map. Say you're on a large LAN and you traceroute two distant corners of it, then use the results to make like a simple diagram of how the network is layed out? You could try and gather some limited information about each intermediate jump, space them out based on their latency. It could be a sweet app for someone with network issues as you could effectively redraw your network from a Packet perspective - stretched areas would show the places where the traffic is bottlenecking and non-existent routes might show off dodgy cable or hardware.

Anyway, as for packet sniffing i've already got well-documented classes that you can simply slap in from my C# .NET sniffer i wrote. It covers TCP and UDP packets in extreme depth, it's mega simple to extend it for other protocols.

You can also use a sniffer to work out the amount of packet loss between two places - a sniffer will pick up every packet, even the ones that arrive corrupt and get re-sent. If you know what to look for you can single out the packets that get re-sent.


----------



## Oliver_FF (Jul 25, 2008)

Sadly Snoop is taken - I knew there was a reason why i didn't use that name for my sniffer haha

http://en.wikipedia.org/wiki/Snoop_(software)


----------



## Kreij (Jul 25, 2008)

No big deal. Changing the name is not a problem.
Coming up with a better name ... now that could be 

Here are some initial screens ...

Ping






Trace Route





Walk Subnet





Any GUI suggestions are appreciated also !!


----------



## Oliver_FF (Jul 25, 2008)

I found a good way of getting lots of functionality onto one form without cluttering it up too badly is to put each kinda division into a User Control. So you make a User Control, put it's relevant code onto it, then simply make an instance of that control on your form. Boom, no code on the form and it's easy to move around and hide away.

If you're feeling special you can do what i did and photoshop up what you want it to look like, cut it up into chunks then make buttons appear flat and "paint" the pretty bits over the top of them as background images XD


----------



## Kreij (Jul 25, 2008)

That's what I did with the ERP application I wrote for where I work. All UserControls. The reason I used them was I implemented a sliding menu system and did not want forms popping up outside of the applications main form.

I was kicking around the idea of a custom look. It's kind of bland using the pre-rendered MS stuff, especially in XP (like the screens). It looks purdier™ in Vista.

Did I mention this is not even the alpha release? 

I was working on the port scanner. Not happy using the basic "Connect" way of TCP scanning. (Socket or TcpClient)
It's just too slow. I don't need a complete connection to verify the port status. 
I am going to implement ACK and SYN scans and maybe throw in a few others (FIN, NULL, XMAS) just for a little more fun.
I will need to do UDP also as some ports block or filter one or the other.
It would be fun to do protocol scanning, but that may be for a future release.


----------

