[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: system/2162: ppp mssfixup does not work on pf nat



> Have you tried setting a
> lower MTU with ppp's 'set mtu max' option or on the route, like
> http://real.ath.cx/BSDinstall.html suggests?

Changing the route's mtu does not work for some reason (it always
takes the mtu of the tun0 interface).

> Some people have reported
> they had problems with MTU values of 1492 and higher, depending on their
> ISP.
> 
(1492 is the maximum MTU for PPPoE.)
Changing the mtu for tun0 seems to solve the problem!
When using "set mtu max 1480" in ppp.conf, everything works allright.
With values higher than 1480, I get the same errors.


> How are the external machines unreachable for NATed machines?

Browsing some websites (such as http://www.netbsd.org/) does not work.
It sends an HTTP request, but then it hangs, waiting for a response
(lynx says "HTTP request sent; waiting for response." but there
is none; Netscape times out).
FTP'ing to ftp.netbsd.org does not work either:
Connected to ftp.netbsd.org.
220 ftp.netbsd.org FTP server (NetBSD-ftpd 20010417) ready.
Name (ftp.netbsd.org:supc): ftp
331 Guest login ok, type your name as password.
Password:
230-
and it doesn't continue, although it should show the
server's MOTD now.
On the gateway itself, this works fine.


> Can you
> run a tcpdump -nvvpSX on the external interface?

> Does the TCP handshake
> already fail, or the first larger data packets? 
Apparently no, if you look at the (above) output from the ftp client,
it can login but it can't get the server's message.


> Are there any packets
> with the DF (don't fragment) bit set? Any ICMP error messages (packet
> would have to be fragmented, but DF is set)?

No ICMP messages.
The packets originating from my box have the DF bit set.
The attached file contains the output of `tcpdump -nvvpSX -i tun0` while
running `fetch http://www.netbsd.org/images/NetBSD-smaller.jpg` on a
client machine, and the mtu of tun0 set to 1492 (fetch didn't work).
(212.100.182.40 is my external IP at the moment of testing;
204.152.186.171 is www.netbsd.org).

> Connections from the gateway itself work?
Yes, that's been working all the time, even with an mtu of 1492 (this is
really weird, isn't it? I really wonder why it works that way)

thanks for help (and for the great Operating System),
Chris
15:26:35.992770 212.100.182.40.62485 > 204.152.186.171.80: S [tcp sum ok] 2666327938:2666327938(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 1375904 0> (DF) (ttl 63, id 15265)
  0000: 4500 003c 3ba1 4000 3f06 ee49 d464 b628  E..<;¡_(_at_)__(_dot_)_?_(_dot_)_îIÔd¶(
  0010: cc98 baab f415 0050 9eec ef82 0000 0000  Ì.º«ô..P.ìï.....
  0020: a002 4000 77ac 0000 0204 05b4 0103 0300   _(_dot_)__(_at_)__(_dot_)_w¬_(_dot_)__(_dot_)__(_dot_)__(_dot_)__(_dot_)_´_(_dot_)__(_dot_)__(_dot_)__(_dot_)_
  0030: 0101 080a 0014 fea0 0000 0000            ......þ ....

15:26:36.232336 204.152.186.171.80 > 212.100.182.40.62485: S [tcp sum ok] 4042790267:4042790267(0) ack 2666327939 win 32768 <mss 1452,nop,wscale 0,nop,nop,timestamp 45847659 1375904> (ttl 49, id 19660)
  0000: 4500 003c 4ccc 0000 3106 2b1f cc98 baab  E..<LÌ..1.+.Ì.º«
  0010: d464 b628 0050 f415 f0f8 157b 9eec ef83  Ôd¶(.Pô.ðø.{.ìï.
  0020: a012 8000 9a08 0000 0204 05ac 0103 0300   ..........¬....
  0030: 0101 080a 02bb 946b 0014 fea0            .....».k..þ 

15:26:36.234726 212.100.182.40.62485 > 204.152.186.171.80: . [tcp sum ok] ack 4042790268 win 17280 <nop,nop,timestamp 1375928 45847659> (DF) (ttl 63, id 15266)
  0000: 4500 0034 3ba2 4000 3f06 ee50 d464 b628  E..4;¢_(_at_)__(_dot_)_?_(_dot_)_îPÔd¶(
  0010: cc98 baab f415 0050 9eec ef83 f0f8 157c  Ì.º«ô..P.ìï.ðø.|
  0020: 8010 4380 022d 0000 0101 080a 0014 feb8  ..C..-........þ¸
  0030: 02bb 946b                                .».k

15:26:36.235426 212.100.182.40.62485 > 204.152.186.171.80: P 2666327939:2666327980(41) ack 4042790268 win 17280 <nop,nop,timestamp 1375928 45847659> (DF) (ttl 63, id 15267)
  0000: 4500 005d 3ba3 4000 3f06 ee26 d464 b628  E..];£_(_at_)__(_dot_)_?_(_dot_)_î&Ôd¶(
  0010: cc98 baab f415 0050 9eec ef83 f0f8 157c  Ì.º«ô..P.ìï.ðø.|
  0020: 8018 4380 9cbe 0000 0101 080a 0014 feb8  ..C..¾........þ¸
  0030: 02bb 946b 4745 5420 2f69 6d61 6765 732f  .».kGET /images/
  0040: 4e65 7442 5344 2d73 6d61 6c6c 6572 2e6a  NetBSD-smaller.j
  0050: 7067 2048 5454 502f 312e 310d            pg HTTP/1.1.

15:26:36.569717 204.152.186.171.80 > 212.100.182.40.62485: . [tcp sum ok] ack 2666327980 win 33580 <nop,nop,timestamp 45847660 1375928> (ttl 49, id 19662)
  0000: 4500 0034 4cce 0000 3106 2b25 cc98 baab  E..4LÎ..1.+%Ì.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec efac  Ôd¶(.Pô.ðø.|.ìï¬
  0020: 8010 832c c256 0000 0101 080a 02bb 946c  ...,ÂV.......».l
  0030: 0014 feb8                                ..þ¸

15:26:36.572174 212.100.182.40.62485 > 204.152.186.171.80: P 2666327980:2666328055(75) ack 4042790268 win 17280 <nop,nop,timestamp 1375962 45847660> (DF) (ttl 63, id 15268)
  0000: 4500 007f 3ba4 4000 3f06 ee03 d464 b628  E...;¤_(_at_)__(_dot_)_?_(_dot_)_î_(_dot_)_Ôd¶(
  0010: cc98 baab f415 0050 9eec efac f0f8 157c  Ì.º«ô..P.ìï¬ðø.|
  0020: 8018 4380 5a80 0000 0101 080a 0014 feda  ..C.Z.........þÚ
  0030: 02bb 946c 486f 7374 3a20 7777 772e 6e65  .».lHost: www.ne
  0040: 7462 7364 2e6f 7267 0d0a 5573 6572 2d41  tbsd.org..User-A
  0050: 6765 6e74 3a20 6665 7463 6820            gent: fetch 

15:26:36.830421 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847661 1375962> (frag 19663:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4ccf 2000 3106 06fc cc98 baab  E..\LÏ .1..üÌ.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff7  Ôd¶(.Pô.ðø.|.ìï÷
  0020: 8010 832c 83ed 0000 0101 080a 02bb 946d  ...,.í.......».m
  0030: 0014 feda 4854 5450 2f31 2e31 2032 3030  ..þÚHTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:36.835406 204.152.186.171 > 212.100.182.40: (frag 19663:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4ccf 0089 3106 293b cc98 baab  E...LÏ..1.);Ì.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV

15:26:36.844964 204.152.186.171.80 > 212.100.182.40.62485: . 4042791716:4042792780(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847661 1375962> (frag 19664:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4cd0 2000 3106 06fb cc98 baab  E..\LÐ .1..ûÌ.º«
  0010: d464 b628 0050 f415 f0f8 1b24 9eec eff7  Ôd¶(.Pô.ðø.$.ìï÷
  0020: 8010 832c f3aa 0000 0101 080a 02bb 946d  ...,óª.......».m
  0030: 0014 feda 9413 d463 8af5 ea28 a28a 28a2  ..þÚ..Ôc.õê(¢.(¢
  0040: 8a28 a28a 28a2 8a28 a28a 28a2 8a2b 1fc6  .(¢.(¢.(¢.(¢.+.Æ
  0050: 1a14 3e26 f0ce a1a3 dc48 d125            ..>&ðΡ£ÜHÑ%

15:26:36.849954 204.152.186.171 > 212.100.182.40: (frag 19664:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4cd0 0089 3106 293a cc98 baab  E...LÐ..1.):Ì.º«
  0010: d464 b628 6c03 c8c9 1d00 03e8 4fd9 dbe2  Ôd¶(l.ÈÉ...èOÙÛâ
  0020: 26a9 a77c 26f1 5693 a3c3 6d73 ac68 48da  &©§|&ñV.£Ãms¬hHÚ
  0030: a5ac 373b 8acb 6c48 3328 0a41 cae1 88e7  ¥¬7;.ËlH3(.AÊá.ç
  0040: 9320 18ae f3e1 b7ed 1de1 cf16 4d0e 95e2  . .®óá·í.áÏ.M..â
  0050: 9b3f ec7b f9dc 468c e7cd b595            .?ì{ùÜF.ç͵.

15:26:36.859755 204.152.186.171.80 > 212.100.182.40.62485: . 4042793164:4042794228(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847661 1375962> (frag 19665:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4cd1 2000 3106 06fa cc98 baab  E..\LÑ .1..úÌ.º«
  0010: d464 b628 0050 f415 f0f8 20cc 9eec eff7  Ôd¶(.Pô.ðø Ì.ìï÷
  0020: 8010 832c 93a5 0000 0101 080a 02bb 946d  ...,.¥.......».m
  0030: 0014 feda 3aa5 8e8d e254 b0b6 9cc9 b6e3  ..þÚ:¥..âT°¶.ɶã
  0040: 4e95 2210 b60c 8bbd bdf2 46e2 0024 9c03  N.".¶..½½òFâ.$..
  0050: cd7d 2f69 3c77 56b0 dc40 dba2            Í}/i<wV°Ü_(_at_)_Û¢

15:26:36.864882 204.152.186.171 > 212.100.182.40: (frag 19665:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4cd1 0089 3106 2939 cc98 baab  E...LÑ..1.)9Ì.º«
  0010: d464 b628 7196 5246 1d54 6eeb ce37 60f1  Ôd¶(q.RF.TnëÎ7`ñ
  0020: d41a fa1e bce3 c67f da3a 7eb0 b2d9 4ea8  Ô.ú.¼ãÆ.Ú:~°²ÙN¨
  0030: 90e2 78a4 62c5 e25c fcea 31f7 d5b8 0623  .âx¤bÅâ\üê1÷Õ¸.#
  0040: 8188 f702 0a83 5dd6 8f7e 9a9e 9d0d d460  ..÷...]Ö.~....Ô`
  0050: 0de3 e650 db82 b0e0 807b 8cf7            .ãæPÛ.°à.{.÷

15:26:36.874571 204.152.186.171.80 > 212.100.182.40.62485: . 4042794612:4042795676(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847661 1375962> (frag 19666:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4cd2 2000 3106 06f9 cc98 baab  E..\LÒ .1..ùÌ.º«
  0010: d464 b628 0050 f415 f0f8 2674 9eec eff7  Ôd¶(.Pô.ðø&t.ìï÷
  0020: 8010 832c 4511 0000 0101 080a 02bb 946d  ...,E........».m
  0030: 0014 feda 4a68 d819 2cf4 6d34 44a8 e723  ..þÚJhØ.,ôm4D¨ç#
  0040: 3267 6e3e ef2c 41c6 066b a9b7 d63c 7bac  2gn>ï,AÆ.k©·Ö<{¬
  0050: dac3 369f e1ed 3342 0df7 d758            ÚÃ6.áí3B.÷×X

15:26:36.879633 204.152.186.171 > 212.100.182.40: (frag 19666:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4cd2 0089 3106 2938 cc98 baab  E...LÒ..1.)8Ì.º«
  0010: d464 b628 ef76 e1b9 c024 71ba bd3e bccf  Ôd¶(ïvá¹À$qº½>¼Ï
  0020: e256 9fe2 db5f 12e9 fac7 8167 125d dd44  âV.âÛ_.éúÇ.g.]ÝD
  0030: b617 7672 2a95 10ab b389 86e6 0a0a 9720  ¶.vr*..«³..æ... 
  0040: e792 1801 cf56 df7c 4bb2 b5d7 65d2 2e74  ç...ÏVß|K²µ×eÒ.t
  0050: bbfd 60c0 c409 2d20 594b 3c44            »ý`ÀÄ.- YK<D

15:26:37.567473 212.100.182.40.62485 > 204.152.186.171.80: P 2666327980:2666328055(75) ack 4042790268 win 17280 <nop,nop,timestamp 1376062 45847660> (DF) (ttl 63, id 15269)
  0000: 4500 007f 3ba5 4000 3f06 ee02 d464 b628  E...;¥_(_at_)__(_dot_)_?_(_dot_)_î_(_dot_)_Ôd¶(
  0010: cc98 baab f415 0050 9eec efac f0f8 157c  Ì.º«ô..P.ìï¬ðø.|
  0020: 8018 4380 5a1c 0000 0101 080a 0014 ff3e  ..C.Z.........ÿ>
  0030: 02bb 946c 486f 7374 3a20 7777 772e 6e65  .».lHost: www.ne
  0040: 7462 7364 2e6f 7267 0d0a 5573 6572 2d41  tbsd.org..User-A
  0050: 6765 6e74 3a20 6665 7463 6820            gent: fetch 

15:26:37.809443 204.152.186.171.80 > 212.100.182.40.62485: . [tcp sum ok] ack 2666328055 win 33580 <nop,nop,timestamp 45847663 1375962> (ttl 49, id 19669)
  0000: 4500 0034 4cd5 0000 3106 2b1e cc98 baab  E..4LÕ..1.+.Ì.º«
  0010: d464 b628 0050 f415 f0f8 2c1c 9eec eff7  Ôd¶(.Pô.ðø,..ìï÷
  0020: 8010 832c ab46 0000 0101 080a 02bb 946f  ...,«F.......».o
  0030: 0014 feda                                ..þÚ

15:26:38.283099 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847663 1375962> (frag 19671:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4cd7 2000 3106 06f4 cc98 baab  E..\L× .1..ôÌ.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff7  Ôd¶(.Pô.ðø.|.ìï÷
  0020: 8010 832c 83eb 0000 0101 080a 02bb 946f  ...,.ë.......».o
  0030: 0014 feda 4854 5450 2f31 2e31 2032 3030  ..þÚHTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:38.287514 204.152.186.171 > 212.100.182.40: (frag 19671:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4cd7 0089 3106 2933 cc98 baab  E...L×..1.)3Ì.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV

15:26:38.614347 204.152.184.75.21 > 212.100.182.40.62658: . 2247278976:2247280040(1064) ack 3623593086 win 33580 <nop,nop,timestamp 7268688 1372323> (frag 4439:1096_(_at_)_0+) [tos 0x10] (ttl 49)
  0000: 4510 045c 1157 2000 3106 44c4 cc98 b84b  E..\.W .1.DÄÌ.¸K
  0010: d464 b628 0015 f4c2 85f2 c180 d7fb a47e  Ôd¶(..ôÂ.òÁ.×û¤~
  0020: 8010 832c 367c 0000 0101 080a 006e e950  ...,6|.......néP
  0030: 0014 f0a3 2020 2020 2020 2020 2020 2020  ..ð£            
  0040: 2020 2020 2020 2020 2020 2020 2020 2020                  
  0050: 2020 2020 2020 2020 2020 2020                        

15:26:38.618656 204.152.184.75 > 212.100.182.40: (frag 4439:384_(_at_)_1096) [tos 0x10] (ttl 49)
  0000: 4510 0194 1157 0089 3106 6703 cc98 b84b  E....W..1.g.Ì.¸K
  0010: d464 b628 2d2e 2020 2020 205f 5f20 2f20  Ôd¶(-.     __ / 
  0020: 5f5f 2020 205c 2020 2020 2020 2020 0d0a  __   \        ..
  0030: 2020 2020 7c20 4d4f 544f 524f 4c41 204d      | MOTOROLA M
  0040: 564d 4536 386b 2c20 4e45 5753 2028 3638  VME68k, NEWS (68
  0050: 6b20 2620 4d49 5053 292c 207c            k & MIPS), |

15:26:41.284572 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847669 1375962> (frag 19677:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4cdd 2000 3106 06ee cc98 baab  E..\LÝ .1..îÌ.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff7  Ôd¶(.Pô.ðø.|.ìï÷
  0020: 8010 832c 83e5 0000 0101 080a 02bb 9475  ...,.å.......».u
  0030: 0014 feda 4854 5450 2f31 2e31 2032 3030  ..þÚHTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:41.289620 204.152.186.171 > 212.100.182.40: (frag 19677:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4cdd 0089 3106 292d cc98 baab  E...LÝ..1.)-Ì.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV

15:26:43.785218 204.152.186.171.80 > 212.100.182.40.61049: . 3154783829:3154784893(1064) ack 1780131003 win 33580 <nop,nop,timestamp 45847674 1373742> (frag 19683:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4ce3 2000 3106 06e8 cc98 baab  E..\Lã .1..èÌ.º«
  0010: d464 b628 0050 ee79 bc0a 2e55 6a1a a4bb  Ôd¶(.Pîy¼..Uj.¤»
  0020: 8010 832c 9563 0000 0101 080a 02bb 947a  ...,.c.......».z
  0030: 0014 f62e 4854 5450 2f31 2e31 2032 3030  ..ö.HTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:43.790338 204.152.186.171 > 212.100.182.40: (frag 19683:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4ce3 0089 3106 2927 cc98 baab  E...Lã..1.)'Ì.º«
  0010: d464 b628 2c20 7375 6e6f 732c 206f 7366  Ôd¶(, sunos, osf
  0020: 2f31 2c20 756c 7472 6978 2c20 7376 7234  /1, ultrix, svr4
  0030: 2c20 736f 6c61 7269 732c 2073 636f 2c20  , solaris, sco, 
  0040: 6942 4353 322c 2049 5076 362c 2065 6d62  iBCS2, IPv6, emb
  0050: 6564 6465 6422 3e0a 3c2f 6865            edded">.</he

15:26:45.586851 212.100.182.40.62078 > 66.77.58.13.80: S [tcp sum ok] 10636075:10636075(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) (ttl 127, id 7694)
  0000: 4500 0030 1e0e 4000 7f06 d6d2 d464 b628  E_(_dot_)__(_dot_)_0_(_dot_)__(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÖÒÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4b2b 0000 0000  BM:.ò~.P.¢K+....
  0020: 7002 2000 1d9c 0000 0204 05b4 0101 0402  p. ........´....

15:26:45.757968 66.77.58.13.80 > 212.100.182.40.62078: S [tcp sum ok] 4003525904:4003525904(0) ack 10636076 win 5840 <mss 1452,nop,nop,sackOK> (DF) (ttl 46, id 0)
  0000: 4500 0030 0000 4000 2e06 45e1 424d 3a0d  E_(_dot_)__(_dot_)_0_(_dot_)__(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_EáBM:.
  0010: d464 b628 0050 f27e eea0 f510 00a2 4b2c  Ôd¶(.Pò~î õ..¢K,
  0020: 7012 16d0 4311 0000 0204 05ac 0101 0402  p..ÐC......¬....

15:26:45.764170 212.100.182.40.62078 > 66.77.58.13.80: . [tcp sum ok] ack 4003525905 win 8712 (DF) (ttl 127, id 7950)
  0000: 4500 0028 1f0e 4000 7f06 d5da d464 b628  E..(_(_dot_)__(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÕÚÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4b2c eea0 f511  BM:.ò~.P.¢K,î õ.
  0020: 5010 2208 6495 0000                      P.".d...

15:26:45.765385 212.100.182.40.62078 > 66.77.58.13.80: P 10636076:10636314(238) ack 4003525905 win 8712 (DF) (ttl 127, id 8206)
  0000: 4500 0116 200e 4000 7f06 d3ec d464 b628  E... _(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÓìÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4b2c eea0 f511  BM:.ò~.P.¢K,î õ.
  0020: 5018 2208 520d 0000 4745 5420 2f52 6561  P.".R...GET /Rea
  0030: 6c4d 6564 6961 2f61 6473 2f61 6473 7472  lMedia/ads/adstr
  0040: 6561 6d5f 6a78 2e61 6473 2f53 7761 704e  eam_jx.ads/SwapN
  0050: 7574 2e53 6f66 7477 6172 652f            ut.Software/

15:26:45.959636 66.77.58.13.80 > 212.100.182.40.62078: . [tcp sum ok] ack 10636314 win 6432 (DF) (ttl 46, id 62531)
  0000: 4500 0028 f443 4000 2e06 51a5 424d 3a0d  E..(ôC_(_at_)__(_dot_)__(_dot_)__(_dot_)_Q¥BM:.
  0010: d464 b628 0050 f27e eea0 f511 00a2 4c1a  Ôd¶(.Pò~î õ..¢L.
  0020: 5010 1920 6c8f 0000                      P.. l...

15:26:45.971012 66.77.58.13.80 > 212.100.182.40.62078: P 4003525905:4003526618(713) ack 10636314 win 6432 (DF) (ttl 46, id 62532)
  0000: 4500 02f1 f444 4000 2e06 4edb 424d 3a0d  E_(_dot_)__(_dot_)_ñôD_(_at_)__(_dot_)__(_dot_)__(_dot_)_NÛBM:.
  0010: d464 b628 0050 f27e eea0 f511 00a2 4c1a  Ôd¶(.Pò~î õ..¢L.
  0020: 5018 1920 c4b3 0000 4854 5450 2f31 2e31  P.. ij..HTTP/1.1
  0030: 2032 3030 204f 4b0d 0a44 6174 653a 2053   200 OK..Date: S
  0040: 6174 2c20 3033 204e 6f76 2032 3030 3120  at, 03 Nov 2001 
  0050: 3134 3a32 333a 3533 2047 4d54            14:23:53 GMT

15:26:46.090953 212.100.182.40.62078 > 66.77.58.13.80: . [tcp sum ok] ack 4003526618 win 7999 (DF) (ttl 127, id 8462)
  0000: 4500 0028 210e 4000 7f06 d3da d464 b628  E..(!_(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÓÚÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4c1a eea0 f7da  BM:.ò~.P.¢L.î ÷Ú
  0020: 5010 1f3f 63a7 0000                      P..?c§..

15:26:47.289537 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847681 1375962> (frag 19687:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4ce7 2000 3106 06e4 cc98 baab  E..\Lç .1..äÌ.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff7  Ôd¶(.Pô.ðø.|.ìï÷
  0020: 8010 832c 83d9 0000 0101 080a 02bb 9481  ...,.Ù.......»..
  0030: 0014 feda 4854 5450 2f31 2e31 2032 3030  ..þÚHTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:47.294690 204.152.186.171 > 212.100.182.40: (frag 19687:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4ce7 0089 3106 2923 cc98 baab  E...Lç..1.)#Ì.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV

15:26:50.983375 212.100.182.40.62078 > 66.77.58.13.80: F [tcp sum ok] 10636314:10636314(0) ack 4003526618 win 7999 (DF) (ttl 127, id 8718)
  0000: 4500 0028 220e 4000 7f06 d2da d464 b628  E..("_(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÒÚÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4c1a eea0 f7da  BM:.ò~.P.¢L.î ÷Ú
  0020: 5011 1f3f 63a6 0000                      P..?c¦..

15:26:51.153572 66.77.58.13.80 > 212.100.182.40.62078: F [tcp sum ok] 4003526618:4003526618(0) ack 10636315 win 6432 (DF) (ttl 46, id 62533)
  0000: 4500 0028 f445 4000 2e06 51a3 424d 3a0d  E..(ôE_(_at_)__(_dot_)__(_dot_)__(_dot_)_Q£BM:.
  0010: d464 b628 0050 f27e eea0 f7da 00a2 4c1b  Ôd¶(.Pò~î ÷Ú.¢L.
  0020: 5011 1920 69c4 0000                      P.. iÄ..

15:26:51.156472 212.100.182.40.62078 > 66.77.58.13.80: . [tcp sum ok] ack 4003526619 win 7999 (DF) (ttl 127, id 8974)
  0000: 4500 0028 230e 4000 7f06 d1da d464 b628  E..(#_(_dot_)__(_at_)__(_dot_)__(_dot_)__(_dot_)_ÑÚÔd¶(
  0010: 424d 3a0d f27e 0050 00a2 4c1b eea0 f7db  BM:.ò~.P.¢L.î ÷Û
  0020: 5010 1f3f 63a5 0000                      P..?c¥..

15:26:59.295569 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328055 win 33580 <nop,nop,timestamp 45847705 1375962> (frag 19728:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4d10 2000 3106 06bb cc98 baab  E..\M. .1..»Ì.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff7  Ôd¶(.Pô.ðø.|.ìï÷
  0020: 8010 832c 83c1 0000 0101 080a 02bb 9499  ...,.Á.......»..
  0030: 0014 feda 4854 5450 2f31 2e31 2032 3030  ..þÚHTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:26:59.301100 204.152.186.171 > 212.100.182.40: (frag 19728:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4d10 0089 3106 28fa cc98 baab  E...M...1.(úÌ.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV

15:27:15.795797 204.152.186.171.80 > 212.100.182.40.61049: . 3154783829:3154784893(1064) ack 1780131003 win 33580 <nop,nop,timestamp 45847738 1373742> (frag 19757:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4d2d 2000 3106 069e cc98 baab  E..\M- .1...Ì.º«
  0010: d464 b628 0050 ee79 bc0a 2e55 6a1a a4bb  Ôd¶(.Pîy¼..Uj.¤»
  0020: 8010 832c 9523 0000 0101 080a 02bb 94ba  ...,.#.......».º
  0030: 0014 f62e 4854 5450 2f31 2e31 2032 3030  ..ö.HTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:27:15.801292 204.152.186.171 > 212.100.182.40: (frag 19757:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4d2d 0089 3106 28dd cc98 baab  E...M-..1.(ÝÌ.º«
  0010: d464 b628 2c20 7375 6e6f 732c 206f 7366  Ôd¶(, sunos, osf
  0020: 2f31 2c20 756c 7472 6978 2c20 7376 7234  /1, ultrix, svr4
  0030: 2c20 736f 6c61 7269 732c 2073 636f 2c20  , solaris, sco, 
  0040: 6942 4353 322c 2049 5076 362c 2065 6d62  iBCS2, IPv6, emb
  0050: 6564 6465 6422 3e0a 3c2f 6865            edded">.</he

15:27:19.300331 204.152.186.171.80 > 212.100.182.40.52406: . 2107286185:2107287249(1064) ack 2960419980 win 33580 <nop,nop,timestamp 45847745 1370917> (frag 19763:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4d33 2000 3106 0698 cc98 baab  E..\M3 .1...Ì.º«
  0010: d464 b628 0050 ccb6 7d9a a2a9 b074 6c8c  Ôd¶(.P̶}.¢©°tl.
  0020: 8010 832c 805e 0000 0101 080a 02bb 94c1  ...,.^.......».Á
  0030: 0014 eb25 4854 5450 2f31 2e31 2032 3036  ..ë%HTTP/1.1 206
  0040: 2050 6172 7469 616c 2043 6f6e 7465 6e74   Partial Content
  0050: 0d0a 4461 7465 3a20 5361 742c            ..Date: Sat,

15:27:19.305341 204.152.186.171 > 212.100.182.40: (frag 19763:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4d33 0089 3106 28d7 cc98 baab  E...M3..1.(×Ì.º«
  0010: d464 b628 661f 78b5 76f5 e3ff 0010 3e3f  Ôd¶(f.xµvõãÿ..>?
  0020: fc18 f855 e25f 07f8 43e2 37c4 8f0b 783b  ü.øUâ_.øCâ7Ä..x;
  0030: c43e 3dbd 9f4f f0b6 9fae ea29 6435 1bc8  Ä>=½.Oð¶.®ê)d5.È
  0040: 1ac6 3104 b772 0fb1 69af 7371 a9e9 d67a  .Æ1.·r.±i¯sq©éÖz
  0050: 70d5 2e6c bfb4 efaf 6dec b4ef            pÕ.l¿´ï¯mì´ï

15:27:22.040525 212.100.182.40.62485 > 204.152.186.171.80: F [tcp sum ok] 2666328055:2666328055(0) ack 4042790268 win 17280 <nop,nop,timestamp 1380507 45847660> (DF) (ttl 63, id 15270)
  0000: 4500 0034 3ba6 4000 3f06 ee4c d464 b628  E..4;¦_(_at_)__(_dot_)_?_(_dot_)_îLÔd¶(
  0010: cc98 baab f415 0050 9eec eff7 f0f8 157c  Ì.º«ô..P.ìï÷ðø.|
  0020: 8011 4380 efd3 0000 0101 080a 0015 109b  ..C.ïÓ..........
  0030: 02bb 946c                                .».l

15:27:22.280347 204.152.186.171.80 > 212.100.182.40.62485: . [tcp sum ok] ack 2666328056 win 33580 <nop,nop,timestamp 45847751 1380507> (ttl 49, id 19773)
  0000: 4500 0034 4d3d 0000 3106 2ab6 cc98 baab  E..4M=..1.*¶Ì.º«
  0010: d464 b628 0050 f415 f0f8 2c1c 9eec eff8  Ôd¶(.Pô.ðø,..ìïø
  0020: 8010 832c 992c 0000 0101 080a 02bb 94c7  ...,.,.......».Ç
  0030: 0015 109b                                ....

15:27:23.298214 204.152.186.171.80 > 212.100.182.40.62485: . 4042790268:4042791332(1064) ack 2666328056 win 33580 <nop,nop,timestamp 45847753 1380507> (frag 19778:1096_(_at_)_0+) (ttl 49)
  0000: 4500 045c 4d42 2000 3106 0689 cc98 baab  E..\MB .1...Ì.º«
  0010: d464 b628 0050 f415 f0f8 157c 9eec eff8  Ôd¶(.Pô.ðø.|.ìïø
  0020: 8010 832c 71cf 0000 0101 080a 02bb 94c9  ...,qÏ.......».É
  0030: 0015 109b 4854 5450 2f31 2e31 2032 3030  ....HTTP/1.1 200
  0040: 204f 4b0d 0a44 6174 653a 2053 6174 2c20   OK..Date: Sat, 
  0050: 3033 204e 6f76 2032 3030 3120            03 Nov 2001 

15:27:23.303243 204.152.186.171 > 212.100.182.40: (frag 19778:384_(_at_)_1096) (ttl 49)
  0000: 4500 0194 4d42 0089 3106 28c8 cc98 baab  E...MB..1.(ÈÌ.º«
  0010: d464 b628 4514 5145 1451 4514 5145 78de  Ôd¶(E.QE.QE.QExÞ
  0020: 97e3 79ad ff00 681f 1568 37b2 4f24 622b  .ãy­ÿ.h..h7²O$b+
  0030: 55b7 8546 5561 16fe 6b30 5033 90ce e49e  U·.FUa.þk0P3.Îä.
  0040: e1b1 c90a 2bd1 3c72 865f 095f dd5b 8324  á±É.+Ñ<r._._Ý[.$
  0050: d691 1bc8 3cb6 dacc c80b 6d56            Ö..È<¶ÚÌÈ.mV


Visit your host, monkey.org