Hi Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These packets are long (2090 Bytes) and not filled with nulls, but with more or less weird content. They have no "Don't fragment" flags set, so I wonder where they come from and what they good for. Has anybody seem such packets yet? (See attachment) Regards Marcel
Frame 3 (2090 on wire, 2090 captured)
Arrival Time: Nov 18, 2002 07:31:22.567756000
Time delta from previous packet: 52.964341000 seconds
Time relative to first packet: 1026.528290000 seconds
Frame Number: 3
Packet Length: 2090 bytes
Capture Length: 2090 bytes
Ethernet II
Destination: 00:e0:7d:8a:07:11 (Encore_8a:07:11)
Source: 00:a0:c9:af:bb:7f (Intel_af:bb:7f)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.100.30 (192.168.100.30), Dst Addr: 192.168.100.239 (192.168.100.239)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 2076
Identification: 0xffd7
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: ICMP (0x01)
Header checksum: 0xe8aa (correct)
Source: 192.168.100.30 (192.168.100.30)
Destination: 192.168.100.239 (192.168.100.239)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0xbdd5 (correct)
Identifier: 0x0200
Sequence number: 04:00
Data (2048 bytes)
0000 00 e0 7d 8a 07 11 00 a0 c9 af bb 7f 08 00 45 00 ..}...........E.
0010 08 1c ff d7 00 00 80 01 e8 aa c0 a8 64 1e c0 a8 ............d...
0020 64 ef 00 00 bd d5 02 00 04 00 ff d8 ff fe 00 08 d...............
0030 57 41 4e 47 32 02 ff e0 00 10 4a 46 49 46 00 01 WANG2.....JFIF..
0040 01 01 00 60 00 60 00 00 ff db 00 43 00 10 0b 0c ...`.`.....C....
0050 0e 0c 0a 10 0e 0d 0e 12 11 10 13 18 28 1a 18 16 ............(...
0060 16 18 31 23 25 1d 28 3a 33 3d 3c 39 33 38 37 40 ..1#%.(:3=<9387@
0070 48 5c 4e 40 44 57 45 37 38 50 6d 51 57 5f 62 67 H\N@DWE78PmQW_bg
0080 68 67 3e 4d 71 79 70 64 78 5c 65 67 63 ff db 00 hg>Mqypdx\egc...
0090 43 01 11 12 12 18 15 18 2f 1a 1a 2f 63 42 38 42 C......./../cB8B
00a0 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 cccccccccccccccc
00b0 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 cccccccccccccccc
00c0 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 cccccccccccccccc
00d0 63 63 ff c0 00 11 08 00 26 00 9e 03 01 21 00 02 cc......&....!..
00e0 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 ................
00f0 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 ................
0100 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 ................
0110 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 ..........}.....
0120 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 ...!1A..Qa."q.2.
0130 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 ...#B...R..$3br.
0140 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 .......%&'()*456
0150 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 789:CDEFGHIJSTUV
0160 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 WXYZcdefghijstuv
0170 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 wxyz............
0180 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 ................
0190 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca ................
01a0 d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 ................
01b0 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 ................
01c0 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 ................
01d0 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 ................
01e0 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 ................
01f0 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 ..w.......!1..AQ
0200 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 .aq."2...B.....#
0210 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 3R..br...$4.%...
0220 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 ..&'()*56789:CDE
0230 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 FGHIJSTUVWXYZcde
0240 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 fghijstuvwxyz...
0250 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 ................
0260 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ................
0270 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 ................
0280 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 ................
0290 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 ................
02a0 00 3f 00 ed 35 6d 4a 1d 23 4d 96 fa e1 64 68 a2 .?..5mJ.#M...dh.
02b0 c6 e1 18 05 b9 20 71 92 3d 6a ae 81 e2 2b 2f 10 ..... q.=j...+/.
02c0 47 33 59 89 50 c2 40 74 95 40 23 3d 0f 04 8e c7 G3Y.P.@t.@#=....
02d0 bf 6a 00 d6 ae 75 fc 67 a6 2e b6 34 a5 8e e5 e6 .j...u.g...4....
02e0 f3 c4 1b d5 06 cd e4 e3 b9 cf 07 8e 9d bb d0 06 ................
02f0 86 a7 ad db 69 77 b6 16 b3 a4 ac f7 d2 79 71 94 ....iw.......yq.
0300 00 80 72 a3 9c 91 fd e1 eb 5a 54 00 51 40 05 14 ..r......ZT.Q@..
0310 00 51 40 05 14 00 51 40 0d 92 44 8a 36 92 47 54 .Q@...Q@..D.6.GT
0320 44 05 99 98 e0 28 1d 49 35 cc db f8 f3 49 b9 d4 D....(.I5....I..
0330 62 b3 86 2b b6 69 65 11 24 9b 14 29 24 e0 1e 5b b..+.ie.$..)$..[
0340 38 fc 33 ed 40 1b d6 ba 8d a5 e5 d5 cd b5 b4 eb 8.3.@...........
0350 24 b6 a4 2c ca a0 fc 84 e7 8c f4 3d 0f 4e 98 ab $..,.......=.N..
0360 54 01 cf f8 ef fe 45 0b ef fb 67 ff 00 a3 16 b9 T.....E...g.....
0370 9f 0c 11 a1 f8 a2 c6 1d ca 96 fa a5 84 4e 07 98 .............N..
0380 40 0e 50 1c 90 7a 92 ca c0 0f f6 f8 f4 a0 0e f3 @.P..z..........
0390 53 bd 4d 37 4d b9 bd 93 69 10 46 5f 6b 36 dd c4 S.M7M...i.F_k6..
03a0 0e 17 3e e7 03 f1 af 2d d3 ac da 39 fc 3b a8 4c ..>....-...9.;.L
03b0 db e7 be d4 19 da 42 c4 b3 05 78 c7 39 ef bb 79 ......B...x.9..y
03c0 fc 68 03 d1 35 ad 77 fb 27 51 d2 ed 3e cd e6 fd .h..5.w.'Q..>...
03d0 be 5f 2f 76 fd bb 39 51 9c 60 e7 ef 7b 74 ab 5a ._/v..9Q.`..{t.Z
03e0 be af 69 a2 d9 7d aa f5 d9 50 9d aa 15 49 2c d8 ..i..}...P...I,.
03f0 24 01 f5 c1 eb 81 40 1c ef fc 27 13 47 fe 91 71 $.....@...'.G..q
0400 a0 5f 47 a7 9e 45 ce 0f 2a 7e e9 c1 00 73 91 fc ._G..E..*~...s..
0410 5d fb d7 45 2e a9 07 f6 24 ba a5 ab 2d c4 29 03 ]..E....$...-.).
0420 4c bb 4e 37 6d 04 e3 db a6 3d a8 03 9d b6 f1 c4 L.N7m....=......
0430 d7 e9 00 d3 74 49 ee e7 6f f5 c8 8e 76 c2 4b 10 ....tI..o...v.K.
0440 a0 b6 dc 72 06 72 70 07 af 5c 6d 78 83 c4 16 9a ...r.rp..\mx....
0450 05 a8 92 e7 73 cb 20 6f 26 25 07 f7 84 63 bf 41 ....s. o&%...c.A
0460 d4 75 fd 7a 50 06 2a f8 de e2 de 68 8e ab a0 dd .u.zP.*....h....
0470 d8 5a bb ec 69 df 71 0a 4f b1 51 9f e7 8c f5 ae .Z..i.q.O.Q.....
0480 99 f5 1b 48 f4 d1 a8 c9 3a a5 a1 8c 4b e6 30 23 ...H....:...K.0#
0490 e5 23 23 8e bc e4 71 d6 80 39 9f f8 4d 6f 2e 3f .##...q..9..Mo.?
04a0 7b a7 f8 6e fa e6 d5 be e4 bc 8d de bd 14 8e b9 {..n............
04b0 1d 7b 56 c7 87 3c 45 6b e2 1b 79 1e dd 24 8a 58 .{V..<Ek..y..$.X
04c0 76 89 63 71 f7 49 1d 8f 71 c1 f4 3c 74 14 01 1f v.cq.I..q..<t...
04d0 88 7c 4d 6f a2 32 5b ac 32 5d 5f 4b b7 cb b6 40 .|Mo.2[.2]_K...@
04e0 41 60 49 19 ce 0f a1 18 19 39 c7 1d eb 36 0f 1c A`I......9...6..
04f0 18 6e 92 3d 6b 49 b9 d2 e2 90 1d b2 c8 19 b2 47 .n.=kI.........G
0500 b6 d0 7f 2c f5 1f 5a 00 b9 e3 4d 4a e6 cb 4a 92 ...,..Z...MJ..J.
0510 08 34 e9 6e 92 e6 09 52 49 53 38 80 6d c6 e3 80 .4.n...RIS8.m...
0520 7d 49 ed d2 b9 bf 0c 78 82 ff 00 4d d0 e1 b7 b4 }I.....x...M....
0530 f0 dd cd d2 65 98 dc 44 18 09 09 63 cf 08 73 8e ....e..D...c..s.
0540 07 5e d4 01 5f c3 fa f5 fd 96 ab ac 4f 06 87 73 .^.._.......O..s
0550 74 f7 33 ef 92 24 dd 98 0e e7 3b 4e 14 fa 91 db t.3..$....;N....
0560 a5 7a 75 00 73 fe 3b ff 00 91 42 fb fe d9 ff 00 .zu.s.;...B.....
0570 e8 c5 ac 1f 11 db 4a be 0e d0 75 5b 62 c2 6b 08 ......J...u[b.k.
0580 e1 60 dc 61 41 55 e7 07 af cc 13 f3 34 01 6b c6 .`.aAU......4.k.
0590 fa 93 5f 68 7a 65 a5 92 c9 bf 56 74 64 56 0a 32 .._hze....VtdV.2
05a0 bc 10 a4 93 c1 dc c9 f9 1e 7d 5b e2 8b 64 b3 d5 .........}[..d..
05b0 7c 23 6b 19 62 90 4e 23 52 dd 48 0d 10 19 fc a8 |#k.b.N#R.H.....
05c0 02 6f 1a 7f c8 c3 e1 8f fa fb ff 00 d9 e3 a8 fc .o..............
05d0 45 0a ea 3e 3f d1 b4 fb 93 ba d5 62 33 79 78 18 E..>?......b3yx.
05e0 27 e6 27 39 1c 83 b1 41 1e 94 01 d8 5c 41 1d cd '.'9...A....\A..
05f0 bc b6 f3 2e e8 a5 42 8e b9 c6 41 18 23 8a c3 97 ......B...A.#...
0600 48 87 44 f0 7e a7 67 6f 34 f2 c5 f6 79 99 7c e6 H.D.~.go4...y.|.
0610 0c 57 28 78 18 03 03 bf d4 9a 00 6f 80 63 44 f0 .W(x.......o.cD.
0620 95 9b 22 2a 97 32 33 10 31 b8 ef 61 93 eb c0 03 .."*.23.1..a....
0630 f0 ac d4 85 75 1f 8a 17 02 e8 ef 5b 1b 75 78 54 ....u......[.uxT
0640 81 80 70 b8 cf 1c e0 bb 1f 5c e3 d2 80 3a cb fb ..p......\...:..
0650 28 75 1b 19 ec ee 17 31 4c 85 5b 81 91 ee 33 dc (u.....1L.[...3.
0660 75 1e e2 b8 9f 0c 59 cf ae fc 3e bc d3 44 ca 84 u.....Y...>..D..
0670 4e 52 22 cb c2 e0 ab e0 e3 d4 93 cf 3d 7d b1 40 NR".........=}.@
0680 10 db f8 9b 5f f0 cd bc 56 9a b6 93 be de 04 11 ...._...V.......
0690 24 9c a6 4e 32 a3 78 ca 9c 0e 30 06 78 f6 35 b9 $..N2.x...0.x.5.
06a0 e1 ad 43 c3 da a6 af 73 77 a6 db c9 06 a1 22 13 ..C....sw.....".
06b0 28 75 20 b2 e5 72 d8 04 af 27 1e f9 cd 00 53 f0 (u ..r...'....S.
06c0 bc 2b 7b e3 3d 7a fe e4 ef 9e da 5f 26 32 40 c2 .+{.=z....._&2@.
06d0 8c b2 fa 75 0a 80 67 d0 9e b9 ad cf 16 d9 43 7b ...u..g.......C{
06e0 e1 ab e5 99 73 e5 44 d3 21 00 65 59 41 23 19 e9 ....s.D.!.eYA#..
06f0 d3 1f 42 68 03 2f 4b 9e 4b 8f 86 4e f2 b6 e6 16 ..Bh./K.K..N....
0700 53 a0 38 c7 0a 19 40 fc 80 ab 9e 04 ff 00 91 42 S.8...@........B
0710 c7 fe da 7f e8 c6 a0 0c ff 00 05 ff 00 c8 c3 e2 ................
0720 7f fa fb ff 00 d9 e4 ae c2 80 39 ff 00 1d ff 00 ..........9.....
0730 c8 a1 7d ff 00 6c ff 00 f4 62 d4 d6 56 49 a9 78 ..}..l...b..VI.x
0740 2e d6 ca 4d a0 4f 61 1a 6e 65 dd b4 94 18 6c 7b ...M.Oa.ne....l{
0750 1c 1f c2 80 38 df 05 c1 36 a1 ad d9 43 71 14 89 ....8...6...Cq..
0760 16 8f 13 ee 49 14 95 f3 0b b1 e4 1f ba df 37 d7 ....I.........7.
0770 f7 7f 96 e7 8d 3f e4 61 f0 c7 fd 7d ff 00 ec f1 .....?.a...}....
0780 d0 01 e3 4f f9 18 7c 31 ff 00 5f 7f fb 3c 75 37 ...O..|1.._..<u7
0790 8c 2c 2f 62 ba b2 d7 74 88 5a 5b db 43 b1 91 50 .,/b...t.Z[.C..P
07a0 be f4 39 ed 9e d9 23 81 9f 9b 39 18 a0 0a bf f0 ..9...#...9.....
07b0 b0 61 ba b7 f2 b4 fd 36 ee 5d 41 d3 e4 8b 68 65 .a.....6.]A...he
07c0 dd 8e 7a 1c 90 39 3d 06 71 db b5 e8 6c 6f 6c 3c ..z..9=.q...lol<
07d0 0b 7f 1e a5 71 2c f7 6f 6d 33 c8 64 94 c9 b3 28 ....q,.om3.d...(
07e0 70 a0 fb 00 3d 79 cd 00 4d e0 4f f9 14 2c 7f ed p...=y..M.O..,..
07f0 a7 fe 8c 6a cd f1 35 9d ee 91 af 47 e2 4d 36 06 ...j..5....G.M6.
0800 99 16 32 2f 23 0c 46 54 60 64 f3 9e 98 e8 30 36 ..2/#.FT`d....06
0810 64 d0 04 77 7e 35 3a bd ac 96 3e 1f b1 bc 92 f6 d..w~5:...>.....
0820 61 b0 33 28 5f 2d 4f 05 b2 ac a.3(_-O...
Attachment:
pgpILvrKW9Vha.pgp
Description: PGP signature