No. Time Source Destination Protocol Info 236 20.287585 10.147.40.51 10.147.20.85 TCP 12645 > h323hostcall [SYN] Seq=0 Win=8192 Len=0 MSS=1456 WS=0 TSV=1636470495 TSER=0 Frame 236 (74 bytes on wire, 74 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.865792000 [Time delta from previous captured frame: 0.187759000 seconds] [Time delta from previous displayed frame: 20.287585000 seconds] [Time since reference or first frame: 20.287585000 seconds] Frame Number: 236 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0xa4ea (42218) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x4524 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 0, Len: 0 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 0 (relative sequence number) Header length: 40 bytes Flags: 0x02 (SYN) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgement: Not set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set [Expert Info (Chat/Sequence): Connection establish request (SYN): server port h323hostcall] [Message: Connection establish request (SYN): server port h323hostcall] [Severity level: Chat] [Group: Sequence] .... ...0 = Fin: Not set Window size: 8192 Checksum: 0x4ed9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (20 bytes) Maximum segment size: 1456 bytes NOP Window scale: 0 (multiply by 1) NOP NOP Timestamps: TSval 1636470495, TSecr 0 No. Time Source Destination Protocol Info 237 20.287611 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=46345434 TSER=1636470495 WS=6 Frame 237 (74 bytes on wire, 74 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.865818000 [Time delta from previous captured frame: 0.000026000 seconds] [Time delta from previous displayed frame: 0.000026000 seconds] [Time since reference or first frame: 20.287611000 seconds] Frame Number: 237 Frame Length: 74 bytes Capture Length: 74 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 60 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe90e [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 0, Ack: 1, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 0 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 40 bytes Flags: 0x12 (SYN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..1. = Syn: Set [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port h323hostcall] [Message: Connection establish acknowledge (SYN+ACK): server port h323hostcall] [Severity level: Chat] [Group: Sequence] .... ...0 = Fin: Not set Window size: 5792 Checksum: 0xb471 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (20 bytes) Maximum segment size: 1460 bytes NOP NOP Timestamps: TSval 46345434, TSecr 1636470495 NOP Window scale: 6 (multiply by 64) [SEQ/ACK analysis] [This is an ACK to the segment in frame: 236] [The RTT to ACK the segment was: 0.000026000 seconds] No. Time Source Destination Protocol Info 238 20.289065 10.147.40.51 10.147.20.85 TCP 12645 > h323hostcall [ACK] Seq=1 Ack=1 Win=8664 Len=0 TSV=1636470495 TSER=46345434 Frame 238 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.867272000 [Time delta from previous captured frame: 0.001454000 seconds] [Time delta from previous displayed frame: 0.001454000 seconds] [Time since reference or first frame: 20.289065000 seconds] Frame Number: 238 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xa4eb (42219) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x452b [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 1, Ack: 1, Len: 0 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 1 (relative sequence number) Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xd503 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470495, TSecr 46345434 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 237] [The RTT to ACK the segment was: 0.001454000 seconds] No. Time Source Destination Protocol Info 241 20.303965 10.147.40.51 10.147.20.85 TCP [TCP segment of a reassembled PDU] Frame 241 (322 bytes on wire, 322 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.882172000 [Time delta from previous captured frame: 0.003911000 seconds] [Time delta from previous displayed frame: 0.014900000 seconds] [Time since reference or first frame: 20.303965000 seconds] Frame Number: 241 Frame Length: 322 bytes Capture Length: 322 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 308 Identification: 0xa4ec (42220) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x442a [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 1, Ack: 1, Len: 256 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 1 (relative sequence number) [Next sequence number: 257 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xccd7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470498, TSecr 46345434 [SEQ/ACK analysis] [Number of bytes in flight: 256] TCP segment data (256 bytes) No. Time Source Destination Protocol Info 242 20.303988 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=1 Ack=257 Win=6912 Len=0 TSV=46345438 TSER=1636470498 Frame 242 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.882195000 [Time delta from previous captured frame: 0.000023000 seconds] [Time delta from previous displayed frame: 0.000023000 seconds] [Time since reference or first frame: 20.303988000 seconds] Frame Number: 242 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb488 (46216) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x348e [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 1, Ack: 257, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 1 (relative sequence number) Acknowledgement number: 257 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 6912 (scaled) Checksum: 0xf568 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345438, TSecr 1636470498 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 241] [The RTT to ACK the segment was: 0.000023000 seconds] No. Time Source Destination Protocol Info 243 20.307105 10.147.40.51 10.147.20.85 H.225.0 CS: setup OpenLogicalChannel Frame 243 (262 bytes on wire, 262 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.885312000 [Time delta from previous captured frame: 0.003117000 seconds] [Time delta from previous displayed frame: 0.003117000 seconds] [Time since reference or first frame: 20.307105000 seconds] Frame Number: 243 Frame Length: 262 bytes Capture Length: 262 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:q932:q932.ros:data:q932:q932.ros:qsig:q932:q932.ros:qsig:h225] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 248 Identification: 0xa4ed (42221) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x4465 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 257, Ack: 1, Len: 196 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 257 (relative sequence number) [Next sequence number: 453 (relative sequence number)] Acknowledgement number: 1 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0x414c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470499, TSecr 46345438 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 242] [The RTT to ACK the segment was: 0.003117000 seconds] [Number of bytes in flight: 196] TCP segment data (196 bytes) [Reassembled TCP Segments (452 bytes): #241(256), #243(196)] [Frame: 241, payload: 0-255 (256 bytes)] [Frame: 243, payload: 256-451 (196 bytes)] TPKT, Version: 3, Length: 452 Version: 3 Reserved: 0 Length: 452 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: SETUP (0x05) Sending complete Bearer capability Information element: Bearer capability Length: 3 1... .... = Extension indicator: last octet .00. .... = Coding standard: ITU-T standardized coding (0x00) ...1 0000 = Information transfer capability: 3.1 kHz audio (0x10) 1... .... = Extension indicator: last octet .00. .... = Transfer mode: Circuit mode (0x00) ...1 0000 = Information transfer rate: 64 kbit/s (0x10) 1... .... = Extension indicator: last octet .01. .... = Layer identification: Layer 1 identifier (0x01) ...0 0101 = User information layer 1 protocol: Recommendation H.221 and H.242 (0x05) Facility INV: 1.3.12.2.1016.1.255 Type: Facility (0x1c) Length: 58 ...1 1111 = Protocol profile: Networking extensions (0x1f) NetworkFacilityExtension sourceEntity: endPINX (0) destinationEntity: endPINX (0) InterpretationComponent: discardAnyUnrecognisedInvokePdu (0) ROS: invoke (1) invoke invokeId: present (0) present: -5828 opcode: global (1) global: 1.3.12.2.1016.1.255 (SNMPv2-SMI::org.12.2.1016.1.255) argument: 041CF9F7020000F50F23566F6963656D61696C2041737465... Data (30 bytes) 0000 04 1c f9 f7 02 00 00 f5 0f 23 56 6f 69 63 65 6d .........#Voicem 0010 61 69 6c 20 41 73 74 65 f4 04 82 91 b3 a5 ail Aste...... Data: 041CF9F7020000F50F23566F6963656D61696C2041737465... [Length: 30] Facility INV: divertingLegInformation2 Type: Facility (0x1c) Length: 99 ...1 1111 = Protocol profile: Networking extensions (0x1f) NetworkFacilityExtension sourceEntity: endPINX (0) destinationEntity: endPINX (0) InterpretationComponent: discardAnyUnrecognisedInvokePdu (0) ROS: invoke (1) invoke invokeId: present (0) present: -5827 opcode: local (0) local: 21 - divertingLegInformation2 argument: 30800201010A0100800100A180A080A5800A010412053430... QSIG: divertingLegInformation2 Operation: divertingLegInformation2 (21) Service: QSIG-CF (13873) - Call-Diversion-Operations ARG-divertingLegInformation2 diversionCounter: 1 diversionReason: unknown (0) originalDiversionReason: unknown (0) divertingNr: presentationAllowedAddressNU (0) presentationAllowedAddressNU: privatePartyNumber (5) privatePartyNumber privateTypeOfNumber: localNumber (4) privateNumberDigits: 40075 originalCalledNr: presentationAllowedAddressNU (0) presentationAllowedAddressNU: privatePartyNumber (5) privatePartyNumber privateTypeOfNumber: localNumber (4) privateNumberDigits: 40075 redirectingName: namePresentationAllowed (0) namePresentationAllowed: namePresentationAllowedSimple (0) namePresentationAllowedSimple: CONSTANTIN, Cyr Facility INV: callingName Type: Facility (0x1c) Length: 38 ...1 1111 = Protocol profile: Networking extensions (0x1f) NetworkFacilityExtension sourceEntity: endPINX (0) destinationEntity: endPINX (0) InterpretationComponent: discardAnyUnrecognisedInvokePdu (0) ROS: invoke (1) invoke invokeId: present (0) present: -5826 opcode: local (0) local: 0 - callingName argument: 800F464C5945205341494E5445204D4152 QSIG: callingName Operation: callingName (0) Service: QSIG-NA (13868) - Name-Operations NameArg: name (0) name: namePresentationAllowed (0) namePresentationAllowed: namePresentationAllowedSimple (0) namePresentationAllowedSimple: FLYE SAINTE MAR Calling party number: '44232' Information element: Calling party number Length: 7 .... 1001 = Numbering plan: Private numbering (0x09) .100 .... = Number type: Subscriber number (0x04) 0... .... = Extension indicator: information continues through the next octet .... ..00 = Screening indicator: User-provided, not screened (0x00) .00. .... = Presentation indicator: Presentation allowed (0x00) 1... .... = Extension indicator: last octet Calling party number digits: 44232 Called party number: '58000' Information element: Called party number Length: 6 .... 1001 = Numbering plan: Private numbering (0x09) .001 .... = Number type: International number (0x01) 1... .... = Extension indicator: last octet Called party number digits: 58000 User-user Information element: User-user Length: 194 Protocol discriminator: X.208 and X.209 coded user information Locking shift to codeset 6: Information elements specific to the local network Call appearance Information element: Call appearance Length: 19 Data: 8291B3A523566F6963656D61696C2041737465 H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: setup (0) setup protocolIdentifier: 0.0.8.2250.0.5 (Version 5) sourceInfo vendor vendor t35CountryCode: United States (181) t35Extension: 0 manufacturerCode: 19540 H.221 Manufacturer: Lucent Technologies (0xb5004c54) productId: Avaya Multivantage versionId: R013x.01.5.642.3 gatekeeper gateway protocol: 3 items Item 0 SupportedProtocols: h320 (2) h320 supportedPrefixes: 1 item Item 0 SupportedPrefix prefix: dialedDigits (0) dialedDigits: 9 Item 1 SupportedProtocols: h323 (5) h323 supportedPrefixes: 1 item Item 0 SupportedPrefix prefix: dialedDigits (0) dialedDigits: 9 Item 2 SupportedProtocols: voice (7) voice supportedPrefixes: 1 item Item 0 SupportedPrefix prefix: dialedDigits (0) dialedDigits: 9 mcu ..1. .... mc: True ...0 .... undefinedNode: False destinationAddress: 1 item Item 0 AliasAddress: dialedDigits (0) dialedDigits: 58000 .... 0... activeMC: False conferenceID: 80449e8d-923a-df01-baa0-4b3bf3220000 conferenceGoal: create (0) create: NULL callType: pointToPoint (0) pointToPoint: NULL sourceCallSignalAddress: ipAddress (0) ipAddress ip: 10.147.40.51 (10.147.40.51) port: 1720 callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 fastStart: 2 items Item 0 FastStart item: 19 octets OpenLogicalChannel forwardLogicalChannelNumber: 101 forwardLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (3) h2250LogicalChannelParameters sessionID: 1 0... .... mediaGuaranteedDelivery: False mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.40.75 (10.147.40.75) tsapIdentifier: 2485 0... .... mediaControlGuaranteedDelivery: False .0.. .... silenceSuppression: False Item 1 FastStart item: 30 octets OpenLogicalChannel forwardLogicalChannelNumber: 101 forwardLogicalChannelParameters dataType: nullData (1) nullData: NULL multiplexParameters: none (4) none: NULL reverseLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (2) h2250LogicalChannelParameters sessionID: 1 mediaChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.40.75 (10.147.40.75) tsapIdentifier: 2484 mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.40.75 (10.147.40.75) tsapIdentifier: 2485 0... .... silenceSuppression: False 0... .... mediaWaitForConnect: False 1... .... canOverlapSend: True 0... .... multipleCalls: False 0... .... maintainConnection: False 1... .... h245Tunneling: True No. Time Source Destination Protocol Info 244 20.307111 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=1 Ack=453 Win=7936 Len=0 TSV=46345439 TSER=1636470499 Frame 244 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:37.885318000 [Time delta from previous captured frame: 0.000006000 seconds] [Time delta from previous displayed frame: 0.000006000 seconds] [Time since reference or first frame: 20.307111000 seconds] Frame Number: 244 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb489 (46217) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x348d [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 1, Ack: 453, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 1 (relative sequence number) Acknowledgement number: 453 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xf492 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345439, TSecr 1636470499 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 243] [The RTT to ACK the segment was: 0.000006000 seconds] No. Time Source Destination Protocol Info 247 20.482452 10.147.20.85 10.147.40.51 H.225.0 CS: callProceeding Frame 247 (152 bytes on wire, 152 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.060659000 [Time delta from previous captured frame: 0.042141000 seconds] [Time delta from previous displayed frame: 0.175341000 seconds] [Time since reference or first frame: 20.482452000 seconds] Frame Number: 247 Frame Length: 152 bytes Capture Length: 152 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 138 Identification: 0xb48a (46218) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3436 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 1, Ack: 453, Len: 86 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 1 (relative sequence number) [Next sequence number: 87 (relative sequence number)] Acknowledgement number: 453 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0x522a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345483, TSecr 1636470499 [SEQ/ACK analysis] [Number of bytes in flight: 86] TPKT, Version: 3, Length: 86 Version: 3 Reserved: 0 Length: 86 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: CALL PROCEEDING (0x02) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 59 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: callProceeding (1) callProceeding protocolIdentifier: 0.0.8.2250.0.4 (Version 4) destinationInfo vendor vendor t35CountryCode: Albania (1) t35Extension: 0 manufacturerCode: 71 H.221 Manufacturer: Unknown (0x01000047) productId: objsys versionId: v0.8.3 terminal ..0. .... mc: False ...0 .... undefinedNode: False callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 0... .... multipleCalls: False 0... .... maintainConnection: False 1... .... h245Tunneling: True No. Time Source Destination Protocol Info 248 20.525733 10.147.40.51 10.147.20.85 TCP 12645 > h323hostcall [ACK] Seq=453 Ack=87 Win=8664 Len=0 TSV=1636470543 TSER=46345483 Frame 248 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.103940000 [Time delta from previous captured frame: 0.043281000 seconds] [Time delta from previous displayed frame: 0.043281000 seconds] [Time since reference or first frame: 20.525733000 seconds] Frame Number: 248 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xa4ee (42222) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x4528 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 453, Ack: 87, Len: 0 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 453 (relative sequence number) Acknowledgement number: 87 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xd288 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470543, TSecr 46345483 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 247] [The RTT to ACK the segment was: 0.043281000 seconds] No. Time Source Destination Protocol Info 249 20.525744 10.147.20.85 10.147.40.51 H.225.0 CS: alerting OpenLogicalChannel CS: connect OpenLogicalChannel Frame 249 (389 bytes on wire, 389 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.103951000 [Time delta from previous captured frame: 0.000011000 seconds] [Time delta from previous displayed frame: 0.000011000 seconds] [Time since reference or first frame: 20.525744000 seconds] Frame Number: 249 Frame Length: 389 bytes Capture Length: 389 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:q931:h225] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 375 Identification: 0xb48b (46219) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3348 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 87, Ack: 453, Len: 323 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 87 (relative sequence number) [Next sequence number: 410 (relative sequence number)] Acknowledgement number: 453 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0x5317 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345494, TSecr 1636470543 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 248] [The RTT to ACK the segment was: 0.000011000 seconds] [Number of bytes in flight: 323] TPKT, Version: 3, Length: 151 Version: 3 Reserved: 0 Length: 151 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: ALERTING (0x01) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 124 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: alerting (3) alerting protocolIdentifier: 0.0.8.2250.0.4 (Version 4) destinationInfo vendor vendor t35CountryCode: Albania (1) t35Extension: 0 manufacturerCode: 71 H.221 Manufacturer: Unknown (0x01000047) productId: objsys versionId: v0.8.3 terminal ..0. .... mc: False ...0 .... undefinedNode: False callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 fastStart: 2 items Item 0 FastStart item: 26 octets OpenLogicalChannel forwardLogicalChannelNumber: 101 forwardLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (3) h2250LogicalChannelParameters sessionID: 1 mediaChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10226 0... .... mediaGuaranteedDelivery: False mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10227 0... .... mediaControlGuaranteedDelivery: False .0.. .... silenceSuppression: False Item 1 FastStart item: 23 octets OpenLogicalChannel forwardLogicalChannelNumber: 1001 forwardLogicalChannelParameters dataType: nullData (1) nullData: NULL multiplexParameters: none (4) none: NULL reverseLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (2) h2250LogicalChannelParameters sessionID: 1 mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10227 0... .... silenceSuppression: False 0... .... multipleCalls: False 0... .... maintainConnection: False alertingAddress: 1 item Item 0 AliasAddress: dialedDigits (0) dialedDigits: 58000 presentationIndicator: presentationAllowed (0) presentationAllowed: NULL screeningIndicator: userProvidedNotScreened (0) 1... .... h245Tunneling: True TPKT, Version: 3, Length: 172 Version: 3 Reserved: 0 Length: 172 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: CONNECT (0x07) Bearer capability Information element: Bearer capability Length: 3 1... .... = Extension indicator: last octet .00. .... = Coding standard: ITU-T standardized coding (0x00) ...0 1000 = Information transfer capability: Unrestricted digital information (0x08) 1... .... = Extension indicator: last octet .10. .... = Transfer mode: Packet mode (0x02) ...0 0000 = Information transfer rate: Packet mode (0x00) 1... .... = Extension indicator: last octet .01. .... = Layer identification: Layer 1 identifier (0x01) ...0 0101 = User information layer 1 protocol: Recommendation H.221 and H.242 (0x05) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 140 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: connect (2) connect protocolIdentifier: 0.0.8.2250.0.4 (Version 4) destinationInfo vendor vendor t35CountryCode: Albania (1) t35Extension: 0 manufacturerCode: 71 H.221 Manufacturer: Unknown (0x01000047) productId: objsys versionId: v0.8.3 terminal ..0. .... mc: False ...0 .... undefinedNode: False conferenceID: 80449e8d-923a-df01-baa0-4b3bf3220000 callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 fastStart: 2 items Item 0 FastStart item: 26 octets OpenLogicalChannel forwardLogicalChannelNumber: 101 forwardLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (3) h2250LogicalChannelParameters sessionID: 1 mediaChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10226 0... .... mediaGuaranteedDelivery: False mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10227 0... .... mediaControlGuaranteedDelivery: False .0.. .... silenceSuppression: False Item 1 FastStart item: 23 octets OpenLogicalChannel forwardLogicalChannelNumber: 1001 forwardLogicalChannelParameters dataType: nullData (1) nullData: NULL multiplexParameters: none (4) none: NULL reverseLogicalChannelParameters dataType: audioData (3) audioData: g711Alaw64k (1) g711Alaw64k: 20 multiplexParameters: h2250LogicalChannelParameters (2) h2250LogicalChannelParameters sessionID: 1 mediaControlChannel: unicastAddress (0) unicastAddress: iPAddress (0) iPAddress network: 10.147.20.85 (10.147.20.85) tsapIdentifier: 10227 0... .... silenceSuppression: False 0... .... multipleCalls: False 0... .... maintainConnection: False connectedAddress: 1 item Item 0 AliasAddress: dialedDigits (0) dialedDigits: 58000 presentationIndicator: presentationAllowed (0) presentationAllowed: NULL screeningIndicator: userProvidedNotScreened (0) 1... .... h245Tunneling: True No. Time Source Destination Protocol Info 250 20.547813 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility terminalCapabilitySet Frame 250 (181 bytes on wire, 181 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.126020000 [Time delta from previous captured frame: 0.022069000 seconds] [Time delta from previous displayed frame: 0.022069000 seconds] [Time since reference or first frame: 20.547813000 seconds] Frame Number: 250 Frame Length: 181 bytes Capture Length: 181 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 167 Identification: 0xa4ef (42223) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44b4 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 453, Ack: 410, Len: 115 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 453 (relative sequence number) [Next sequence number: 568 (relative sequence number)] Acknowledgement number: 410 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xe604 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470547, TSecr 46345494 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 249] [The RTT to ACK the segment was: 0.022069000 seconds] [Number of bytes in flight: 115] TPKT, Version: 3, Length: 115 Version: 3 Reserved: 0 Length: 115 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 103 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 62 octets H.245 PDU Type: request (0) request: terminalCapabilitySet (2) terminalCapabilitySet sequenceNumber: 1 protocolIdentifier: 0.0.8.245.0.10 (h245 version 10) multiplexCapability: h2250Capability (4) h2250Capability maximumAudioDelayJitter: 100 receiveMultipointCapability .0.. .... multicastCapability: False ..0. .... multiUniCastConference: False mediaDistributionCapability: 1 item Item 0 MediaDistributionCapability ...1 .... centralizedControl: True .... 0... distributedControl: False .... .1.. centralizedAudio: True .... ..0. distributedAudio: False .... ...1 centralizedVideo: True 0... .... distributedVideo: False transmitMultipointCapability ..0. .... multicastCapability: False ...0 .... multiUniCastConference: False mediaDistributionCapability: 1 item Item 0 MediaDistributionCapability ...1 .... centralizedControl: True .... 0... distributedControl: False .... .1.. centralizedAudio: True .... ..0. distributedAudio: False .... ...1 centralizedVideo: True 0... .... distributedVideo: False receiveAndTransmitMultipointCapability ..0. .... multicastCapability: False ...0 .... multiUniCastConference: False mediaDistributionCapability: 1 item Item 0 MediaDistributionCapability ...1 .... centralizedControl: True .... 0... distributedControl: False .... .1.. centralizedAudio: True .... ..0. distributedAudio: False .... ...1 centralizedVideo: True 0... .... distributedVideo: False mcCapability ..1. .... centralizedConferenceMC: True ...0 .... decentralizedConferenceMC: False .... 0... rtcpVideoControlCapability: False mediaPacketizationCapability .... ..0. h261aVideoPacketization: False 0... .... logicalChannelSwitchingCapability: False 0... .... t120DynamicPortCapability: False capabilityTable: 3 items Item 0 CapabilityTableEntry capabilityTableEntryNumber: 1 capability: receiveAndTransmitAudioCapability (6) receiveAndTransmitAudioCapability: g711Alaw64k (1) g711Alaw64k: 20 Item 1 CapabilityTableEntry capabilityTableEntryNumber: 2 capability: receiveAndTransmitUserInputCapability (17) receiveAndTransmitUserInputCapability: generalString (3) generalString: NULL Item 2 CapabilityTableEntry capabilityTableEntryNumber: 3 capability: receiveAndTransmitUserInputCapability (17) receiveAndTransmitUserInputCapability: dtmf (4) dtmf: NULL capabilityDescriptors: 1 item Item 0 CapabilityDescriptor capabilityDescriptorNumber: 1 simultaneousCapabilities: 2 items Item 0 AlternativeCapabilitySet: 1 item Item 0 alternativeCapability: 1 Item 1 AlternativeCapabilitySet: 2 items Item 0 alternativeCapability: 2 Item 1 alternativeCapability: 3 No. Time Source Destination Protocol Info 251 20.547821 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=410 Ack=568 Win=7936 Len=0 TSV=46345499 TSER=1636470547 Frame 251 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.126028000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 20.547821000 seconds] Frame Number: 251 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb48c (46220) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x348a [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 410, Ack: 568, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 410 (relative sequence number) Acknowledgement number: 568 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xf21a [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345499, TSecr 1636470547 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 250] [The RTT to ACK the segment was: 0.000008000 seconds] No. Time Source Destination Protocol Info 252 20.549129 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility masterSlaveDetermination Frame 252 (124 bytes on wire, 124 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.127336000 [Time delta from previous captured frame: 0.001308000 seconds] [Time delta from previous displayed frame: 0.001308000 seconds] [Time since reference or first frame: 20.549129000 seconds] Frame Number: 252 Frame Length: 124 bytes Capture Length: 124 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 110 Identification: 0xa4f0 (42224) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44ec [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 568, Ack: 410, Len: 58 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 568 (relative sequence number) [Next sequence number: 626 (relative sequence number)] Acknowledgement number: 410 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xe958 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470547, TSecr 46345494 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 251] [The RTT to ACK the segment was: 0.001308000 seconds] [Number of bytes in flight: 58] TPKT, Version: 3, Length: 58 Version: 3 Reserved: 0 Length: 58 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 46 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 5 octets H.245 PDU Type: request (0) request: masterSlaveDetermination (1) masterSlaveDetermination terminalType: 140 statusDeterminationNumber: 0 No. Time Source Destination Protocol Info 253 20.549133 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=410 Ack=626 Win=7936 Len=0 TSV=46345500 TSER=1636470547 Frame 253 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.127340000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 20.549133000 seconds] Frame Number: 253 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb48d (46221) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3489 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 410, Ack: 626, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 410 (relative sequence number) Acknowledgement number: 626 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xf1df [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345500, TSecr 1636470547 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 252] [The RTT to ACK the segment was: 0.000004000 seconds] No. Time Source Destination Protocol Info 293 20.701151 10.147.20.85 10.147.40.51 H.225.0/H.245 CS: facility terminalCapabilitySetAck Frame 293 (137 bytes on wire, 137 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.279358000 [Time delta from previous captured frame: 0.006389000 seconds] [Time delta from previous displayed frame: 0.152018000 seconds] [Time since reference or first frame: 20.701151000 seconds] Frame Number: 293 Frame Length: 137 bytes Capture Length: 137 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 123 Identification: 0xb48e (46222) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3441 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 410, Ack: 626, Len: 71 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 410 (relative sequence number) [Next sequence number: 481 (relative sequence number)] Acknowledgement number: 626 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0x521b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345538, TSecr 1636470547 [SEQ/ACK analysis] [Number of bytes in flight: 71] TPKT, Version: 3, Length: 71 Version: 3 Reserved: 0 Length: 71 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: FACILITY (0x62) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 44 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.4 (Version 4) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 3 octets H.245 PDU Type: response (1) response: terminalCapabilitySetAck (3) terminalCapabilitySetAck sequenceNumber: 1 No. Time Source Destination Protocol Info 298 20.725752 10.147.40.51 10.147.20.85 TCP 12645 > h323hostcall [ACK] Seq=626 Ack=481 Win=8664 Len=0 TSV=1636470583 TSER=46345538 Frame 298 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.303959000 [Time delta from previous captured frame: 0.000153000 seconds] [Time delta from previous displayed frame: 0.024601000 seconds] [Time since reference or first frame: 20.725752000 seconds] Frame Number: 298 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xa4f1 (42225) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x4525 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 626, Ack: 481, Len: 0 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 626 (relative sequence number) Acknowledgement number: 481 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xcff2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470583, TSecr 46345538 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 293] [The RTT to ACK the segment was: 0.024601000 seconds] No. Time Source Destination Protocol Info 299 20.725757 10.147.20.85 10.147.40.51 H.225.0/H.225.0/H.245 CS: facility terminalCapabilitySet CS: facility masterSlaveDeterminationAck Frame 299 (242 bytes on wire, 242 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.303964000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 20.725757000 seconds] Frame Number: 299 Frame Length: 242 bytes Capture Length: 242 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 228 Identification: 0xb48f (46223) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x33d7 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 481, Ack: 626, Len: 176 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 481 (relative sequence number) [Next sequence number: 657 (relative sequence number)] Acknowledgement number: 626 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0x5284 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345544, TSecr 1636470583 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 298] [The RTT to ACK the segment was: 0.000005000 seconds] [Number of bytes in flight: 176] TPKT, Version: 3, Length: 106 Version: 3 Reserved: 0 Length: 106 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: FACILITY (0x62) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 79 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.4 (Version 4) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 38 octets H.245 PDU Type: request (0) request: terminalCapabilitySet (2) terminalCapabilitySet sequenceNumber: 1 protocolIdentifier: 0.0.8.245.0.8 (h245 version 8) capabilityTable: 2 items Item 0 CapabilityTableEntry capabilityTableEntryNumber: 1 capability: receiveAudioCapability (4) receiveAudioCapability: g711Alaw64k (1) g711Alaw64k: 240 Item 1 CapabilityTableEntry capabilityTableEntryNumber: 2 capability: receiveRTPAudioTelephonyEventCapability (22) receiveRTPAudioTelephonyEventCapability dynamicRTPPayloadType: 101 audioTelephoneEvent: 0-16 capabilityDescriptors: 1 item Item 0 CapabilityDescriptor capabilityDescriptorNumber: 1 simultaneousCapabilities: 2 items Item 0 AlternativeCapabilitySet: 1 item Item 0 alternativeCapability: 1 Item 1 AlternativeCapabilitySet: 1 item Item 0 alternativeCapability: 2 TPKT, Version: 3, Length: 70 Version: 3 Reserved: 0 Length: 70 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent to originating side Call reference value: 23C0 Message type: FACILITY (0x62) Display 'Asterisk PBX\000' Information element: Display Length: 13 Display information: Asterisk PBX\000 User-user Information element: User-user Length: 43 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.4 (Version 4) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 2 octets H.245 PDU Type: response (1) response: masterSlaveDeterminationAck (1) masterSlaveDeterminationAck decision: master (0) master: NULL No. Time Source Destination Protocol Info 301 20.744064 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility terminalCapabilitySetAck Frame 301 (122 bytes on wire, 122 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.322271000 [Time delta from previous captured frame: 0.017686000 seconds] [Time delta from previous displayed frame: 0.018307000 seconds] [Time since reference or first frame: 20.744064000 seconds] Frame Number: 301 Frame Length: 122 bytes Capture Length: 122 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 108 Identification: 0xa4f2 (42226) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44ec [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 626, Ack: 657, Len: 56 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 626 (relative sequence number) [Next sequence number: 682 (relative sequence number)] Acknowledgement number: 657 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0x6c3f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470586, TSecr 46345544 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 299] [The RTT to ACK the segment was: 0.018307000 seconds] [Number of bytes in flight: 56] TPKT, Version: 3, Length: 56 Version: 3 Reserved: 0 Length: 56 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 44 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 3 octets H.245 PDU Type: response (1) response: terminalCapabilitySetAck (3) terminalCapabilitySetAck sequenceNumber: 1 No. Time Source Destination Protocol Info 302 20.744072 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=657 Ack=682 Win=7936 Len=0 TSV=46345548 TSER=1636470586 Frame 302 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.322279000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 20.744072000 seconds] Frame Number: 302 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb490 (46224) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3486 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 682, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 682 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xf059 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345548, TSecr 1636470586 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 301] [The RTT to ACK the segment was: 0.000008000 seconds] No. Time Source Destination Protocol Info 304 20.745766 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility masterSlaveDeterminationAck Frame 304 (121 bytes on wire, 121 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.323973000 [Time delta from previous captured frame: 0.000186000 seconds] [Time delta from previous displayed frame: 0.001694000 seconds] [Time since reference or first frame: 20.745766000 seconds] Frame Number: 304 Frame Length: 121 bytes Capture Length: 121 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 107 Identification: 0xa4f3 (42227) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44ec [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 682, Ack: 657, Len: 55 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 682 (relative sequence number) [Next sequence number: 737 (relative sequence number)] Acknowledgement number: 657 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0x4e0b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470587, TSecr 46345544 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 302] [The RTT to ACK the segment was: 0.001694000 seconds] [Number of bytes in flight: 55] TPKT, Version: 3, Length: 55 Version: 3 Reserved: 0 Length: 55 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 43 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 2 octets H.245 PDU Type: response (1) response: masterSlaveDeterminationAck (1) masterSlaveDeterminationAck decision: slave (1) slave: NULL No. Time Source Destination Protocol Info 305 20.745770 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=657 Ack=737 Win=7936 Len=0 TSV=46345549 TSER=1636470587 Frame 305 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.323977000 [Time delta from previous captured frame: 0.000004000 seconds] [Time delta from previous displayed frame: 0.000004000 seconds] [Time since reference or first frame: 20.745770000 seconds] Frame Number: 305 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb491 (46225) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3485 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 737, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 737 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xf020 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345549, TSecr 1636470587 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 304] [The RTT to ACK the segment was: 0.000004000 seconds] No. Time Source Destination Protocol Info 306 20.748284 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility conferenceIndication Frame 306 (125 bytes on wire, 125 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.326491000 [Time delta from previous captured frame: 0.002514000 seconds] [Time delta from previous displayed frame: 0.002514000 seconds] [Time since reference or first frame: 20.748284000 seconds] Frame Number: 306 Frame Length: 125 bytes Capture Length: 125 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 111 Identification: 0xa4f4 (42228) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44e7 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 737, Ack: 657, Len: 59 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 737 (relative sequence number) [Next sequence number: 796 (relative sequence number)] Acknowledgement number: 657 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0x956c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636470587, TSecr 46345549 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 305] [The RTT to ACK the segment was: 0.002514000 seconds] [Number of bytes in flight: 59] TPKT, Version: 3, Length: 59 Version: 3 Reserved: 0 Length: 59 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 47 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 6 octets H.245 PDU Type: indication (3) indication: conferenceIndication (16) conferenceIndication: terminalNumberAssign (1) terminalNumberAssign mcuNumber: 1 terminalNumber: 2 No. Time Source Destination Protocol Info 307 20.748289 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=657 Ack=796 Win=7936 Len=0 TSV=46345549 TSER=1636470587 Frame 307 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:38.326496000 [Time delta from previous captured frame: 0.000005000 seconds] [Time delta from previous displayed frame: 0.000005000 seconds] [Time since reference or first frame: 20.748289000 seconds] Frame Number: 307 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb492 (46226) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3484 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 796, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 796 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xefe5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46345549, TSecr 1636470587 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 306] [The RTT to ACK the segment was: 0.000005000 seconds] No. Time Source Destination Protocol Info 2214 37.282608 10.147.40.51 10.147.20.85 H.225.0/H.245 CS: facility endSessionCommand Frame 2214 (121 bytes on wire, 121 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.860815000 [Time delta from previous captured frame: 0.000581000 seconds] [Time delta from previous displayed frame: 16.534319000 seconds] [Time since reference or first frame: 37.282608000 seconds] Frame Number: 2214 Frame Length: 121 bytes Capture Length: 121 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225:h245] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 107 Identification: 0xa4fb (42235) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44e4 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 796, Ack: 657, Len: 55 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 796 (relative sequence number) [Next sequence number: 851 (relative sequence number)] Acknowledgement number: 657 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xa07f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636473894, TSecr 46345549 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 307] [The RTT to ACK the segment was: 16.534319000 seconds] [Number of bytes in flight: 55] TPKT, Version: 3, Length: 55 Version: 3 Reserved: 0 Length: 55 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: FACILITY (0x62) User-user Information element: User-user Length: 43 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: facility (6) facility protocolIdentifier: 0.0.8.2250.0.5 (Version 5) reason: transportedInformation (10) transportedInformation: NULL callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 1... .... h245Tunneling: True h245Control: 1 item Item 0 H245Control item: 2 octets H.245 PDU Type: command (2) command: endSessionCommand (5) endSessionCommand: disconnect (1) disconnect: NULL No. Time Source Destination Protocol Info 2215 37.282620 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=657 Ack=851 Win=7936 Len=0 TSV=46349683 TSER=1636473894 Frame 2215 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.860827000 [Time delta from previous captured frame: 0.000012000 seconds] [Time delta from previous displayed frame: 0.000012000 seconds] [Time since reference or first frame: 37.282620000 seconds] Frame Number: 2215 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb493 (46227) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3483 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 851, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 851 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xd29d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46349683, TSecr 1636473894 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2214] [The RTT to ACK the segment was: 0.000012000 seconds] No. Time Source Destination Protocol Info 2216 37.283906 10.147.40.51 10.147.20.85 H.225.0 CS: releaseComplete Frame 2216 (112 bytes on wire, 112 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.862113000 [Time delta from previous captured frame: 0.001286000 seconds] [Time delta from previous displayed frame: 0.001286000 seconds] [Time since reference or first frame: 37.283906000 seconds] Frame Number: 2216 Frame Length: 112 bytes Capture Length: 112 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:q931:q931:h225] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 98 Identification: 0xa4fc (42236) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x44ec [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 851, Ack: 657, Len: 46 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 851 (relative sequence number) [Next sequence number: 897 (relative sequence number)] Acknowledgement number: 657 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xe3aa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636473894, TSecr 46345549 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2215] [The RTT to ACK the segment was: 0.001286000 seconds] [Number of bytes in flight: 46] TPKT, Version: 3, Length: 46 Version: 3 Reserved: 0 Length: 46 Q.931 Protocol discriminator: Q.931 Call reference value length: 2 Call reference flag: Message sent from originating side Call reference value: 23C0 Message type: RELEASE COMPLETE (0x5a) Cause Information element: Cause Length: 2 .... 0001 = Cause location: Private network serving the local user (LPN) (1) .00. .... = Coding standard: ITU-T standardized coding (0x00) 1... .... = Extension indicator: last octet .001 0000 = Cause value: Normal call clearing (16) 1... .... = Extension indicator: last octet User-user Information element: User-user Length: 30 Protocol discriminator: X.208 and X.209 coded user information H.225.0 CS H323-UserInformation h323-uu-pdu h323-message-body: releaseComplete (5) releaseComplete protocolIdentifier: 0.0.8.2250.0.5 (Version 5) callIdentifier guid: 80449e8d-923a-df01-baa0-4b3bf3220000 No. Time Source Destination Protocol Info 2217 37.283909 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [ACK] Seq=657 Ack=897 Win=7936 Len=0 TSV=46349684 TSER=1636473894 Frame 2217 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.862116000 [Time delta from previous captured frame: 0.000003000 seconds] [Time delta from previous displayed frame: 0.000003000 seconds] [Time since reference or first frame: 37.283909000 seconds] Frame Number: 2217 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb494 (46228) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3482 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 897, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 897 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xd26e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46349684, TSecr 1636473894 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2216] [The RTT to ACK the segment was: 0.000003000 seconds] No. Time Source Destination Protocol Info 2218 37.291670 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [FIN, ACK] Seq=657 Ack=897 Win=7936 Len=0 TSV=46349686 TSER=1636473894 Frame 2218 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.869877000 [Time delta from previous captured frame: 0.007761000 seconds] [Time delta from previous displayed frame: 0.007761000 seconds] [Time since reference or first frame: 37.291670000 seconds] Frame Number: 2218 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP SYN/FIN] [Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb495 (46229) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3481 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 657, Ack: 897, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 657 (relative sequence number) Acknowledgement number: 897 (relative ack number) Header length: 32 bytes Flags: 0x11 (FIN, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...1 = Fin: Set [Expert Info (Chat/Sequence): Connection finish (FIN)] [Message: Connection finish (FIN)] [Severity level: Chat] [Group: Sequence] Window size: 7936 (scaled) Checksum: 0xd26b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46349686, TSecr 1636473894 No. Time Source Destination Protocol Info 2219 37.291690 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [RST, ACK] Seq=658 Ack=897 Win=7936 Len=0 TSV=46349686 TSER=1636473894 Frame 2219 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.869897000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.000020000 seconds] [Time since reference or first frame: 37.291690000 seconds] Frame Number: 2219 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP RST] [Coloring Rule String: tcp.flags.reset eq 1] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xb496 (46230) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x3480 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 658, Ack: 897, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 658 (relative sequence number) Acknowledgement number: 897 (relative ack number) Header length: 32 bytes Flags: 0x14 (RST, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .1.. = Reset: Set [Expert Info (Chat/Sequence): Connection reset (RST)] [Message: Connection reset (RST)] [Severity level: Chat] [Group: Sequence] .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 7936 (scaled) Checksum: 0xd267 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 46349686, TSecr 1636473894 No. Time Source Destination Protocol Info 2220 37.293047 10.147.40.51 10.147.20.85 TCP 12645 > h323hostcall [ACK] Seq=897 Ack=658 Win=8664 Len=0 TSV=1636473896 TSER=46349686 Frame 2220 (66 bytes on wire, 66 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.871254000 [Time delta from previous captured frame: 0.001357000 seconds] [Time delta from previous displayed frame: 0.001357000 seconds] [Time since reference or first frame: 37.293047000 seconds] Frame Number: 2220 Frame Length: 66 bytes Capture Length: 66 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP] [Coloring Rule String: tcp] Ethernet II, Src: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c), Dst: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Destination: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) Address: Cisco_7b:cd:7c (00:14:6a:7b:cd:7c) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.40.51 (10.147.40.51), Dst: 10.147.20.85 (10.147.20.85) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 52 Identification: 0xa4fd (42237) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 63 Protocol: TCP (0x06) Header checksum: 0x4519 [correct] [Good: True] [Bad : False] Source: 10.147.40.51 (10.147.40.51) Destination: 10.147.20.85 (10.147.20.85) Transmission Control Protocol, Src Port: 12645 (12645), Dst Port: h323hostcall (1720), Seq: 897, Ack: 658, Len: 0 Source port: 12645 (12645) Destination port: h323hostcall (1720) [Stream index: 6] Sequence number: 897 (relative sequence number) Acknowledgement number: 658 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8664 Checksum: 0xb10d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 1636473896, TSecr 46349686 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 2218] [The RTT to ACK the segment was: 0.001377000 seconds] No. Time Source Destination Protocol Info 2221 37.293055 10.147.20.85 10.147.40.51 TCP h323hostcall > 12645 [RST] Seq=658 Win=0 Len=0 Frame 2221 (54 bytes on wire, 54 bytes captured) Arrival Time: Mar 18, 2010 17:51:54.871262000 [Time delta from previous captured frame: 0.000008000 seconds] [Time delta from previous displayed frame: 0.000008000 seconds] [Time since reference or first frame: 37.293055000 seconds] Frame Number: 2221 Frame Length: 54 bytes Capture Length: 54 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp] [Coloring Rule Name: TCP RST] [Coloring Rule String: tcp.flags.reset eq 1] Ethernet II, Src: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03), Dst: All-HSRP-routers_14 (00:00:0c:07:ac:14) Destination: All-HSRP-routers_14 (00:00:0c:07:ac:14) Address: All-HSRP-routers_14 (00:00:0c:07:ac:14) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) Address: Xensourc_8f:fc:03 (00:16:3e:8f:fc:03) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 10.147.20.85 (10.147.20.85), Dst: 10.147.40.51 (10.147.40.51) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 40 Identification: 0x0000 (0) Flags: 0x02 (Don't Fragment) 0.. = Reserved bit: Not Set .1. = Don't fragment: Set ..0 = More fragments: Not Set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xe922 [correct] [Good: True] [Bad : False] Source: 10.147.20.85 (10.147.20.85) Destination: 10.147.40.51 (10.147.40.51) Transmission Control Protocol, Src Port: h323hostcall (1720), Dst Port: 12645 (12645), Seq: 658, Len: 0 Source port: h323hostcall (1720) Destination port: 12645 (12645) [Stream index: 6] Sequence number: 658 (relative sequence number) Header length: 20 bytes Flags: 0x04 (RST) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...0 .... = Acknowledgement: Not set .... 0... = Push: Not set .... .1.. = Reset: Set [Expert Info (Chat/Sequence): Connection reset (RST)] [Message: Connection reset (RST)] [Severity level: Chat] [Group: Sequence] .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 0 Checksum: 0xaf74 [validation disabled] [Good Checksum: False] [Bad Checksum: False]