1. root@linups:~/wav/openwrt# tcpdump -s 0 -A -vvv port 445 and host 192.168.1.250
  2. tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes
  3. 06:37:45.674219 IP (tos 0x0, ttl 64, id 17869, offset 0, flags [DF], proto TCP (6), length 60)
  4. linups.33688 > 192.168.1.250.microsoft-ds: Flags [S], cksum 0x8483 (incorrect -> 0x7f17), seq 2061363137, win 64240, options [mss 1460,sackOK,TS val 3986125846 ecr 0,nop,wscale 7], length 0
  6. ........z......................
  7. ..t.........
  8. 06:37:45.689451 IP (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
  9. 192.168.1.250.microsoft-ds > linups.33688: Flags [S.], cksum 0x0f03 (correct), seq 2742049716, ack 2061363138, win 65160, options [mss 1460,sackOK,TS val 1106324312 ecr 3986125846,nop,wscale 4], length 0
  10. E..<..@[email protected].......
  11. .....p[.z..................
  12. A.+X..t.....
  13. 06:37:45.689474 IP (tos 0x0, ttl 64, id 17870, offset 0, flags [DF], proto TCP (6), length 52)
  14. linups.33688 > 192.168.1.250.microsoft-ds: Flags [.], cksum 0x847b (incorrect -> 0x3a50), seq 1, ack 1, win 502, options [nop,nop,TS val 3986125861 ecr 1106324312], length 0
  16. ........z....p[......{.....
  17. ..t%A.+X
  18. 06:37:45.689741 IP (tos 0x0, ttl 64, id 17871, offset 0, flags [DF], proto TCP (6), length 222)
  19. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x8525 (incorrect -> 0xaccf), seq 1:171, ack 1, win 502, options [nop,nop,TS val 3986125862 ecr 1106324312], length 170
  21. ........z....p[......%.....
  22. ..t&A.+X.....SMB@...........................................................$............@x.?*.I.../P$.gh.............&....... ......=N..U2...e.A..Du.D.....S.' .m................
  23. 06:37:45.704512 IP (tos 0x10, ttl 64, id 9788, offset 0, flags [DF], proto TCP (6), length 52)
  24. 192.168.1.250.microsoft-ds > linups.33688: Flags [.], cksum 0x2bae (correct), seq 1, ack 171, win 4062, options [nop,nop,TS val 1106324327 ecr 3986125862], length 0
  25. E..4&<@.@..#.......
  26. .....p[.z..l....+......
  27. A.+g..t&
  28. 06:37:45.719305 IP (tos 0x10, ttl 64, id 9789, offset 0, flags [DF], proto TCP (6), length 324)
  29. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xe8ef (correct), seq 1:273, ack 171, win 4062, options [nop,nop,TS val 1106324349 ecr 3986125862], length 272
  30. E..D&=@.@..........
  31. .....p[.z..l...........
  32. A.+}..t&.....SMB@...........................................................A.......zalupa...........................3................J.....`H..+......>0<..0..
  33. +.....7..
  34. .*0(.&.$not_defined_in_RFC4178@please_ignore........&....... ......J+.t....<E/P .ce6-y8.....~.................
  35. 06:37:45.719316 IP (tos 0x0, ttl 64, id 17872, offset 0, flags [DF], proto TCP (6), length 52)
  36. linups.33688 > 192.168.1.250.microsoft-ds: Flags [.], cksum 0x847b (incorrect -> 0x3854), seq 171, ack 273, win 501, options [nop,nop,TS val 3986125891 ecr 1106324349], length 0
  38. ........z..l.p\......{.....
  39. ..tCA.+}
  40. 06:37:45.774452 IP (tos 0x10, ttl 64, id 9793, offset 0, flags [DF], proto TCP (6), length 157)
  41. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x8769 (correct), seq 524:629, ack 879, win 4019, options [nop,nop,TS val 1106324411 ecr 3986125918], length 105
  42. E...&A@.@..........
  43. .....p].z..0.....i.....
  44. A.+...t^...e.SMB@.......... ........................>...........ug..{.
  45. Q.C.. ...H.....0...
  46. ..............q.%.....
  47. 06:37:45.774840 IP (tos 0x0, ttl 64, id 17875, offset 0, flags [DF], proto TCP (6), length 168)
  48. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84ef (incorrect -> 0x11ec), seq 879:995, ack 629, win 501, options [nop,nop,TS val 3986125947 ecr 1106324411], length 116
  50. ........z..0.p^)...........
  51. ..t{A.+....p.SMB@...................................>.......k]....b....g...K ...H.(.\.\.1.9.2...1.6.8...1...2.5.0.\.I.P.C.$.
  52. 06:37:45.776518 IP (tos 0x10, ttl 64, id 9794, offset 0, flags [DF], proto TCP (6), length 52)
  53. 192.168.1.250.microsoft-ds > linups.33688: Flags [.], cksum 0x258a (correct), seq 629, ack 995, win 4012, options [nop,nop,TS val 1106324412 ecr 3986125947], length 0
  54. E..4&B@.@..........
  55. .....p^)z.......%......
  56. A.+...t{
  57. 06:37:45.782741 IP (tos 0x10, ttl 64, id 9795, offset 0, flags [DF], proto TCP (6), length 136)
  58. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xf050 (correct), seq 629:713, ack 995, win 4012, options [nop,nop,TS val 1106324420 ecr 3986125947], length 84
  59. E...&C@.@..........
  60. .....p^)z........P.....
  61. A.+...t{[email protected]>..........\....^....S%_................
  62. 06:37:45.782891 IP (tos 0x0, ttl 64, id 17876, offset 0, flags [DF], proto TCP (6), length 216)
  63. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x851f (incorrect -> 0x8697), seq 995:1159, ack 713, win 501, options [nop,nop,TS val 3986125955 ecr 1106324420], length 164
  65. ........z....p^}...........
  66. [email protected]>.......................9.......................x...(.......x.....................\.1.9.2...1.6.8...1...2.5.0.\.s.h.r...
  67. 06:37:45.783463 IP (tos 0x10, ttl 64, id 9796, offset 0, flags [DF], proto TCP (6), length 52)
  68. 192.168.1.250.microsoft-ds > linups.33688: Flags [.], cksum 0x2489 (correct), seq 713, ack 1159, win 4005, options [nop,nop,TS val 1106324420 ecr 3986125955], length 0
  69. E..4&D@.@..........
  70. .....p^}z..H....$......
  71. A.+...t.
  72. 06:37:45.786858 IP (tos 0x10, ttl 64, id 9797, offset 0, flags [DF], proto TCP (6), length 129)
  73. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xca32 (correct), seq 713:790, ack 1159, win 4005, options [nop,nop,TS val 1106324424 ecr 3986125955], length 77
  74. E...&E@.@..........
  75. .....p^}z..H.....2.....
  76. A.+...t....I.SMB@...%..............................W>....................... ........
  77. 06:37:45.786979 IP (tos 0x0, ttl 64, id 17877, offset 0, flags [DF], proto TCP (6), length 124)
  78. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84c3 (incorrect -> 0x095e), seq 1159:1231, ack 790, win 501, options [nop,nop,TS val 3986125959 ecr 1106324424], length 72
  80. ........z..H.p^............
  81. [email protected]>...........................
  82. 06:37:45.788263 IP (tos 0x10, ttl 64, id 9798, offset 0, flags [DF], proto TCP (6), length 52)
  83. 192.168.1.250.microsoft-ds > linups.33688: Flags [.], cksum 0x23eb (correct), seq 790, ack 1231, win 4005, options [nop,nop,TS val 1106324425 ecr 3986125959], length 0
  84. E..4&F@.@..........
  85. .....p^.z.......#......
  86. A.+...t.
  87. 06:37:45.791797 IP (tos 0x10, ttl 64, id 9799, offset 0, flags [DF], proto TCP (6), length 124)
  88. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xfa61 (correct), seq 790:862, ack 1231, win 4005, options [nop,nop,TS val 1106324428 ecr 3986125959], length 72
  89. E..|&G@.@..........
  90. .....p^.z........a.....
  91. [email protected]>...........................
  92. 06:37:45.792019 IP (tos 0x0, ttl 64, id 17878, offset 0, flags [DF], proto TCP (6), length 166)
  93. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84ed (incorrect -> 0x2549), seq 1231:1345, ack 862, win 501, options [nop,nop,TS val 3986125964 ecr 1106324428], length 114
  95. ........z....p_............
  96. ..t.A.+....n.SMB@...................................>........q-...|w...[.... ...H.&.\.\.1.9.2...1.6.8...1...2.5.0.\.s.h.r.
  97. 06:37:45.804977 IP (tos 0x10, ttl 64, id 9800, offset 0, flags [DF], proto TCP (6), length 136)
  98. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x1ce5 (correct), seq 862:946, ack 1345, win 4005, options [nop,nop,TS val 1106324442 ecr 3986125964], length 84
  99. E...&H@.@..........
  100. .....p_.z..............
  101. [email protected]..>.......q.P......u.....j................
  102. 06:37:45.805135 IP (tos 0x0, ttl 64, id 17879, offset 0, flags [DF], proto TCP (6), length 177)
  103. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84f8 (incorrect -> 0xc28f), seq 1345:1470, ack 946, win 501, options [nop,nop,TS val 3986125977 ecr 1106324442], length 125
  105. ........z....p_f...........
  106. [email protected]..>.......................9...........................................x............
  107. 06:37:45.812494 IP (tos 0x10, ttl 64, id 9801, offset 0, flags [DF], proto TCP (6), length 208)
  108. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x6353 (correct), seq 946:1102, ack 1470, win 4005, options [nop,nop,TS val 1106324449 ecr 3986125977], length 156
  109. E...&I@[email protected].......
  110. .....p_fz.......cS.....
  111. [email protected]..>.......................Y........n.......n..............................................I~2.....s...............
  112. 06:37:45.812680 IP (tos 0x0, ttl 64, id 17880, offset 0, flags [DF], proto TCP (6), length 161)
  113. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84e8 (incorrect -> 0xef45), seq 1470:1579, ack 1102, win 501, options [nop,nop,TS val 3986125985 ecr 1106324449], length 109
  115. ........z....p`............
  116. [email protected]..>.......................).......................I~2.....s........
  117. 06:37:45.817380 IP (tos 0x10, ttl 64, id 9802, offset 0, flags [DF], proto TCP (6), length 148)
  118. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xfb7d (correct), seq 1102:1198, ack 1579, win 4005, options [nop,nop,TS val 1106324454 ecr 3986125985], length 96
  119. E...&J@.@..........
  120. .....p`.z........}.....
  121. A.+...t....\[email protected]..>....................... .H.....O...........N.T.F.S.
  122. 06:37:45.817525 IP (tos 0x0, ttl 64, id 17881, offset 0, flags [DF], proto TCP (6), length 144)
  123. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84d7 (incorrect -> 0x0a96), seq 1579:1671, ack 1198, win 501, options [nop,nop,TS val 3986125990 ecr 1106324454], length 92
  125. ........z....p`b...........
  126. ..t.A.+....X.SMB@................... ............N..>...............................I~2.....s.......
  127. 06:37:45.820854 IP (tos 0x10, ttl 64, id 9803, offset 0, flags [DF], proto TCP (6), length 180)
  128. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xbe7b (correct), seq 1198:1326, ack 1671, win 4005, options [nop,nop,TS val 1106324458 ecr 3986125990], length 128
  129. E...&K@.@..........
  130. .....p`bz..H.....{.....
  131. A.+...t....|.SMB@................... ............N..>.......................<...........................................................
  132. 06:37:45.821011 IP (tos 0x0, ttl 64, id 17882, offset 0, flags [DF], proto TCP (6), length 184)
  133. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84ff (incorrect -> 0x239e), seq 1671:1803, ack 1326, win 501, options [nop,nop,TS val 3986125993 ecr 1106324458], length 132
  135. ........z..H.p`............
  136. ..t.A.+......SMB@...................
  137. ............N..>.......................9.......................................@...x...........q.w.e...
  138. 06:37:45.827461 IP (tos 0x10, ttl 64, id 9804, offset 0, flags [DF], proto TCP (6), length 208)
  139. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x34b7 (correct), seq 1326:1482, ack 1803, win 4005, options [nop,nop,TS val 1106324464 ecr 3986125993], length 156
  140. E...&L@[email protected].......
  141. .....p`.z.......4......
  142. A.+...t......SMB@...................
  143. ............N..>.......................Y...............................................S................]d.....................
  144. 06:37:45.827726 IP (tos 0x0, ttl 64, id 17883, offset 0, flags [DF], proto TCP (6), length 161)
  145. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84e8 (incorrect -> 0xb585), seq 1803:1912, ack 1482, win 501, options [nop,nop,TS val 3986126000 ecr 1106324464], length 109
  147. ........z....pa~...........
  148. [email protected]..>.......................)........................]d..............
  149. 06:37:45.831055 IP (tos 0x10, ttl 64, id 9805, offset 0, flags [DF], proto TCP (6), length 236)
  150. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x3f71 (correct), seq 1482:1666, ack 1912, win 4005, options [nop,nop,TS val 1106324468 ecr 3986126000], length 184
  151. E...&M@[email protected].......
  152. .....pa~z..9....?q.....
  153. [email protected]..>....................... .H.l...................................................S...................................................\.q.w.e.
  154. 06:37:45.831229 IP (tos 0x0, ttl 64, id 17884, offset 0, flags [DF], proto TCP (6), length 169)
  155. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84f0 (incorrect -> 0xb361), seq 1912:2029, ack 1666, win 501, options [nop,nop,TS val 3986126003 ecr 1106324468], length 117
  157. ........z..9.pb6...........
  158. [email protected]..>.......................1................]d..............................
  159. 06:37:45.835161 IP (tos 0x10, ttl 64, id 9806, offset 0, flags [DF], proto TCP (6), length 129)
  160. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0x3f9e (correct), seq 1666:1743, ack 2029, win 4005, options [nop,nop,TS val 1106324472 ecr 3986126003], length 77
  161. E...&N@.@..........
  162. .....pb6z.......?......
  163. A.+...t....I.SMB@...................................>....................... .......!
  164. 06:37:45.888444 IP (tos 0x0, ttl 64, id 17885, offset 0, flags [DF], proto TCP (6), length 52)
  165. linups.33688 > 192.168.1.250.microsoft-ds: Flags [.], cksum 0x847b (incorrect -> 0x2a30), seq 2029, ack 1743, win 501, options [nop,nop,TS val 3986126060 ecr 1106324472], length 0
  167. ........z....pb......{.....
  168. ..t.A.+.
  169. 06:38:05.852358 IP (tos 0x0, ttl 64, id 17886, offset 0, flags [DF], proto TCP (6), length 144)
  170. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84d7 (incorrect -> 0x7f92), seq 2029:2121, ack 1743, win 501, options [nop,nop,TS val 3986146024 ecr 1106324472], length 92
  172. ........z....pb............
  173. [email protected]..>................................]d.............
  174. 06:38:05.854688 IP (tos 0x10, ttl 64, id 9807, offset 0, flags [DF], proto TCP (6), length 129)
  175. 192.168.1.250.microsoft-ds > linups.33688: Flags [P.], cksum 0xa28b (correct), seq 1743:1820, ack 2121, win 4005, options [nop,nop,TS val 1106344492 ecr 3986146024], length 77
  176. E...&O@.@..........
  177. .....pb.z..
  178. ...........
  179. A.z,.......I.SMB@...................................>....................... .......!
  180. 06:38:05.854707 IP (tos 0x0, ttl 64, id 17887, offset 0, flags [DF], proto TCP (6), length 52)
  181. linups.33688 > 192.168.1.250.microsoft-ds: Flags [.], cksum 0x847b (incorrect -> 0x8d53), seq 2121, ack 1820, win 501, options [nop,nop,TS val 3986146027 ecr 1106344492], length 0
  183. ........z..
  184. .pb......{.....
  185. ....A.z,
  186. 06:38:25.873009 IP (tos 0x0, ttl 64, id 17888, offset 0, flags [DF], proto TCP (6), length 124)
  187. linups.33688 > 192.168.1.250.microsoft-ds: Flags [P.], cksum 0x84c3 (incorrect -> 0x13b2), seq 2121:2193, ack 1820, win 501, options [nop,nop,TS val 3986166045 ecr 1106344492], length 72
  189. ........z..
  190. .pb............
  191. ....A.z,[email protected]..>...........................
  192. 06:38:25.917334 IP (tos 0x10, ttl 64, id 9808, offset 0, flags [DF], proto TCP (6), length 52)
  193. 192.168.1.250.microsoft-ds > linups.33688: Flags [.], cksum 0xe2c9 (correct), seq 1820, ack 2193, win 4005, options [nop,nop,TS val 1106364555 ecr 3986166045], length 0
  194. E..4&P@.@..........
  195. .....pb.z..R...........
  196. A.......
  197. 06:38:45.893253 IP (tos 0x0, ttl 64, id 17889, offset 0, flags [DF], proto TCP (6), length 52)
  198. linups.33688 > 192.168.1.250.microsoft-ds: Flags [F.], cksum 0x847b (incorrect -> 0xa244), seq 2193, ack 1820, win 501, options [nop,nop,TS val 3986186065 ecr 1106364555], length 0
  200. ........z..R.pb......{.....
  201. .._QA...
  202. 06:38:45.893837 IP (tos 0x10, ttl 64, id 9809, offset 0, flags [DF], proto TCP (6), length 52)
  203. 192.168.1.250.microsoft-ds > linups.33688: Flags [F.], cksum 0x468b (correct), seq 1820, ack 2194, win 4005, options [nop,nop,TS val 1106384531 ecr 3986186065], length 0
  204. E..4&Q@.@..........
  205. .....pb.z..S....F......
  206. A....._Q
  207. 06:38:45.893863 IP (tos 0x0, ttl 64, id 17890, offset 0, flags [DF], proto TCP (6), length 52)
  208. linups.33688 > 192.168.1.250.microsoft-ds: Flags [.], cksum 0x847b (incorrect -> 0x543a), seq 2194, ack 1821, win 501, options [nop,nop,TS val 3986186066 ecr 1106384531], length 0
  210. ........z..S.pb......{.....
  211. .._RA...
  212. ^C
  213. 40 packets captured
  214. 45 packets received by filter
  215. 5 packets dropped by kernel