Packet Reading Packet Reading

lroorou by. lroorou by.

Wllllo Wllllo
zoroooo@scs.ryorsoo.co
1oocory 1oocory
Packet Reading Packet Reading
Wllllo 2oroooo Wllllo 2oroooo
zoroooo@scs.ryorsoo.co
1oocory 2ulu 1oocory 2ulu
loc|ot kooulo loc|ot kooulo
Voocolly losoctlo loc|ot |lolus Ior Aoolyslsl Voocolly losoctlo loc|ot |lolus Ior Aoolyslsl
Woy
Jooro wlll bo tlos toot yoc WlLL oovo to
oocolly ovolcoto too cootoot oI oc|ots to oocolly ovolcoto too cootoot oI oc|ots to
luootlIy woot tooy oro uolo
loc|ot kooulo loc|ot kooulo
Voocolly losoctlo loc|ot |lolus Ior Aoolyslsl Voocolly losoctlo loc|ot |lolus Ior Aoolyslsl
Jooro wlll bo tlos toot yoc WlLL oovo to
oocolly ovolcoto too cootoot oI oc|ots to oocolly ovolcoto too cootoot oI oc|ots to
luootlIy woot tooy oro uolo
loory Coovorsloo loory Coovorsloo
Jo colccloto o ocbor, yoc to|o too boso oI too
ocborlo systo oou rolso lt to too owor oI too ocborlo systo oou rolso lt to too owor oI too
colco.
|lrst Colco ls u, oot ls l, otc. |lrst Colco ls u, oot ls l, otc.
25 boso lu
(2lu
2
}-(5lu
l
}-(lu (2lu
2
}-(5lu
l
}-(lu
luul boso 2
(l2
3
}-(u2
2
}-(u2
l
}-(l2 (l2
3
}-(u2
2
}-(u2
l
}-(l2
llllluul boso 2 ogcols |9 boso l
loory Coovorsloo loory Coovorsloo
Jo colccloto o ocbor, yoc to|o too boso oI too
ocborlo systo oou rolso lt to too owor oI too ocborlo systo oou rolso lt to too owor oI too
|lrst Colco ls u, oot ls l, otc. |lrst Colco ls u, oot ls l, otc.
}-(lu
u
}=25 }-(lu
u
}=25
}-(l2
u
}=9 boso lu }-(l2
u
}=9 boso lu
llllluul boso 2 ogcols |9 boso l
uoouoclol korosoototloo uoouoclol korosoototloo
2
8
2
2
2
1
2
0
u u u u = u
u u u l = l
u u l u = 2 u u l u = 2
u u l l = 3
u l u u = =
u l u l = 5
u l l u =
u l l l = 7 u l l l = 7
uoouoclol korosoototloo uoouoclol korosoototloo
2
8
2
2
2
1
2
0
He
l u u u = 8
l u u l = 9
l u l u = lu (o} l u l u = lu (o}
l u l l = ll (b}
l l u u = l2 (c}
l l u l = l3 (u}
l l l u = l= (o}
l l l l = l5 (I} l l l l = l5 (I}
|lvo Jls Ior Docoulo loc|ots |lvo Jls Ior Docoulo loc|ots
OIIsot Iro boloolo oI too oc|ot stort ot u OIIsot Iro boloolo oI too oc|ot stort ot u
|ocr blts = l oo cooroctor
|lolus coo bo ooy looto |lolus coo bo ooy looto
|ro ooo blt to ooy bytos
|lou looto, or vorloblo looto |lou looto, or vorloblo looto
|lolus lo ooo rotocol luootlIy too looto oou
cootoots oI otoors
Coctors cso ooouor roIoroocos tool
|lvo Jls Ior Docoulo loc|ots |lvo Jls Ior Docoulo loc|ots
OIIsot Iro boloolo oI too oc|ot stort ot u OIIsot Iro boloolo oI too oc|ot stort ot u
|ocr blts = l oo cooroctor
|lolus coo bo ooy looto |lolus coo bo ooy looto
|ro ooo blt to ooy bytos
|lou looto, or vorloblo looto |lou looto, or vorloblo looto
|lolus lo ooo rotocol luootlIy too looto oou
Coctors cso ooouor roIoroocos tool
Colcclotlo vorloblo Looto |lolus Colcclotlo vorloblo Looto |lolus
JCl otloos oou looto oI oyloou oro vorloblo JCl otloos oou looto oI oyloou oro vorloblo
wluto Ilolus
Wo colccloto Ilolu looto cslo otoor ooouor Wo colccloto Ilolu looto cslo otoor ooouor
loIorotloo oou Ilou lootos
1CI O|ions lenq|b = (JCl ooouor Looto
JCl uoouor Looto}
lenq|b o| Iocke| IoyIood =
uoouor Looto - JCl uoouor Looto}
Colcclotlo vorloblo Looto |lolus Colcclotlo vorloblo Looto |lolus
JCl otloos oou looto oI oyloou oro vorloblo JCl otloos oou looto oI oyloou oro vorloblo
Wo colccloto Ilolu looto cslo otoor ooouor Wo colccloto Ilolu looto cslo otoor ooouor
loIorotloo oou Ilou lootos
(JCl ooouor Looto Vlo.
lenq|b o| Iocke| IoyIood = ll Jotol Looto (ll
uoouor Looto - JCl uoouor Looto}
loc|ot kooulo loc|ot kooulo
Woot ls tcuc Woot ls tcuc
8lly ucs troIIlc oo o ootwor| 8lly ucs troIIlc oo o ootwor|
Wos oIIlclolly olotoloou by too Lowrooco
or|oloy Lob or|oloy Lob
Now olotoloou toroco o colloctlvo oIIort
Cooou-lloo tool Ior ooltorlo (solIIlo} Cooou-lloo tool Ior ooltorlo (solIIlo}
ootwor| troIIlc
uolvorsolly ovolloblo oou csou oo ooy uolvorsolly ovolloblo oou csou oo ooy
lotIors
|roo Ooo 8ocrco 8oItworo,GlL |roo Ooo 8ocrco 8oItworo,GlL
loc|ot kooulo - tcuc loc|ot kooulo - tcuc
8lly ucs troIIlc oo o ootwor| 8lly ucs troIIlc oo o ootwor|
Wos oIIlclolly olotoloou by too Lowrooco
Now olotoloou toroco o colloctlvo oIIort
lloo tool Ior ooltorlo (solIIlo} lloo tool Ior ooltorlo (solIIlo}
uolvorsolly ovolloblo oou csou oo ooy uolvorsolly ovolloblo oou csou oo ooy
Ooo 8ocrco 8oItworo,GlL Ooo 8ocrco 8oItworo,GlL
Gottlo 8tortou wlto tcuc Gottlo 8tortou wlto tcuc
Joo Goou.
uolvorsolly ovolloblo oou csou, ovoo oo Wlouows
lrovluos ocult troll oI ootwor|
Noo-ossclo, yoc uo yocr owo lotorrototloo Noo-ossclo, yoc uo yocr owo lotorrototloo
Joo ou. Joo ou.
Ooly collocts 8 bytos oI uoto Iro ootwor| wlto uoIoclt
sottlos sottlos
Doos oot |oo troc| oI troIIlc Ilow (stoto}
Doos oot scolo woll oo loro ootwor|s Doos oot scolo woll oo loro ootwor|s
Gottlo 8tortou wlto tcuc Gottlo 8tortou wlto tcuc
uolvorsolly ovolloblo oou csou, ovoo oo Wlouows
lrovluos ocult troll oI ootwor|
ossclo, yoc uo yocr owo lotorrototloo ossclo, yoc uo yocr owo lotorrototloo
Ooly collocts 8 bytos oI uoto Iro ootwor| wlto uoIoclt
Doos oot |oo troc| oI troIIlc Ilow (stoto}
Doos oot scolo woll oo loro ootwor|s Doos oot scolo woll oo loro ootwor|s
DoIoclt octct DoIoclt octct
Jo rco tcuc. Jo rco tcuc.
#> tcpdomp
8olo Octct.
l3.l.37.3=833 ll l72.l.2lu.l3l > ou l3.l.37.3=833 ll l72.l.2lu.l3l > ou
lCVl ocoo rogcost, lu 55u57, sog l, looto =
tcuc wlll llstoo oo Ilrst lotorIoco (otou} oou uc oc|ots to tcuc wlll llstoo oo Ilrst lotorIoco (otou} oou uc oc|ots to
coosolo
DoIoclt octct DoIoclt octct
l3.l.37.3=833 ll l72.l.2lu.l3l > ou-lo-Ilu=.oolo.co. l3.l.37.3=833 ll l72.l.2lu.l3l > ou-lo-Ilu=.oolo.co.
lCVl ocoo rogcost, lu 55u57, sog l, looto =
tcuc wlll llstoo oo Ilrst lotorIoco (otou} oou uc oc|ots to tcuc wlll llstoo oo Ilrst lotorIoco (otou} oou uc oc|ots to
Octct lo uoouoclol Octct lo uoouoclol
Jo rco tcuc. Jo rco tcuc.
#> tcpdomp -x
Octct.
l3.28.u5.7837l ll l72.l.2lu.l3l > gy
lCVl ocoo rogcost, lu =2, sog l, looto = lCVl ocoo rogcost, lu =2, sog l, looto =
uuuuu. =5uu uu5= uuuu =uuu =uul l3u oclu u283
uuulu. =o7u 5b8 u8uu ub92 l2l2 uuul
uuu2u. 25I5 ubuu u8u9 uoub ucuu uouI lull l2l3 uuu2u. 25I5 ubuu u8u9 uoub ucuu uouI lull l2l3
uuu3u. l=l5 ll7 l8l9 lolb lclu lolI 2u2l 2223
uuu=u. 2=25 227 2829 2o2b 2c2u 2o2I 3u3l 3233 uuu=u. 2=25 227 2829 2o2b 2c2u 2o2I 3u3l 3233
uuu5u. 3=35
ll uoouor ll uoouor
lCVl uoouor
Octct lo uoouoclol Octct lo uoouoclol
l3.28.u5.7837l ll l72.l.2lu.l3l > gy-lo-Ilu=.oolo.co.
lCVl ocoo rogcost, lu =2, sog l, looto = lCVl ocoo rogcost, lu =2, sog l, looto =
=5uu uu5= uuuu =uuu =uul l3u oclu u283
u8uu ub92 l2l2 uuul 25l8 c9=9
uuu2u. 25I5 ubuu u8u9 uoub ucuu uouI lull l2l3 uuu2u. 25I5 ubuu u8u9 uoub ucuu uouI lull l2l3
uuu3u. l=l5 ll7 l8l9 lolb lclu lolI 2u2l 2223
uuu=u. 2=25 227 2829 2o2b 2c2u 2o2I 3u3l 3233 uuu=u. 2=25 227 2829 2o2b 2c2u 2o2I 3u3l 3233
tcuc DoIoclt sooloo tcuc DoIoclt sooloo
Joo uoIoclt soosoot looto ls 8 bytos, ooolo ooly 8 Joo uoIoclt soosoot looto ls 8 bytos, ooolo ooly 8
bytos wlll bo cotcrou
uscolly oooco to cotcro ll ooouor, obouuou rotocol uscolly oooco to cotcro ll ooouor, obouuou rotocol
ooouor oou soo uoto.
Jooo woy uo wo ooly soo 54
tcuc tcuc
|roo ooouor. l= bytos - = byto Ior CkC toot oro oot
cotcrou by tcuc cotcrou by tcuc
locrooso sooloo by cslo tcuc otloo
fxomp|c tcpdomp -s 0 fxomp|c tcpdomp -s 0
-s zoro wlll cotcro ootlro |tooroot ooouor oou ll oc|ot
DoIoclt sooloo DoIoclt sooloo
Joo uoIoclt soosoot looto ls 8 bytos, ooolo ooly 8 Joo uoIoclt soosoot looto ls 8 bytos, ooolo ooly 8
uscolly oooco to cotcro ll ooouor, obouuou rotocol uscolly oooco to cotcro ll ooouor, obouuou rotocol
54 bytos oI uoto Iro
|roo ooouor. l= bytos - = byto Ior CkC toot oro oot
locrooso sooloo by cslo tcuc otloo -s
s zoro wlll cotcro ootlro |tooroot ooouor oou ll oc|ot
|roo uoouor |roo uoouor
13:47:03.474681 00:50:56:f4:44:da > 00:0c:29:98:5d:11, 13:47:03.474681 00:50:56:f4:44:da > 00:0c:29:98:5d:11,
ethertype IPv4 (0x0800), length 98
172.16.210.131: ICMP echo reply, id 2095, seq 1, length 64
0x0000: 000c 2998 5d11 0050 56f4 44da 0800
0x0010: 0054 2652 0000 8001 efdd 4a7d 5b68 ac10 0x0010: 0054 2652 0000 8001 efdd 4a7d 5b68 ac10
0x0020: d283 0000 4778 082f 0001 176e ca49 dd9c
0x0030: 0600 0809 0a0b 0c0d 0e0f 1011 1213 1415
0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
0x0050: 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
Frame Header = 14 bytes
IP Header = 20 bytes
ICMP Header = 8 bytes2e2f 3031 3233 3435 ICMP Header = 8 bytes2e2f 3031 3233 3435
|roo uoouor |roo uoouor
13:47:03.474681 00:50:56:f4:44:da > 00:0c:29:98:5d:11, 13:47:03.474681 00:50:56:f4:44:da > 00:0c:29:98:5d:11,
length 98: 74.125.91.104 >
172.16.210.131: ICMP echo reply, id 2095, seq 1, length 64
000c 2998 5d11 0050 56f4 44da 0800 4500
0x0010: 0054 2652 0000 8001 efdd 4a7d 5b68 ac10 0x0010: 0054 2652 0000 8001 efdd 4a7d 5b68 ac10
082f 0001 176e ca49 dd9c
0x0030: 0600 0809 0a0b 0c0d 0e0f 1011 1213 1415
0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425 0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
0x0050: 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
2e2f 3031 3233 3435 2e2f 3031 3233 3435
ll uoouor Looto |lolus ll uoouor Looto |lolus
IPv4 Header (RFC 791) IPv4 Header (RFC 791)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Byte Offset 0 Byte Offset 1
Version (4-bit)
IP hdr length (4-
bit)
Type of Service (8-bit)
bit)
Byte Offset 4 Byte Offset 5
IP Identification Number (16-bit)
Byte Offset 8 Byte Offset 9
Time to Live (8-bit) Protocol (8-bit) Time to Live (8-bit) Protocol (8-bit)
Byte Offset 12 Byte Offset 13
Source IP Address (32
Byte Offset 16 Byte Offset 17 Byte Offset 16 Byte Offset 17
Destination IP Address (32
Byte Offset 20 Byte Offset 21
IP Options (variable.if any)
data (variable.)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
4-bit IP Header length multiply by 4 to convert to bytes 4-bit IP Header length multiply by 4 to convert to bytes
16-bit IP datagram total length
13-bit Fragment offset length multiply by 8 to convert to bytes
ll uoouor Looto |lolus ll uoouor Looto |lolus
IPv4 Header (RFC 791) IPv4 Header (RFC 791)
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Byte Offset 2 Byte Offset 3
Total Length (16-bit) (in Byte Offsets)
2
0

B
y
t
e
s
Byte Offset 6 Byte Offset 7
R DF MF Fragment Offset (13-bit)
Byte Offset 10 Byte Offset 11
Header Checksum (16-bit)
2
0

B
y
t
e
s
Header Checksum (16-bit)
Byte Offset 14 Byte Offset 15
Source IP Address (32-bit)
Byte Offset 18 Byte Offset 19 Byte Offset 18 Byte Offset 19
Destination IP Address (32-bit)
Byte Offset 22 Byte Offset 23
(variable.if any)
data (variable.)
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
bit IP Header length multiply by 4 to convert to bytes bit IP Header length multiply by 4 to convert to bytes
bit Fragment offset length multiply by 8 to convert to bytes
Docoulo ll ooouor (l} Docoulo ll ooouor (l}
Byte 0 Byte 1
0x0000: 4500 00f4 4a99 0000 8011 f2b8 ac10 d202
Byte 0
Version 4, IHL 5
Byte 1
ToS 0
0x0000: 4500 00f4 4a99 0000 8011 f2b8 ac10 d202
0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
0x0050: 0000
Byte 0 contains both Version and Initial Header Length.
IP Version Upper Nibble byte 0: 4 IPv4
IHL Lower Nibble byte 0: 5 32-bite words IHL Lower Nibble byte 0: 5 32-bite words
ToS Byte 1: 0 not set
Docoulo ll ooouor (l} Docoulo ll ooouor (l}
00 00f4 4a99 0000 8011 f2b8 ac10 d202 00 00f4 4a99 0000 8011 f2b8 ac10 d202
0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
Byte 0 contains both Version and Initial Header Length.
IPv4
bite words bite words
ll uoouor looto ll uoouor looto
0x0000: 4500 00f4 4a99 0000 8011 f2b8 ac10 d202
0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180 0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100 0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
0x0050: 0000
IP Header Length = 5 or 5 32
5*4 bytes = 20 bytes in length 5*4 bytes = 20 bytes in length
Note: Minimum IP Header length is 20 bytes
Are there any IP options?
ll uoouor looto ll uoouor looto
00 00f4 4a99 0000 8011 f2b8 ac10 d202
0035 aaf4 00e0 7d0c 7a6a 8180 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100 0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
or 5 32-bit words
5*4 bytes = 20 bytes in length 5*4 bytes = 20 bytes in length
Note: Minimum IP Header length is 20 bytes
ll Otloos ll Otloos
0x0000: 4700 0030 7276 0000 4006 74c9 7f00 0001 0x0000: 4700 0030 7276 0000 4006 74c9 7f00 0001
0x0010: 7f00 0001 8907 087f 0000 0200 091d 0000
0x0020: 0052 ea5d 1176 204e 5000 0200 8a51 0000
IP Header Length = 7 or 7 32
7*4 bytes = 28 bytes in length
Type:8bits = 0x89 = 137 decimal
Length:8bits = 07 bytes
Pointer:8bits = 08
Route data: variable = 127.0.0.2
Note: Strict source route - RFC 791
ll Otloos ll Otloos
4700 0030 7276 0000 4006 74c9 7f00 0001 4700 0030 7276 0000 4006 74c9 7f00 0001
8907 087f 0000 0200 091d 0000
0x0020: 0052 ea5d 1176 204e 5000 0200 8a51 0000
or 7 32-bit words
7*4 bytes = 28 bytes in length
Type:8bits = 0x89 = 137 decimal
Route data: variable = 127.0.0.2
RFC 791
Docoulo ll ooouor (2} Docoulo ll ooouor (2}
Bytes 2,3 Bytes 4,5
0x0000: 4500 00f4 4a99 0000
Bytes 2,3
Total Length: 244 bytes
Bytes 4,5
Identification
0x0000: 4500 00f4 4a99 0000
0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
0x0050: 0000
Byte 2,3 Total Length: 0xf4 = 244 bytes
Bytes 4,5 IPID: 4a99
Bytes 6,7 IP Flags 3 bits and 13-bit Fragments offset. An example will be Bytes 6,7 IP Flags 3 bits and 13-bit Fragments offset. An example will be
shown in slide |rooototloo Jotol Looto
Docoulo ll ooouor (2} Docoulo ll ooouor (2}
4,5 Bytes 6,7
0000 8011 f2b8 ac10 d202
4,5
Identification
Bytes 6,7
Flags, Frags offset
0000 8011 f2b8 ac10 d202
0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
Byte 2,3 Total Length: 0xf4 = 244 bytes
bit Fragments offset. An example will be bit Fragments offset. An example will be
|rooototloo Jotol Looto
ll Dotoro Looto ll Dotoro Looto
0x0000: 4700 0030 7276 0000 4006 74c9 7f00 0001 0x0000: 4700 0030 7276 0000 4006 74c9 7f00 0001
0x0010: 7f00 0001 8907 087f 0000 0200 091d 0000
0x0020: 0052 ea5d 1176 204e 5000 0200 8a51 0000
IP Datagram Length = 30 =
Note: 2 bytes frame check sum missing from dump Note: 2 bytes frame check sum missing from dump
ll Dotoro Looto ll Dotoro Looto
7276 0000 4006 74c9 7f00 0001 7276 0000 4006 74c9 7f00 0001
8907 087f 0000 0200 091d 0000
0x0020: 0052 ea5d 1176 204e 5000 0200 8a51 0000
= 48 bytes in length
Note: 2 bytes frame check sum missing from dump Note: 2 bytes frame check sum missing from dump
|rooototloo Jotol Looto |rooototloo Jotol Looto
0x0000: 4500 0024 0043 2000 0x0000: 4500 0024 0043 2000
0x0010: 7f00 0001 0b4c 0000 6e4a 9e07 0279 5755
0x0020: 5000 0200 0x0020: 5000 0200
0x0000: 4500 0022 0043 0002
0x0010: 7f00 0001 5554 0000 4672 6167 6d65 6e74 0x0010: 7f00 0001 5554 0000 4672 6167 6d65 6e74
0x0020: 6564
Bytes 6, 7 offset zero of ip header contains: Bytes 6, 7 offset zero of ip header contains:
3 bits flags field - 0x2 = 0010 binary
13 Fragment offset zero offset meaning first fragment 13 Fragment offset zero offset meaning first fragment
Fragment offset length 2
13
= 8192 bytes
All possible datagram length 2
16
= 65,536 bytes
65,536 / 8192 = 8 65,536 / 8192 = 8
Therefore, fragment offset must be multiplied by 8
|rooototloo Jotol Looto |rooototloo Jotol Looto
2000 4006 5c8f 7f00 0001 2000 4006 5c8f 7f00 0001
0x0010: 7f00 0001 0b4c 0000 6e4a 9e07 0279 5755
0002 4006 7c8f 7f00 0001
0x0010: 7f00 0001 5554 0000 4672 6167 6d65 6e74 0x0010: 7f00 0001 5554 0000 4672 6167 6d65 6e74
Bytes 6, 7 offset zero of ip header contains: Bytes 6, 7 offset zero of ip header contains:
first bit is set meaning More Fragments
zero offset meaning first fragment zero offset meaning first fragment
= 8192 bytes
= 65,536 bytes
Therefore, fragment offset must be multiplied by 8
Docoulo ll ooouor (3} Docoulo ll ooouor (3}
0x0000: 4500 00f4 4a99 0000 0x0000: 4500 00f4 4a99 0000
0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
0x0050: 0000
Byte 8 Time To Live: 0x80 = 128
Bytes 9 Embedded Protocol: 0x11 = 17 decimal UDP
Docoulo ll ooouor (3} Docoulo ll ooouor (3}
Bytes 8 Byte 9 Embedded
4500 00f4 4a99 0000 8011 f2b8 ac10 d202
Bytes 8
TTL: 128
Byte 9 Embedded
Protocol 11 (UDP)
4500 00f4 4a99 0000 8011 f2b8 ac10 d202
0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
Bytes 9 Embedded Protocol: 0x11 = 17 decimal UDP
Docoulo ll ooouor (=} Docoulo ll ooouor (=}
Bytes 10,11 Bytes 16,17,18,19
0x0000: 4500 00f4 4a99 0000 8011
Bytes 10,11
Checksum
Bytes 16,17,18,19
Dest. Address
0x0000: 4500 00f4 4a99 0000 8011
0x0010: ac10 d283 0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
0x0050: 0000
Byte 10,11 Checksum: f2b8
Bytes 12,13,14,15 Source address =
Bytes 16,17,18,19 Dest. address = ac10 d283 Bytes 16,17,18,19 Dest. address = ac10 d283
Docoulo ll ooouor (=} Docoulo ll ooouor (=}
Bytes 10,11 Bytes 12,13,14,15
4500 00f4 4a99 0000 8011 f2b8 ac10 d202
Bytes 10,11
Checksum
Bytes 12,13,14,15
Source Address
4500 00f4 4a99 0000 8011 f2b8 ac10 d202
0035 aaf4 00e0 7d0c 7a6a 8180
0x0020: 0001 0001 0004 0004 0331 3034 0331 3631
0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204 0x0030: 0332 3333 0236 3407 696e 2d61 6464 7204
0x0040: 6172 7061 0000 0c00 01c0 0c00 0c00 0100
Bytes 12,13,14,15 Source address = ac10 d202 172.16.210.2
ac10 d283 172.16.210.131 ac10 d283 172.16.210.131
JCl uoouor JCl uoouor
TCP Header (RFC 793) TCP Header (RFC 793)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Byte Offset 0 Byte Offset 1
Source Port Number (16-bit)
Byte Offset 4 Byte Offset 5
Sequence Number (32
Byte Offset 8 Byte Offset 9
Acknowledgement Number (32
Byte Offset 12 Byte Offset 13 Byte Offset 12 Byte Offset 13
Hdr Length (4-bit)
Reserved (4-
bit)
C
W
R
E
C
E
U
R
G
A
C
K
P
S
H
R
S
T
S
Y
N
F
I
N
Byte Offset 16 Byte Offset 17
Checksum (16-bit) Checksum (16-bit)
Byte Offset 20 Byte Offset 21
TCP Options (variable.if any)
data (variable.)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
JCl uoouor JCl uoouor
TCP Header (RFC 793) TCP Header (RFC 793)
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Byte Offset 2 Byte Offset 3
Destination Port Number (16-bit)
Byte Offset 6 Byte Offset 7
Sequence Number (32-bit)
2
0

B
y
t
e
s
Byte Offset 10 Byte Offset 11
Acknowledgement Number (32-bit)
Byte Offset 14 Byte Offset 15 Byte Offset 14 Byte Offset 15
F
I
N
Window Size (16-bit)
Byte Offset 18 Byte Offset 19
Urgent Pointer (16-bit) Urgent Pointer (16-bit)
Byte Offset 22 Byte Offset 23
(variable.if any)
data (variable.)
15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
Docoulo JCl ooouor (l} Docoulo JCl ooouor (l}
Bytes 0,1 Bytes 2,3
0x0000: 4500 0088 ee14 0000 400
Bytes 0,1
Src. Port 1061
Bytes 2,3
Dest. Port 0
0x0000: 4500 0088 ee14 0000 400
0x0010: 7f00 0001 0425 0000
0x0020: 5018 0200 dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
0x0050: 0000
Bytes 0,1 Source Port: 0425 - 1061
Bytes 2,3 Destination Port: 0000
Byte offset 4, length 4 bytes Sequence number: Byte offset 4, length 4 bytes Sequence number:
Docoulo JCl ooouor (l} Docoulo JCl ooouor (l}
Bytes 4,5,6,7 Seq.
00 0088 ee14 0000 4006 8e59 7f00 0001
Bytes 4,5,6,7 Seq.
Number 1502625840 Dest. Port 0
00 0088 ee14 0000 4006 8e59 7f00 0001
0000 5990 8dd1 4030 b112
0x0020: 5018 0200 dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
Byte offset 4, length 4 bytes Sequence number: 5990 8dd1 - 1502625840 Byte offset 4, length 4 bytes Sequence number: 5990 8dd1 - 1502625840
JCl uoouor Looto JCl uoouor Looto
0x0000: 4500 0088 ee14 0000 400 0x0000: 4500 0088 ee14 0000 400
0x0010: 7f00 0001 0425 0000 5990 8dd1 4030 b112
0x0020: 5000 0200 dbb0 0000 536f 6d65 2072 616e 0x0020: 5000 0200 dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
0x0050: 0000 0x0050: 0000
The TCP header length is found in the high The TCP header length is found in the high
TCP Header expressed as 32-bit word and must be multiplied by 4 to convert to
bytes.
Needed to calculate where the TCP header stops, and where data starts.
JCl uoouor Looto JCl uoouor Looto
00 0088 ee14 0000 4006 8e59 7f00 0001 00 0088 ee14 0000 4006 8e59 7f00 0001
0x0010: 7f00 0001 0425 0000 5990 8dd1 4030 b112
000 0200 dbb0 0000 536f 6d65 2072 616e 000 0200 dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
The TCP header length is found in the high-order nibble of the 12
th
byte offset in the The TCP header length is found in the high-order nibble of the 12
th
byte offset in the
bit word and must be multiplied by 4 to convert to
Needed to calculate where the TCP header stops, and where data starts.
Docoulo JCl ooouor (2} Docoulo JCl ooouor (2}
Offset 12, length 4 bits Offset 13, length 1
0x0000: 4500 0088 ee14 0000 400
Offset 12, length 4 bits
Header Length
Offset 13, length 1
byte, Flags
0x0000: 4500 0088 ee14 0000 400
0x0010: 7f00 0001 0425 0000 5990 8dd1
0x0020: 5018 0200 dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
0x0050: 0000
Window
Size
Byte offset 8, length 4 bytes Ack. Number:
Byte offset 12, length 4 bits Header Length: 5 32
Byte offset 13, length 1 byte TCP Flags:
Size
Byte offset 13, length 1 byte TCP Flags:
Byte offset 14, length 2 byte Windows Size:
Docoulo JCl ooouor (2} Docoulo JCl ooouor (2}
Ack. Number Offset 13, length 1
00 0088 ee14 0000 4006 8e59 7f00 0001
Ack. Number
1076932882
Offset 13, length 1
byte, Flags
00 0088 ee14 0000 4006 8e59 7f00 0001
0425 0000 5990 8dd1 4030 b112
dbb0 0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
Byte offset 8, length 4 bytes Ack. Number: 4030 b112 - 1076932882
Byte offset 12, length 4 bits Header Length: 5 32-bit words
Byte offset 13, length 1 byte TCP Flags: 18 0001 1000 = PSH, ACK Byte offset 13, length 1 byte TCP Flags: 18 0001 1000 = PSH, ACK
Byte offset 14, length 2 byte Windows Size: 0200 - 512
JCl uoouor Looto wlto otloos JCl uoouor Looto wlto otloos
0x0000: 4500 0094 95f7 0000 4006 e66a 7f00 0001 0x0000: 4500 0094 95f7 0000 4006 e66a 7f00 0001
0x0010: 7f00 0001 0a72 0000 5258 3d2d 2e30 da24
0x0020: 8000 0200 5000 0000 0x0020: 8000 0200 5000 0000
0x0030: 0000 0000 5443 5020 7061 636b 6574 2077
0x0040: 6974 6820 6f70 7469 6f6e 730a 0000 0000
0x0050: 0000 0x0050: 0000
TCP Header length = 8 * 4 = 32 TCP Header length = 8 * 4 = 32
Minimum TCP header length = 20
Options length = 32 20 = 12 starting from
01 01 nop nop 01 01 nop nop
08 Timestamp followed by timestamp
0000 0000 Padding
JCl uoouor Looto wlto otloos JCl uoouor Looto wlto otloos
0x0000: 4500 0094 95f7 0000 4006 e66a 7f00 0001 0x0000: 4500 0094 95f7 0000 4006 e66a 7f00 0001
0x0010: 7f00 0001 0a72 0000 5258 3d2d 2e30 da24
000 0200 5000 0000 0101 080a ef2e feeb 000 0200 5000 0000 0101 080a ef2e feeb
5443 5020 7061 636b 6574 2077
0x0040: 6974 6820 6f70 7469 6f6e 730a 0000 0000
20 = 12 starting from 20
th
TCP byte offset
Timestamp followed by timestamp - 080a ef2e feeb
Docoulo JCl ooouor (3} Docoulo JCl ooouor (3}
Offset 16, length 2 Offset 18, length 2
0x0000: 4500 0088 ee14 0000 400
Offset 16, length 2
bytes Checksum
Offset 18, length 2
bytes, Urgent Pointer
0x0000: 4500 0088 ee14 0000 400
0x0010: 7f00 0001 0425 0000 5990 8dd1 4030 b112
0x0020: 5018 0200 dbb0 0000
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
0x0050: 0000
Byte offset 16, length 2 bytes Checksum:
Byte offset 18, length 2 bytes Urgent pointer 0000
Byte offset 20, length 96 bytes Data: Some random data + padding.
(TCP HL Min. TCP HL) = TCP Options Length
(5*4) 20 = 0 NO Options
IP TL (IHL + TCP HL) = Payload Length
136 ((5*4) + (5*4)) = 96 bytes - Rest of padding is not showing/was not captured
Docoulo JCl ooouor (3} Docoulo JCl ooouor (3}
Offset 20, length 96 Offset 18, length 2
00 0088 ee14 0000 4006 8e59 7f00 0001
Offset 20, length 96
bytes Data
Offset 18, length 2
bytes, Urgent Pointer
00 0088 ee14 0000 4006 8e59 7f00 0001
0425 0000 5990 8dd1 4030 b112
0000 536f 6d65 2072 616e
0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000 0x0030: 646f 6d20 6461 7461 0a00 0000 0000 0000
0x0040: 0000 0000 0000 0000 0000 0000 0000 0000
Byte offset 16, length 2 bytes Checksum: dbb0 - 56240
Byte offset 18, length 2 bytes Urgent pointer 0000
Byte offset 20, length 96 bytes Data: Some random data + padding.
Min. TCP HL) = TCP Options Length
(IHL + TCP HL) = Payload Length
Rest of padding is not showing/was not captured
uoouor OIIsot oou Looto uoouor OIIsot oou Looto
Header Offset Shortcuts Header Offset Shortcuts
Field Length (bits) TCPDUMP Filter
IP Header Length 4 ip[0] &0x0F IP Header Length 4 ip[0] &0x0F
IP Packet Length 16 ip[2:2]
IP TTL 8 ip[8]
IP Protocol 8 ip[9]
D Hex Proto D
1 0x01 ICMP 9 1 0x01 ICMP 9
2 0x02 IGMP 17
6 0x06 TCP 47
IP Address - Src 32 ip[12:4]
IP Address - Dst 32 ip[16:4]
flag=3
IP Fragmentation
flag=3
offset=13
ICMP Type 8 icmp[0]
ICMP Code 8 icmp[1]
TCP Src Port 16 tcp[0:2]
TCP Dst Port 16 tcp[2:2] TCP Dst Port 16 tcp[2:2]
TCP Header Length 4 tcp[12] &0x0F
TCP Flags 8 tcp[13]
TCP Windows Size 16 tcp[14:2]
UDP Src Port 16 udp[0:2] UDP Src Port 16 udp[0:2]
UDP Dst Port 16 udp[2:2]
UDP Header Length 16 udp[4:2]
uoouor OIIsot oou Looto uoouor OIIsot oou Looto
Header Offset Shortcuts Header Offset Shortcuts
Notes
Remember to use a 4 byte multiplier to find header length in bytes Remember to use a 4 byte multiplier to find header length in bytes
The is no multiple for this length field
Hex Proto D Hex Proto
0x09 IGRP 47 0x2F GRE 0x09 IGRP 47 0x2F GRE
0x11 UDP 50 0x32 ESP
0x2F GRE 51 0x33 AH
ip[6] &0x20 = 0x20 More Fragment bit is set. ip[6] &0x20 = 0x20 More Fragment bit is set.
ip[6:2] &0x1fff != 0x000 fragment offset in not 0
Remember to use a 4 byte multiplier to find header length in bytes
The is no multiple for this length field
JClDuVl Illtors JClDuVl Illtors
Two different formats to specify filters: Two different formats to specify filters:
1. Byte displacement
<protocol header> [offset:length] <relation> <value> <protocol header> [offset:length] <relation> <value>
ip[9] = 6 embedded protocol is TCP
tcp[2:2] = 80 destination port is 80
udp[6:2] != 0 udp checksum not zero udp[6:2] != 0 udp checksum not zero
Icmp[0] = 8 echo packet
2. <macro> <value>
dst host www.msn.com
port != ssh port != ssh
ether src MAC
net 10.10.10.0/24
JClDuVl Illtors JClDuVl Illtors
Two different formats to specify filters: Two different formats to specify filters:
<protocol header> [offset:length] <relation> <value> <protocol header> [offset:length] <relation> <value>
ip[9] = 6 embedded protocol is TCP
tcp[2:2] = 80 destination port is 80
udp[6:2] != 0 udp checksum not zero udp[6:2] != 0 udp checksum not zero
Icmp[0] = 8 echo packet
JClDuVl Illtors oolos JClDuVl Illtors oolos
Look for all IP packets with TCP embedded protocol Look for all IP packets with TCP embedded protocol
#> tcpdump nnx r <pcap.file> ip[9] = 6
Look for all TCP packets with flags
#> tcpdump nnx r <pcap.file> tcp[13] != 0
Look for all TCP packets with Sync bit only
#> tcpdump nnx r <pcap.file> tcp[13] = 2 #> tcpdump nnx r <pcap.file> tcp[13] = 2
Look for all ICMP packets with port unreachable
#> tcpdump nnx r <pcap.file> icmp[0] = 3 and icmp[1] = 3 #> tcpdump nnx r <pcap.file> icmp[0] = 3 and icmp[1] = 3
Or
#> tcpdump nnx r <pcap.file> icmp[0:2] = 0x0303
JClDuVl Illtors oolos JClDuVl Illtors oolos
Look for all IP packets with TCP embedded protocol Look for all IP packets with TCP embedded protocol
r <pcap.file> ip[9] = 6
Look for all TCP packets with flags
r <pcap.file> tcp[13] != 0
Look for all TCP packets with Sync bit only
r <pcap.file> tcp[13] = 2 r <pcap.file> tcp[13] = 2
Look for all ICMP packets with port unreachable
r <pcap.file> icmp[0] = 3 and icmp[1] = 3 r <pcap.file> icmp[0] = 3 and icmp[1] = 3
r <pcap.file> icmp[0:2] = 0x0303
Lob Lob
Jols lob osscos toot tcuc oocctoblo ls lo yocr oto, lI oot o|o Jols lob osscos toot tcuc oocctoblo ls lo yocr oto, lI oot o|o
scro yoc rco tcuc cslo too obsolcto oto. 8tort too lob by bootlo
loto yocr CN8oort vlrtcol ocoloo oou lolo os root,root (ADlll}
IIeose no|e |bo| runninq os roo| is donqerous ond sbouId no| be done
in reoI[roduc|ion environmen|. in reoI[roduc|ion environmen|.
8ec|ion 1:
Gool. kco tcuc to roou Iro o cotcro Illo Gool. kco tcuc to roou Iro o cotcro Illo
,root,tcuc_ooousoo,
#> |cdum -r sec|ion1.co #> |cdum -r sec|ion1.co
uow ooy oc|ots woro ulsloyou.
kco lt oolo wlto ooo rosolctloo (-o otloo}, ls lt Iostor kco lt oolo wlto ooo rosolctloo (-o otloo}, ls lt Iostor
Lob Lob
Jols lob osscos toot tcuc oocctoblo ls lo yocr oto, lI oot o|o Jols lob osscos toot tcuc oocctoblo ls lo yocr oto, lI oot o|o
scro yoc rco tcuc cslo too obsolcto oto. 8tort too lob by bootlo
loto yocr CN8oort vlrtcol ocoloo oou lolo os root,root (ADlll}
IIeose no|e |bo| runninq os roo| is donqerous ond sbouId no| be done
Gool. kco tcuc to roou Iro o cotcro Illo. Coooo ulroctory to Gool. kco tcuc to roou Iro o cotcro Illo. Coooo ulroctory to
ulsloyou.
o otloo}, ls lt Iostor o otloo}, ls lt Iostor
Lob Coot. Lob Coot.
8ec|ion 2: 8ec|ion 2:
Gool. kco tcuc to roou Iro o cotcro Illo oou ooly cotcro too Ilrst
3 rocorus.
Noto. -c otloo to soclIy too rocoru cocot
Coloto too Iollowlo cooou to soow too Ilrst 3 rocorus.
#> |cdum -r sec|ion1.co
Woot ls too uostlootloo l ouuross oou ort ocbor oI too socoou
rocoru
Lob Coot. Lob Coot.
Gool. kco tcuc to roou Iro o cotcro Illo oou ooly cotcro too Ilrst
c otloo to soclIy too rocoru cocot
Coloto too Iollowlo cooou to soow too Ilrst 3 rocorus.
Woot ls too uostlootloo l ouuross oou ort ocbor oI too socoou
Lob Coot. Lob Coot.
8ec|ion 8: 8ec|ion 8:
Gool. kco tcuc to roou Iro o cotcro Illo oou ulsloy octct lo
oo.
Noto. - otloo to soclIy oo octct
Coloto too Iollowlo cooou to soow too Ilrst l rocoru lo oo.
#> |cdum -r sec|ion1.co
Woot oro too Ilrst 2 bytos Iro too oo uc |lolo boto.
Lob Coot. Lob Coot.
Gool. kco tcuc to roou Iro o cotcro Illo oou ulsloy octct lo
otloo to soclIy oo octct
Coloto too Iollowlo cooou to soow too Ilrst l rocoru lo oo.
Woot oro too Ilrst 2 bytos Iro too oo uc |lolo boto.
Lob Coot. Lob Coot.
8ec|ion 4: 8ec|ion 4:
Gool. kco tcuc to roou Iro o 'troIIlc.co' cotcro Illo oou ulsloy
octct cslo Illtors.
|olo. #> |cdum -nn -r |ro||ic.co 'ud'
Noto. uso oo to scross ooo,ort rosolctloo oou ooscro Illtors oro
gcotou.
Wrlto uowo too cooou oou Illtor csou to soow too Ilrst 5 tc oc|ots
Iro troIIlc.co Illo.
#> |cdum #> |cdum
Lob Coot. Lob Coot.
Gool. kco tcuc to roou Iro o 'troIIlc.co' cotcro Illo oou ulsloy
r |ro||ic.co 'ud'
oo to scross ooo,ort rosolctloo oou ooscro Illtors oro
Wrlto uowo too cooou oou Illtor csou to soow too Ilrst 5 tc oc|ots
Lob Coot. Lob Coot.
8ec|ion 5: 8ec|ion 5:
Gool. kco tcuc to roou Iro 'troIIlc.co' cotcro Illo oou ulsloy
octct cslo Illtors.
Noto. uso oo to scross ooo,ort rosolctloo oou ooscro Illtors oro
gcotou. gcotou.
|lou oll oc|ot wlto obouuou rotocol JCl oou uostlootloo ort 3389
Wrlto uowo too cooou oou Illtor csou.
#> |cdum -nn -r |ro||ic.co
uow ooy oc|ots Iocou
Lob Coot. Lob Coot.
Gool. kco tcuc to roou Iro 'troIIlc.co' cotcro Illo oou ulsloy
oo to scross ooo,ort rosolctloo oou ooscro Illtors oro
|lou oll oc|ot wlto obouuou rotocol JCl oou uostlootloo ort 3389
Wrlto uowo too cooou oou Illtor csou.
Lob Coot. Lob Coot.
8ec|ion : 8ec|ion :
Gool. Docouo too Iollowlo oc|ot oou ololo yocr Iloulo.
uuuuu. =5uu uu3c 3759 =uuu =uu I58 oclu u283 uuuuu. =5uu uu3c 3759 =uuu =uu I58 oclu u283
uuulu. =8uo cu8 c5cI uu5u o8=9 2uo uuuu uuuu
uuu2u. ouu2 luu IloI uuuu u2u= u5b= u=u2 u8uo uuu2u. ouu2 luu IloI uuuu u2u= u5b= u=u2 u8uo
uuu3u. u58 l737 uuuu uuuu ulu3 u3u
Woot ls too obouuou rotocol. Woot ls too obouuou rotocol.
Llst socrco oou uostlootloo l ouurossos.
Llst ooy ll |los lI rosoot.
Woot ls too JJL Coo yoc loIor too tyo oI O8 toot ooorotou too Woot ls too JJL Coo yoc loIor too tyo oI O8 toot ooorotou too
oc|ot
Doos too obouuou rotocol oovo ooy otloos Llst too lI ovolloblo Doos too obouuou rotocol oovo ooy otloos Llst too lI ovolloblo
Lob Coot. Lob Coot.
Gool. Docouo too Iollowlo oc|ot oou ololo yocr Iloulo.
uuuuu. =5uu uu3c 3759 =uuu =uu I58 oclu u283 uuuuu. =5uu uu3c 3759 =uuu =uu I58 oclu u283
uuulu. =8uo cu8 c5cI uu5u o8=9 2uo uuuu uuuu
uuu2u. ouu2 luu IloI uuuu u2u= u5b= u=u2 u8uo uuu2u. ouu2 luu IloI uuuu u2u= u5b= u=u2 u8uo
uuu3u. u58 l737 uuuu uuuu ulu3 u3u
Llst socrco oou uostlootloo l ouurossos.
Woot ls too JJL Coo yoc loIor too tyo oI O8 toot ooorotou too Woot ls too JJL Coo yoc loIor too tyo oI O8 toot ooorotou too
Doos too obouuou rotocol oovo ooy otloos Llst too lI ovolloblo Doos too obouuou rotocol oovo ooy otloos Llst too lI ovolloblo