From owner-freebsd-net@FreeBSD.ORG Wed Mar 21 14:16:16 2012 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id BF7951065677 for ; Wed, 21 Mar 2012 14:16:16 +0000 (UTC) (envelope-from seyit.ozgur@istanbul.net) Received: from spamtrap.istanbul.net (spamtrap.istanbul.net [85.111.12.34]) by mx1.freebsd.org (Postfix) with ESMTP id BC0178FC14 for ; Wed, 21 Mar 2012 14:16:15 +0000 (UTC) X-ASG-Debug-ID: 1332339365-0426ae106492170001-QdxwpM Received: from GAMMA.magnetdigital.local (gamma.magnetdigital.local [192.168.131.244]) by spamtrap.istanbul.net with ESMTP id tTDIDB8dwlzON4i6; Wed, 21 Mar 2012 16:16:05 +0200 (EET) X-Barracuda-Envelope-From: seyit.ozgur@istanbul.net X-Barracuda-RBL-Trusted-Forwarder: 192.168.131.244 Received: from YUHANNA.magnetdigital.local ([fe80::1058:3088:f9b1:1346]) by GAMMA.magnetdigital.local ([fe80::3cca:d6ef:febb:fafb%17]) with mapi id 14.01.0218.012; Wed, 21 Mar 2012 16:15:12 +0200 From: =?iso-8859-9?Q?Seyit_=D6zg=FCr?= X-Barracuda-Apparent-Source-IP: fe80::1058:3088:f9b1:1346 To: Chuck Swiger Thread-Topic: Malformed syn packet cause %100 cpu and interrupts FreeBSD 9.0 release X-ASG-Orig-Subj: RE: Malformed syn packet cause %100 cpu and interrupts FreeBSD 9.0 release Thread-Index: Ac0C5Fxpv2wbk7REQXGSXBWgiq7+JP//5aEA//bValA= Date: Wed, 21 Mar 2012 14:15:12 +0000 Message-ID: <3807CE6F3BF4B04EB897F4EBF2D258CE5C064A80@yuhanna.magnetdigital.local> References: <3807CE6F3BF4B04EB897F4EBF2D258CE5C05F221@yuhanna.magnetdigital.local> <38FA7BAB-AC2B-4515-85CF-27F77C3F4313@mac.com> In-Reply-To: <38FA7BAB-AC2B-4515-85CF-27F77C3F4313@mac.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [192.168.134.34] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0018_01CD077D.CABBE3B0" MIME-Version: 1.0 X-Barracuda-Connect: gamma.magnetdigital.local[192.168.131.244] X-Barracuda-Start-Time: 1332339365 X-Barracuda-URL: http://10.10.140.221:8000/cgi-mod/mark.cgi X-Barracuda-Spam-Score: 0.50 X-Barracuda-Spam-Status: No, SCORE=0.50 using per-user scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_RULE7568M, NORMAL_HTTP_TO_IP X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.91847 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL 0.50 BSF_RULE7568M Custom Rule 7568M X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: "freebsd-net@freebsd.org" Subject: RE: Malformed syn packet cause %100 cpu and interrupts FreeBSD 9.0 release X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2012 14:16:16 -0000 ------=_NextPart_000_0018_01CD077D.CABBE3B0 Content-Type: multipart/mixed; boundary="----=_NextPart_001_0019_01CD077D.CABBE3B0" ------=_NextPart_001_0019_01CD077D.CABBE3B0 Content-Type: text/plain; charset="iso-8859-9" Content-Transfer-Encoding: quoted-printable Hello chris, Here i get tcpdump with X param..=20 First look input errors.. its about 60 mbit/sec and much more packets = can't process packets errs idrops bytes packets errs bytes colls 36356 42777 0 7747642 243 0 263462 0 36732 41709 0 7681242 240 0 359432 0 36422 41975 0 7677434 197 0 258142 0 34042 42339 0 7487618 222 0 227152 0 35987 44405 0 7863192 304 0 377624 0 36454 41799 0 7665082 120 0 276008 0 36870 41471 0 7671950 249 0 402546 0 35951 42431 0 7674562 328 0 258136 0 36398 41853 0 7667556 28 0 78640 0 36098 42070 0 7660804 2 0 256 0 18446744073709551273 8555 0 836906 3 0 642 0 2 0 0 144 2 0 272 0 4 0 0 276 4 0 708 0 2 0 0 148 2 0 260 0 4 0 0 270 3 0 642 0 2 0 0 148 2 0 256 0 Then tcpdump with X param, also i attach txt file in mail.. 16:02:53.954863 IP 88.133.15.78 > x.x.x.x: tcp 0x0000: 4500 0050 10ba 07d0 6b06 7382 5885 0f4e = E..P....k.s.X..N 0x0010: 556f 065a f386 0050 45c4 8c77 9592 0241 = Uo.Z...PE..w...A 0x0020: 00a3 3c4c b5a3 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 9a48 07d0 6c06 dd1e 5899 1b0f = E..P.H..l...X... 0x0010: 556f 065a 718a 0050 9c79 672b c680 a521 = Uo.Zq..P.yg+...! 0x0020: 00a3 3c4c 2693 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 6c2b 07d0 6c06 e837 5815 3e97 = E..Pl+..l..7X.>. 0x0010: 556f 065a 8ae5 0050 aac1 6265 1a53 5749 = Uo.Z...P..be.SWI 0x0020: 00a3 3c4c dab7 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 4807 07d0 6b06 9ee4 582e acf5 = E..PH...k...X... 0x0010: 556f 065a a76b 0050 e3f3 5b68 1e1c 9773 = Uo.Z.k.P..[h...s 0x0020: 00a3 3c4c d991 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 0db9 07d0 6b06 d159 58f6 b406 = E..P....k..YX... 0x0010: 556f 065a 3348 0050 2817 6a1f 444e 8273 = Uo.Z3H.P(.j.DN.s 0x0020: 00a3 3c4c e1cf 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 b767 07d0 6b06 b307 58d7 28c9 = E..P.g..k...X.(. 0x0010: 556f 065a abf4 0050 947a 1e32 3a04 e901 = Uo.Z...P.z.2:... 0x0020: 00a3 3c4c 77c5 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 3789 07d0 6c06 cf55 5853 8bdd = E..P7...l..UXS.. 0x0010: 556f 065a f541 0050 5c12 f670 137b bd08 = Uo.Z.A.P\..p.{.. 0x0020: 00a3 3c4c 7e93 0000 8807 a83a f215 b40d = .. x.x.x.x: tcp 0x0000: 4500 0050 71dc 07d0 6b06 193e 58d0 0825 = E..Pq...k..>X..% 0x0010: 556f 065a 437b 0050 8045 710e dfc0 f23b = Uo.ZC{.P.Eq....; 0x0020: 00a3 3c4c 134c 0000 8807 a83a f215 b40d = .. Today we tried to see what happens Malformed syn packets on FreeBSD = 9.0 release.. >=20 > Those packets rise to CPU %100 and stucks.. >=20 > listening on ix0, link-type EN10MB (Ethernet), capture size 65535 = bytes > 18:33:30.010215 IP vgn44-1-88-123-89-40.fbx.proxad.net > = 85.xxx.xxx.90: tcp > 18:33:30.010242 IP 225.74.196.88.sta.estpak.ee > 85.xxx.xxx.90: tcp > 18:33:30.010269 IP Nnov-Prospekt.71.quantum.rn > 85.xxx.xxx.90: tcp > 18:33:30.010296 IP host52-108-static.49-88-b.business.telecomitalia.it = > 85.xxx.xxx.90: tcp > 18:33:30.010325 IP 125.Red-88-1-75.dynamicIP.rima-tde.net > = 85.xxx.xxx.90: tcp >=20 > i dont know which tool generate those packets.. but as we see i dont = see seq, flag, lenth etc.. just this ouput on tcpdump... >=20 > Is there any kernel feature for do NOT process malformed syn packets = ?? A firewall can block them before the system will see and try to process = them as incoming traffic. Also, running tcpdump with -X will give both hex and ASCII rendition of = the packets, which would be helpful to identify what you mean by = "malformed". Regards, --=20 -Chuck ------=_NextPart_001_0019_01CD077D.CABBE3B0 Content-Type: text/plain; name="tcpdump_X_.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="tcpdump_X_.txt" 16:02:53.954863 IP 88.133.15.78 > x.x.x.x: tcp 0x0000: 4500 0050 10ba 07d0 6b06 7382 5885 0f4e E..P....k.s.X..N 0x0010: 556f 065a f386 0050 45c4 8c77 9592 0241 Uo.Z...PE..w...A 0x0020: 00a3 3c4c b5a3 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 9a48 07d0 6c06 dd1e 5899 1b0f E..P.H..l...X... 0x0010: 556f 065a 718a 0050 9c79 672b c680 a521 Uo.Zq..P.yg+...! 0x0020: 00a3 3c4c 2693 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 6c2b 07d0 6c06 e837 5815 3e97 E..Pl+..l..7X.>. 0x0010: 556f 065a 8ae5 0050 aac1 6265 1a53 5749 Uo.Z...P..be.SWI 0x0020: 00a3 3c4c dab7 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 4807 07d0 6b06 9ee4 582e acf5 E..PH...k...X... 0x0010: 556f 065a a76b 0050 e3f3 5b68 1e1c 9773 Uo.Z.k.P..[h...s 0x0020: 00a3 3c4c d991 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0db9 07d0 6b06 d159 58f6 b406 E..P....k..YX... 0x0010: 556f 065a 3348 0050 2817 6a1f 444e 8273 Uo.Z3H.P(.j.DN.s 0x0020: 00a3 3c4c e1cf 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 b767 07d0 6b06 b307 58d7 28c9 E..P.g..k...X.(. 0x0010: 556f 065a abf4 0050 947a 1e32 3a04 e901 Uo.Z...P.z.2:... 0x0020: 00a3 3c4c 77c5 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 3789 07d0 6c06 cf55 5853 8bdd E..P7...l..UXS.. 0x0010: 556f 065a f541 0050 5c12 f670 137b bd08 Uo.Z.A.P\..p.{.. 0x0020: 00a3 3c4c 7e93 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 71dc 07d0 6b06 193e 58d0 0825 E..Pq...k..>X..% 0x0010: 556f 065a 437b 0050 8045 710e dfc0 f23b Uo.ZC{.P.Eq....; 0x0020: 00a3 3c4c 134c 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 2ccb 07d0 6b06 8f40 582b d7d8 E..P,...k..@X+.. 0x0010: 556f 065a 4a00 0050 1c69 0603 2f38 d011 Uo.ZJ..P.i../8.. 0x0020: 00a3 3c4c df52 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 5f46 07d0 6b06 d63f 58db 5dae E..P_F..k..?X.]. 0x0010: 556f 065a ce82 0050 5b9e 1a07 4b7f 5155 Uo.Z...P[...K.QU 0x0020: 00a3 3c4c e386 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d14d 07d0 6c06 1177 58fd af4d E..P.M..l..wX..M 0x0010: 556f 065a 692b 0050 dd11 9600 11be 8474 Uo.Zi+.P.......t 0x0020: 00a3 3c4c 0052 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 8d78 07d0 6c06 8752 58fa 7d4a E..P.x..l..RX.}J 0x0010: 556f 065a d058 0050 182b bb48 c6be 6a14 Uo.Z.X.P.+.H..j. 0x0020: 00a3 3c4c d028 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 6ba7 07d0 6a06 e706 587a 41e7 E..Pk...j...XzA. 0x0010: 556f 065a 488c 0050 85b0 6309 582c c926 Uo.ZH..P..c.X,.& 0x0020: 00a3 3c4c 8e12 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 e95d 07d0 6a06 f97f 581e b213 E..P.]..j...X... 0x0010: 556f 065a 4c88 0050 350f a32f d507 055d Uo.ZL..P5../...] 0x0020: 00a3 3c4c 71af 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 2e5e 07d0 6c06 1f13 58ec 44b2 E..P.^..l...X.D. 0x0010: 556f 065a 540a 0050 0f43 c22b 1173 ab62 Uo.ZT..P.C.+.s.b 0x0020: 00a3 3c4c fb1f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 9ae5 07d0 6a06 062a 5854 f3ab E..P....j..*XT.. 0x0010: 556f 065a 02dc 0050 9037 f051 98ff b852 Uo.Z...P.7.Q...R 0x0020: 00a3 3c4c 5a55 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 a93c 07d0 6c06 e8f5 58ff ffdd E..P.<..l...X... 0x0010: 556f 065a 0612 0050 3099 e04b 6b40 6a53 Uo.Z...P0..Kk@jS 0x0020: 00a3 3c4c 35a5 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 c776 07d0 6b06 4957 58b0 8291 E..P.v..k.IWX... 0x0010: 556f 065a 34a6 0050 5781 1d2f f7fa c432 Uo.Z4..PW../...2 0x0020: 00a3 3c4c 3a47 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 83cd 07d0 6b06 008a 58f5 0ec3 E..P....k...X... 0x0010: 556f 065a d2bb 0050 8dfd c165 bb0b a32a Uo.Z...P...e...* 0x0020: 00a3 3c4c 92ff 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d1fd 07d0 6b06 2baa 580b 965c E..P....k.+.X..\ 0x0010: 556f 065a e71e 0050 e25e 8520 c359 8303 Uo.Z...P.^...Y.. 0x0020: 00a3 3c4c f7a9 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 c27d 07d0 6a06 e1d1 58b9 f006 E..P.}..j...X... 0x0010: 556f 065a e8ef 0050 add8 be7c cbbe e52b Uo.Z...P...|...+ 0x0020: 00a3 3c4c 2c1d 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0dce 07d0 6a06 9f51 588f e760 E..P....j..QX..` 0x0010: 556f 065a 5d4e 0050 5bba 1d70 05b4 1a6a Uo.Z]N.P[..p...j 0x0020: 00a3 3c4c 4486 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d6a8 07d0 6a06 da6e 587c e37b E..P....j..nX|.{ 0x0010: 556f 065a 0d3f 0050 e7e0 6009 bbcf 9f7c Uo.Z.?.P..`....| 0x0020: 00a3 3c4c 8e9f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 b6a2 07d0 6a06 ef62 589a ee6f E..P....j..bX..o 0x0010: 556f 065a 47ca 0050 0285 7256 083b e16d Uo.ZG..P..rV.;.m 0x0020: 00a3 3c4c 8db4 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 ecd1 07d0 6b06 9b8c 5822 0b8f E..P....k...X".. 0x0010: 556f 065a 42fb 0050 1c9d 8278 7464 d231 Uo.ZB..P...xtd.1 0x0020: 00a3 3c4c eeb4 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 ae8f 07d0 6b06 0b67 5870 d9a8 E..P....k..gXp.. 0x0010: 556f 065a a70f 0050 1b8e 0229 1488 e70d Uo.Z...P...).... 0x0020: 00a3 3c4c 8897 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 377c 07d0 6b06 25d7 587f 363d E..P7|..k.%.X.6= 0x0010: 556f 065a 045b 0050 dac0 9a16 e17a 1a58 Uo.Z.[.P.....z.X 0x0020: 00a3 3c4c 774b 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 00fc 07d0 6c06 1ca9 58b2 74b8 E..P....l...X.t. 0x0010: 556f 065a ab8a 0050 5b20 780a 2fa6 c602 Uo.Z...P[.x./... 0x0020: 00a3 3c4c 3944 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 4251 07d0 6a06 2beb 58df 25f4 E..PBQ..j.+.X.%. 0x0010: 556f 065a cf61 0050 98a7 6d78 f98f 5a66 Uo.Z.a.P..mx..Zf 0x0020: 00a3 3c4c d2c1 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f18e 07d0 6b06 91c1 58c2 0ffd E..P....k...X... 0x0010: 556f 065a a30a 0050 d9ee 2f5a 4c49 4e26 Uo.Z...P../ZLIN& 0x0020: 00a3 3c4c cb8a 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 2b75 07d0 6a06 b64e 581e b32d E..P+u..j..NX..- 0x0010: 556f 065a ca99 0050 e4c1 d13e 3b1e b013 Uo.Z...P...>;... 0x0020: 00a3 3c4c 03f5 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d9a7 07d0 6a06 b07c 5874 0a77 E..P....j..|Xt.w 0x0010: 556f 065a 424d 0050 eca9 4547 e8b6 8051 Uo.ZBM.P..EG...Q 0x0020: 00a3 3c4c 3adb 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 00b2 07d0 6c06 ce48 5817 c3fd E..P....l..HX... 0x0010: 556f 065a 165c 0050 a490 136d b9b3 b743 Uo.Z.\.P...m...C 0x0020: 00a3 3c4c 1fa7 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 b102 07d0 6c06 8484 58b6 5cd2 E..P....l...X.\. 0x0010: 556f 065a 642e 0050 66cc a93a 423a 4a0a Uo.Zd..Pf..:B:J. 0x0020: 00a3 3c4c c50a 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f4cd 07d0 6b06 d03f 5872 ce8f E..P....k..?Xr.. 0x0010: 556f 065a 3e33 0050 606b fc5a 5cf2 6404 Uo.Z>3.P`k.Z\.d. 0x0020: 00a3 3c4c f81a 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 5417 07d0 6b06 97b3 5894 a7b0 E..PT...k...X... 0x0010: 556f 065a 36e1 0050 f978 3701 81a6 5717 Uo.Z6..P.x7...W. 0x0020: 00a3 3c4c 3aaf 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 6ea1 07d0 6b06 26dc 58c9 fdc8 E..Pn...k.&.X... 0x0010: 556f 065a 6f8b 0050 feac 646d 8983 c621 Uo.Zo..P..dm...! 0x0020: 00a3 3c4c 0230 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 a7c6 07d0 6b06 3a28 5870 b1b0 E..P....k.:(Xp.. 0x0010: 556f 065a d8db 0050 7ba3 2d3d 444a ed1e Uo.Z...P{.-=DJ.. 0x0020: 00a3 3c4c bdc6 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 4d90 07d0 6b06 b723 5803 8f58 E..PM...k..#X..X 0x0010: 556f 065a f656 0050 ae2c 5d56 f992 b86b Uo.Z.V.P.,]V...k 0x0020: 00a3 3c4c dfd8 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 b65f 07d0 6b06 6971 5855 73e9 E..P._..k.iqXUs. 0x0010: 556f 065a b1b2 0050 0db2 523a db61 fa7c Uo.Z...P..R:.a.| 0x0020: 00a3 3c4c c750 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0a9c 07d0 6b06 2e1f 58b5 5a9f E..P....k...X.Z. 0x0010: 556f 065a d93d 0050 89c2 7058 84d9 6175 Uo.Z.=.P..pX..au 0x0020: 00a3 3c4c 0e11 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 4e89 07d0 6a06 6294 58d6 e31b E..PN...j.b.X... 0x0010: 556f 065a f87d 0050 1d82 1915 7ab0 5426 Uo.Z.}.P....z.T& 0x0020: 00a3 3c4c 412f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 7496 07d0 6c06 8b52 58a1 9285 E..Pt...l..RX... 0x0010: 556f 065a 8059 0050 dcf1 9070 cfb6 6f0e Uo.Z.Y.P...p..o. 0x0020: 00a3 3c4c 6365 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0582 07d0 6b06 2514 5863 6916 E..P....k.%.Xci. 0x0010: 556f 065a 4ca3 0050 01ed 8803 2e87 2b30 Uo.ZL..P......+0 0x0020: 00a3 3c4c 8948 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 fc82 07d0 6b06 dc4d 58b5 ba89 E..P....k..MX... 0x0010: 556f 065a b698 0050 683f d713 9229 1102 Uo.Z...Ph?...).. 0x0020: 00a3 3c4c ceb6 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 1734 07d0 6b06 9ece 58c1 dd4b E..P.4..k...X..K 0x0010: 556f 065a 13e9 0050 4c15 835a 2a16 e464 Uo.Z...PL..Z*..d 0x0020: 00a3 3c4c 532c 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 a707 07d0 6a06 20d8 581f cd10 E..P....j...X... 0x0010: 556f 065a 6836 0050 c396 f16d 7a2d 8659 Uo.Zh6.P...mz-.Y 0x0020: 00a3 3c4c 381b 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0a02 07d0 6c06 e5bc 5880 a2d0 E..P....l...X... 0x0010: 556f 065a 3a42 0050 54c9 2318 8ca0 8e3a Uo.Z:B.PT.#....: 0x0020: 00a3 3c4c b2bd 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 fa1e 07d0 6b06 d1bd 585e c7d4 E..P....k...X^.. 0x0010: 556f 065a 62c2 0050 9675 6301 3912 246e Uo.Zb..P.uc.9.$n 0x0020: 00a3 3c4c a120 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 6e39 07d0 6b06 1811 5895 0d30 E..Pn9..k...X..0 0x0010: 556f 065a 0b88 0050 cfb0 636e c815 5b2d Uo.Z...P..cn..[- 0x0020: 00a3 3c4c b35d 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f4d1 07d0 6c06 08db 5884 94de E..P....l...X... 0x0010: 556f 065a b962 0050 8a46 8e4b bd59 1b28 Uo.Z.b.P.F.K.Y.( 0x0020: 00a3 3c4c e333 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 809c 07d0 6b06 755a 5874 9da4 E..P....k.uZXt.. 0x0010: 556f 065a ae52 0050 814b 0d1c 7cec 5a43 Uo.Z.R.P.K..|.ZC 0x0020: 00a3 3c4c 710a 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d268 07d0 6b06 1257 584f af00 E..P.h..k..WXO.. 0x0010: 556f 065a eab6 0050 823f 1e38 a8ac 8176 Uo.Z...P.?.8...v 0x0020: 00a3 3c4c be6b 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 c8a4 07d0 6a06 390f 5895 92c6 E..P....j.9.X... 0x0010: 556f 065a d7f7 0050 3af8 c61a eefe 0a20 Uo.Z...P:....... 0x0020: 00a3 3c4c bd87 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 134d 07d0 6b06 92b7 58ae ed5c E..P.M..k...X..\ 0x0010: 556f 065a 66f0 0050 33f3 6479 d742 1202 Uo.Zf..P3.dy.B.. 0x0020: 00a3 3c4c 4c60 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 eb70 07d0 6a06 6101 58c7 47d6 E..P.p..j.a.X.G. 0x0010: 556f 065a 30e2 0050 f82e bd2f 35c4 ce09 Uo.Z0..P.../5... 0x0020: 00a3 3c4c f060 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 97db 07d0 6c06 bf7f 58f2 3ac2 E..P....l...X.:. 0x0010: 556f 065a f21e 0050 de5b da74 ac9b d35e Uo.Z...P.[.t...^ 0x0020: 00a3 3c4c bc6e 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 cbde 07d0 6a06 d940 588e ef61 E..P....j..@X..a 0x0010: 556f 065a 94f6 0050 4d8d ec1e c7f6 da39 Uo.Z...PM......9 0x0020: 00a3 3c4c c249 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 0775 07d0 6b06 ea4f 5815 a235 E..P.u..k..OX..5 0x0010: 556f 065a 88d9 0050 7fc7 ef14 e4e4 ba60 Uo.Z...P.......` 0x0020: 00a3 3c4c e9c6 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 104a 07d0 6a06 93b7 58b4 f059 E..P.J..j...X..Y 0x0010: 556f 065a 9ea5 0050 20a4 e660 09bf a035 Uo.Z...P...`...5 0x0020: 00a3 3c4c e25f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 6aa6 07d0 6a06 16b0 5886 1333 E..Pj...j...X..3 0x0010: 556f 065a 1d9c 0050 120f 6834 bc87 a828 Uo.Z...P..h4...( 0x0020: 00a3 3c4c 12c4 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f987 07d0 6c06 e246 58b5 b68b E..P....l..FX... 0x0010: 556f 065a 5b86 0050 25b4 cd0f a3af 4e4f Uo.Z[..P%.....NO 0x0020: 00a3 3c4c 2b83 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 2aeb 07d0 6b06 4f5c 584d 197b E..P*...k.O\XM.{ 0x0010: 556f 065a 1313 0050 a206 3465 e633 6b32 Uo.Z...P..4e.3k2 0x0020: 00a3 3c4c ce5f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f99e 07d0 6c06 49c6 5838 4f72 E..P....l.I.X8Or 0x0010: 556f 065a 9439 0050 85d1 d737 c41b 6d0b Uo.Z.9.P...7..m. 0x0020: 00a3 3c4c b0f8 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 505c 07d0 6a06 d445 58a6 6fc7 E..PP\..j..EX.o. 0x0010: 556f 065a 2a29 0050 a38e 6656 f651 ff1c Uo.Z*).P..fV.Q.. 0x0020: 00a3 3c4c 8922 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 87ff 07d0 6a06 3de4 589a ce91 E..P....j.=.X... 0x0010: 556f 065a 1988 0050 057c a246 0dd1 cb66 Uo.Z...P.|.F...f 0x0020: 00a3 3c4c b95e 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 7ea6 07d0 6c06 3988 58d8 da08 E..P~...l.9.X... 0x0010: 556f 065a 3df9 0050 6d08 3c6f 9a4d 667d Uo.Z=..Pm. x.x.x.x: tcp 0x0000: 4500 0050 186b 07d0 6a06 45e7 5849 3674 E..P.k..j.E.XI6t 0x0010: 556f 065a cacd 0050 69b6 8742 6169 3326 Uo.Z...Pi..Bai3& 0x0020: 00a3 3c4c 9bf9 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 9873 07d0 6b06 8732 587b 73ee E..P.s..k..2X{s. 0x0010: 556f 065a 28e4 0050 34d7 3d26 d0db cb0f Uo.Z(..P4.=&.... 0x0020: 00a3 3c4c 77d6 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 365a 07d0 6a06 47e2 586c 1667 E..P6Z..j.G.Xl.g 0x0010: 556f 065a b4ed 0050 d34c 5341 a811 b40c Uo.Z...P.LSA.... 0x0020: 00a3 3c4c d49f 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 ee15 07d0 6b06 cdfd 584a d7b1 E..P....k...XJ.. 0x0010: 556f 065a 1980 0050 13e2 7f7a 3dae df7f Uo.Z...P...z=... 0x0020: 00a3 3c4c 8106 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 8321 07d0 6c06 73a5 58f4 9b54 E..P.!..l.s.X..T 0x0010: 556f 065a 9e13 0050 2e73 6715 e19d 2634 Uo.Z...P.sg...&4 0x0020: 00a3 3c4c 4b56 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 fe36 07d0 6b06 7537 58e9 1fb8 E..P.6..k.u7X... 0x0010: 556f 065a 8973 0050 8324 a146 0d7a b221 Uo.Z.s.P.$.F.z.! 0x0020: 00a3 3c4c 94f1 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 f748 07d0 6b06 e38f 58c5 b871 E..P.H..k...X..q 0x0010: 556f 065a 5f6a 0050 2bb3 d746 0ff6 d567 Uo.Z_j.P+..F...g 0x0020: 00a3 3c4c 2214 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 2e6e 07d0 6b06 4fb8 5867 1582 E..P.n..k.O.Xg.. 0x0010: 556f 065a 04b8 0050 14c0 d608 8442 2c2f Uo.Z...P.....B,/ 0x0020: 00a3 3c4c 6d31 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 85ee 07d0 6b06 7111 5819 9cf6 E..P....k.q.X... 0x0010: 556f 065a e61f 0050 54a3 2345 33e4 e01f Uo.Z...PT.#E3... 0x0020: 00a3 3c4c 13f1 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 d8ee 07d0 6c06 5db0 5838 5c38 E..P....l.].X8\8 0x0010: 556f 065a 21d9 0050 15fe f63e 21a7 681a Uo.Z!..P...>!.h. 0x0020: 00a3 3c4c 0ec5 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 9f11 07d0 6b06 a25d 5828 5278 E..P....k..]X(Rx 0x0010: 556f 065a 3393 0050 c882 806d 7553 f05f Uo.Z3..P...muS._ 0x0020: 00a3 3c4c ee35 0000 8807 a83a f215 b40d .. x.x.x.x: tcp 0x0000: 4500 0050 50dc 07d0 6a06 3656 5899 0d44 E..PP...j.6VX..D 0x0010: 556f 065a fe8c 0050 db1e 057f 5e5c 2075 Uo.Z...P....^\.u 0x0020: 00a3 3c4c b733 0000 8807 a83a f215 b40d ..