Re: [DNSOP] m.root-servers.net DNSSEC TCP failures

Mark Andrews <marka@isc.org> Wed, 17 March 2010 20:51 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@core3.amsl.com
Delivered-To: dnsop@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F6D03A6976 for <dnsop@core3.amsl.com>; Wed, 17 Mar 2010 13:51:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.277
X-Spam-Level:
X-Spam-Status: No, score=0.277 tagged_above=-999 required=5 tests=[AWL=-2.654, BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, J_CHICKENPOX_12=0.6, J_CHICKENPOX_21=0.6, J_CHICKENPOX_84=0.6]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I2PA+h2ljSQv for <dnsop@core3.amsl.com>; Wed, 17 Mar 2010 13:51:12 -0700 (PDT)
Received: from farside.isc.org (farside.isc.org [IPv6:2001:4f8:3:bb::5]) by core3.amsl.com (Postfix) with ESMTP id 3864E3A685B for <dnsop@ietf.org>; Wed, 17 Mar 2010 13:51:10 -0700 (PDT)
Received: from drugs.dv.isc.org (drugs.dv.isc.org [IPv6:2001:470:1f00:820:214:22ff:fed9:fbdc]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "drugs.dv.isc.org", Issuer "ISC CA" (not verified)) by farside.isc.org (Postfix) with ESMTP id 5BB4DE60B4; Wed, 17 Mar 2010 20:51:14 +0000 (UTC) (envelope-from marka@isc.org)
Received: from drugs.dv.isc.org (localhost [127.0.0.1]) by drugs.dv.isc.org (8.14.3/8.14.3) with ESMTP id o2HKpAOp066726; Thu, 18 Mar 2010 07:51:11 +1100 (EST) (envelope-from marka@drugs.dv.isc.org)
Message-Id: <201003172051.o2HKpAOp066726@drugs.dv.isc.org>
To: Gilles Massen <gilles.massen@restena.lu>
From: Mark Andrews <marka@isc.org>
References: <CF3EE840-0D45-4321-ABC4-31F4D186F9E6@rfc1035.com> <E94DC708-008B-49C5-8728-3F9AD106BF5F@icsi.berkeley.edu> <20100317.150133.74723796.sthaug@nethelp.no> <20100317.150730.41662992.sthaug@nethelp.no> <Prayer.1.3.2.1003171419160.16088@hermes-2.csi.cam.ac.uk> <4BA0EE53.20603@restena.lu>
In-reply-to: Your message of "Wed, 17 Mar 2010 15:59:31 BST." <4BA0EE53.20603@restena.lu>
Date: Thu, 18 Mar 2010 07:51:10 +1100
Sender: marka@isc.org
Cc: cet1@cam.ac.uk, dnsop@ietf.org
Subject: Re: [DNSOP] m.root-servers.net DNSSEC TCP failures
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Mar 2010 20:51:15 -0000

In message <4BA0EE53.20603@restena.lu>, Gilles Massen writes:
> 
> Chris Thompson wrote:
> > On Mar 17 2010, sthaug@nethelp.no wrote:
> > 
> >> Should of course have checked hostname.bind, which reveals:
> >>
> >> % dig @202.12.27.33 hostname.bind ch txt +short
> >> "M-CDG-3"
> >> % dig @2001:dc3::35 hostname.bind ch txt +short
> >> "M-CDG-4"
> >>
> >> So it seems my guess of Paris or thereabouts wasn't too far off. And
> >> M-CDG-3 seems to have problems with TCP.
> 
> Well, I'm getting IPv6 replies from M-CDG-2 which should be in Paris as
> well. I have perfect ping responses (30ms, no packet loss). And TCP
> works except for the ANY query... so that doesn't quite look like a
> stressed network.
> 
> > That would explain why I don't see the effect at all. I am getting
> > M-NRT-JPIX-3 for IPv4 and M-CDG-4 for IPv6 (over either UDP or TCP).
> 
> I would love to know why your get M-CDG-4 and I get M-CDG-2... I'd guess
> that your packets should take the janet-geant-sfinx route?
> 
> 
> Gilles
> 
> -- 
> Fondation RESTENA - DNS-LU
> 6, rue Coudenhove-Kalergi
> L-1359 Luxembourg
> tel: (+352) 424409
> fax: (+352) 422473
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

I get garbage out of M-SFO-1 for ANY queries. Non-meta types apprear to be
ok.  NS/RRSIG/TXT/A for the root are all ok.

drugs:bind9-re-sign 07:47 {3767} % dig @2001:dc3::35 hostname.bind ch txt +short
"M-SFO-1"
drugs:bind9-re-sign 07:47 {3768} % 

tcpdump -s 0 -n -i gif0 -X host m.root-servers.net
tcpdump: WARNING: gif0: no IPv4 address assigned
tcpdump: listening on gif0
07:45:55.528778 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: S 1431041212:1431041212(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389400257 0,sackOK,eol> [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bc        .......5.~.5UK..
0x0030   0000 0000 b002 ffff 72d8 0000 0204 05a0        ........r.......
0x0040   0103 0301 0101 080a 8e6b 5ac1 0000 0000        .........kZ.....
0x0050   0402 0000                                      ....
07:45:55.697734 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: S 6066318:6066318(0) ack 1431041213 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389400257,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 908e        .."......5.~.\..
0x0030   554b f4bd b012 8000 60dc 0000 0204 05a0        UK......`.......
0x0040   0103 0300 0101 080a 0000 0000 8e6b 5ac1        .............kZ.
0x0050   0402 0101                                      ....
07:45:55.698847 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389400428 0> [flowlabel 0xf44d4]
0x0000   600f 44d4 0020 063f 2001 0470 1f00 0820        `.D....?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bd        .......5.~.5UK..
0x0030   005c 908f 8010 804c a09c 0000 0101 080a        .\.....L........
0x0040   8e6b 5b6c 0000 0000                            .k[l....
07:45:55.700266 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389400429 0> 25355+ ANY? . (17) [flowlabel 0xf44d4]
0x0000   600f 44d4 0033 063f 2001 0470 1f00 0820        `.D..3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4bd        .......5.~.5UK..
0x0030   005c 908f 8018 804c 3c62 0000 0101 080a        .\.....L<b......
0x0040   8e6b 5b6d 0000 0000 0011 630b 0100 0001        .k[m......c.....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:45:55.872933 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-D^?^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-Y^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-DM-,^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-DM-^]^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-E^S^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-DM-^N. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-h^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-;^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-E1^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-DM-J^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-E"^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-DM-w^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-E^S^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-h^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flo
 wlabel 0x19e4c]
0x0000   6001 9e4c 01f5 063c 2001 0dc3 0000 0000        `..L...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 9623        .."......5.~.\.#
0x0030   554b f4d0 8018 8160 6e0d 0000 0101 080a        UK.....`n.......
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c4 7f00 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 d900 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc4 ac00 0100 0100        6.....!.........
0x00c0   36ee 8000 0480 080a 5ac4 9d00 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac5 1300 0100 0100        6...............
0x00e0   36ee 8000 04c0 0505 f1c4 8e00 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 e800 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 bb00 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c5 3100 0100 0100        6.....$...1.....
0x0120   36ee 8000 04c0 3a80 1ec4 ca00 0100 0100        6.....:.........
0x0130   36ee 8000 04c1 000e 81c5 2200 0100 0100        6.........".....
0x0140   36ee 8000 04c7 0753 2ac4 f700 0100 0100        6......S*.......
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c5 1300 1c00 0100 36ee 8000        ....0.......6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 e800 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c5 3100        ..........?.5.1.
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c4 ca00 1c00 0100        ........0.......
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c5 2200 1c00 0100 36ee 8000        ......".....6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c4 f700 1c00 0100 36ee 8000 1020 010d        B.......6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:45:55.873928 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389400601 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4d0        .......5.~.5UK..
0x0030   005c 908f b010 804c 3af1 0000 0101 080a        .\.....L:.......
0x0040   8e6b 5c19 0000 0000 0101 050a 005c 9623        .k\..........\.#
0x0050   005c 97f8                                      .\..
07:46:05.575449 2001:470:1f00:820:214:22ff:fed9:fbdc.63358 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389410259 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xf44d4]
0x0000   600f 44d4 002c 063f 2001 0470 1f00 0820        `.D..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77e 0035 554b f4d0        .......5.~.5UK..
0x0030   005c 908f b011 804c 1536 0000 0101 080a        .\.....L.6......
0x0040   8e6b 81d3 0000 0000 0101 050a 005c 9623        .k...........\.#
0x0050   005c 97f8                                      .\..
07:46:05.577626 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: S 3318766951:3318766951(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389410261 0,sackOK,eol> [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d67        .......5...5..]g
0x0030   0000 0000 b002 ffff 7293 0000 0204 05a0        ........r.......
0x0040   0103 0301 0101 080a 8e6b 81d5 0000 0000        .........k......
0x0050   0402 0000                                      ....
07:46:05.744238 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63358: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x19e4c]
0x0000   6001 9e4c 0020 063c 2001 0dc3 0000 0000        `..L...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77e 005c 97f8        .."......5.~.\..
0x0030   554b f4d1 8010 8160 81cf 0000 0101 080a        UK.....`........
0x0040   0000 0014 0000 0000                            ........
07:46:05.748470 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: S 352509186:352509186(0) ack 3318766952 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389410261,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 dd02        .."......5......
0x0030   c5d0 5d68 b012 8000 ff7c 0000 0204 05a0        ..]h.....|......
0x0040   0103 0300 0101 080a 0000 0000 8e6b 81d5        .............k..
0x0050   0402 0101                                      ....
07:46:05.749407 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389410433 0> [flowlabel 0xfc795]
0x0000   600f c795 0020 063f 2001 0470 1f00 0820        `......?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d68        .......5...5..]h
0x0030   1502 dd03 8010 804c 3f3c 0000 0101 080a        .......L?<......
0x0040   8e6b 8281 0000 0000                            .k......
07:46:05.750286 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389410434 0> 26282+ ANY? . (17) [flowlabel 0xfc795]
0x0000   600f c795 0033 063f 2001 0470 1f00 0820        `....3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d68        .......5...5..]h
0x0030   1502 dd03 8018 804c d762 0000 0101 080a        .......L.b......
0x0040   8e6b 8282 0000 0000 0011 66aa 0100 0001        .k........f.....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:46:05.923048 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-E^S^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-^]^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-E"^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-D^?^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-DM-W^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-E^D. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-f^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-^N^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-DM-;^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-DM-,^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-DM-u^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-E1^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-DM-W^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-f^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flo
 wlabel 0x659d8]
0x0000   6006 59d8 01f5 063c 2001 0dc3 0000 0000        `.Y....<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 e297        .."......5......
0x0030   c5d0 5d7b 8018 8160 c4c2 0000 0101 080a        ..]{...`........
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c5 1300 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 9d00 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc5 2200 0100 0100        6.....!...".....
0x00c0   36ee 8000 0480 080a 5ac4 7f00 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac4 d700 0100 0100        6...............
0x00e0   36ee 8000 04c0 0505 f1c5 0400 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 e600 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 8e00 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c4 bb00 0100 0100        6.....$.........
0x0120   36ee 8000 04c0 3a80 1ec4 ac00 0100 0100        6.....:.........
0x0130   36ee 8000 04c1 000e 81c4 f500 0100 0100        6...............
0x0140   36ee 8000 04c7 0753 2ac5 3100 0100 0100        6......S*.1.....
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c4 d700 1c00 0100 36ee 8000        ....0.......6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 e600 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c4 bb00        ..........?.5...
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c4 ac00 1c00 0100        ........0.......
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c4 f500 1c00 0100 36ee 8000        ............6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c5 3100 1c00 0100 36ee 8000 1020 010d        B.1.....6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:46:05.924405 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389410608 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d7b        .......5...5..]{
0x0030   1502 dd03 b010 804c 175a 0000 0101 080a        .......L.Z......
0x0040   8e6b 8330 0000 0000 0101 050a 1502 e297        .k.0............
0x0050   1502 e46c                                      ...l
07:46:15.616411 2001:470:1f00:820:214:22ff:fed9:fbdc.63359 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389420262 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xfc795]
0x0000   600f c795 002c 063f 2001 0470 1f00 0820        `....,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f77f 0035 c5d0 5d7b        .......5...5..]{
0x0030   1502 dd03 b011 804c f1a2 0000 0101 080a        .......L........
0x0040   8e6b a8e6 0000 0000 0101 050a 1502 e297        .k..............
0x0050   1502 e46c                                      ...l
07:46:15.618366 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: S 3733514252:3733514252(0) win 65535 <mss 1440,nop,wscale 1,nop,nop,timestamp 2389420264 0,sackOK,eol> [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80c        .......5...5....
0x0030   0000 0000 b002 ffff a821 0000 0204 05a0        .........!......
0x0040   0103 0301 0101 080a 8e6b a8e8 0000 0000        .........k......
0x0050   0402 0000                                      ....
07:46:15.788094 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63359: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x659d8]
0x0000   6006 59d8 0020 063c 2001 0dc3 0000 0000        `.Y....<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f77f 1502 e46c        .."......5.....l
0x0030   c5d0 5d7c 8010 8160 4784 0000 0101 080a        ..]|...`G.......
0x0040   0000 0014 0000 0000                            ........
07:46:15.792142 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: S 735268754:735268754(0) ack 3733514253 win 32768 <mss 1440,nop,wscale 0,nop,nop,timestamp 0 2389420264,sackOK,nop,nop>
0x0000   6000 0000 002c 063c 2001 0dc3 0000 0000        `....,.<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 4f92        .."......5..+.O.
0x0030   de88 e80d b012 8000 abaa 0000 0204 05a0        ................
0x0040   0103 0300 0101 080a 0000 0000 8e6b a8e8        .............k..
0x0050   0402 0101                                      ....
07:46:15.793178 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389420437 0> [flowlabel 0xc5b85]
0x0000   600c 5b85 0020 063f 2001 0470 1f00 0820        `.[....?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80d        .......5...5....
0x0030   2bd3 4f93 8010 804c eb68 0000 0101 080a        +.O....L.h......
0x0040   8e6b a995 0000 0000                            .k......
07:46:15.794056 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: P 1:20(19) ack 1 win 32844 <nop,nop,timestamp 2389420438 0> 6208+ ANY? . (17) [flowlabel 0xc5b85]
0x0000   600c 5b85 0033 063f 2001 0470 1f00 0820        `.[..3.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e80d        .......5...5....
0x0030   2bd3 4f93 8018 804c d1f9 0000 0101 080a        +.O....L........
0x0040   8e6b a996 0000 0000 0011 1840 0100 0001        .k.........@....
0x0050   0000 0000 0000 0000 ff00 01                    ...........
07:46:15.971558 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: P 1429:1898(469) ack 20 win 33120 <nop,nop,timestamp 0 0> 20894 op7 [b2&3=0x3a8b] [61225a] [54612q] [21615n] [63742au] Type256 (Class 256)? C_^[d^NM-^XM-xM-^EM-BM-*-sM-IKM-+}M-^QM-%&/#M-aBRM-J.M-)M-^CjvqM-uB}^_^AM-WqM-8M-}SM-^@M-^B}^OM-^4!cM-@^\^@^A^@^A^@6M-nM-^@^@^DM-F)^@^DM-E^D^@^A^@^A^@6M-nM-^@^@^DM-@M-dOM-IM-DM-^N^@^A^@^A^@6M-nM-^@^@^DM-@!^D^LM-DM-f^@^A^@^A^@6M-nM-^@^@^DM-^@^H^JZM-DM-H^@^A^@^A^@6M-nM-^@^@^DM-@M-KM-f^JM-E1^@^A^@^A^@6M-nM-^@^@^DM-@^E^EM-qM-D^?. Type32831 (Class 565)? M-nM-^@^@^DM-@p$^DM-DM-u^@^A^@^A^@6M-nM-^@^@^DM-^@?^B5M-DM-9^@^A^@^A^@6M-nM-^@^@^DM-@$M-^T^QM-DM-*^@^A^@^A^@6M-nM-^@^@^DM-@:.^^M-E"^@^A^@^A^@6M-nM-^@^@^DM-A^@^NM-^AM-DM-W^@^A^@^A^@6M-nM-^@^@^DM-G^GS*M-E^S^@^A^@^A^@6M-nM-^@^@^DM-J^L^[!M-@^\^@^\^@^A^@6M-nM-^@^@^P ^A^E^CM-:>^@^@^@^@^@^@^@^B^@0M-E1^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@/^@^@^@^@^@^@^@^@^@^OM-DM-u^@^\^@^A^@6M-nM-^@^@^P ^A^E^@^@^A^@^@^@^@^@. AAAA? [|domain] [flowla
 bel 0x78f40]
0x0000   6007 8f40 01f5 063c 2001 0dc3 0000 0000        `..@...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 5527        .."......5..+.U'
0x0030   de88 e820 8018 8160 df02 0000 0101 080a        .......`........
0x0040   0000 0000 0000 0000 1c29 519e 3a8b d554        .........)Q.:..T
0x0050   ef29 546f f8fe 9443 5f1b 640e 98f8 85c2        .)To...C_.d.....
0x0060   aa2d 73c9 4bab 7d91 a526 2f23 e142 52ca        .-s.K.}..&/#.BR.
0x0070   2ea9 836a 7671 f542 7d1f 01d7 71b8 fd53        ...jvq.B}...q..S
0x0080   80de 427d 0fde 3421 63c0 1c00 0100 0100        ..B}..4!c.......
0x0090   36ee 8000 04c6 2900 04c5 0400 0100 0100        6.....).........
0x00a0   36ee 8000 04c0 e44f c9c4 8e00 0100 0100        6......O........
0x00b0   36ee 8000 04c0 2104 0cc4 e600 0100 0100        6.....!.........
0x00c0   36ee 8000 0480 080a 5ac4 c800 0100 0100        6.......Z.......
0x00d0   36ee 8000 04c0 cbe6 0ac5 3100 0100 0100        6.........1.....
0x00e0   36ee 8000 04c0 0505 f1c4 7f00 0100 0100        6...............
0x00f0   36ee 8000 04c0 7024 04c4 f500 0100 0100        6.....p$........
0x0100   36ee 8000 0480 3f02 35c4 b900 0100 0100        6.....?.5.......
0x0110   36ee 8000 04c0 2494 11c4 aa00 0100 0100        6.....$.........
0x0120   36ee 8000 04c0 3a80 1ec5 2200 0100 0100        6.....:...".....
0x0130   36ee 8000 04c1 000e 81c4 d700 0100 0100        6...............
0x0140   36ee 8000 04c7 0753 2ac5 1300 0100 0100        6......S*.......
0x0150   36ee 8000 04ca 0c1b 21c0 1c00 1c00 0100        6.......!.......
0x0160   36ee 8000 1020 0105 03ba 3e00 0000 0000        6.........>.....
0x0170   0000 0200 30c5 3100 1c00 0100 36ee 8000        ....0.1.....6...
0x0180   1020 0105 0000 2f00 0000 0000 0000 0000        ....../.........
0x0190   0fc4 f500 1c00 0100 36ee 8000 1020 0105        ........6.......
0x01a0   0000 0100 0000 0000 0080 3f02 35c4 aa00        ..........?.5...
0x01b0   1c00 0100 36ee 8000 1020 0105 030c 2700        ....6.........'.
0x01c0   0000 0000 0000 0200 30c5 2200 1c00 0100        ........0.".....
0x01d0   36ee 8000 1020 0107 fd00 0000 0000 0000        6...............
0x01e0   0000 0000 01c4 d700 1c00 0100 36ee 8000        ............6...
0x01f0   1020 0105 0000 0300 0000 0000 0000 0000        ................
0x0200   42c5 1300 1c00 0100 36ee 8000 1020 010d        B.......6.......
0x0210   c300 0000 0000 0000 0000 0000 35               ............5
07:46:15.972853 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: . ack 1 win 32844 <nop,nop,timestamp 2389420617 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e820        .......5...5....
0x0030   2bd3 4f93 b010 804c b0c0 0000 0101 080a        +.O....L........
0x0040   8e6b aa49 0000 0000 0101 050a 2bd3 5527        .k.I........+.U'
0x0050   2bd3 56fc                                      +.V.
07:46:25.667682 2001:470:1f00:820:214:22ff:fed9:fbdc.63360 > 2001:dc3::35.53: F 20:20(0) ack 1 win 32844 <nop,nop,timestamp 2389430265 0,nop,nop,sack sack 1 {1429:1898} > [flowlabel 0xc5b85]
0x0000   600c 5b85 002c 063f 2001 0470 1f00 0820        `.[..,.?...p....
0x0010   0214 22ff fed9 fbdc 2001 0dc3 0000 0000        ..".............
0x0020   0000 0000 0000 0035 f780 0035 de88 e820        .......5...5....
0x0030   2bd3 4f93 b011 804c 8b0f 0000 0101 080a        +.O....L........
0x0040   8e6b cff9 0000 0000 0101 050a 2bd3 5527        .k..........+.U'
0x0050   2bd3 56fc                                      +.V.
07:46:25.835751 2001:dc3::35.53 > 2001:470:1f00:820:214:22ff:fed9:fbdc.63360: . ack 21 win 33120 <nop,nop,timestamp 20 0> [flowlabel 0x78f40]
0x0000   6007 8f40 0020 063c 2001 0dc3 0000 0000        `..@...<........
0x0010   0000 0000 0000 0035 2001 0470 1f00 0820        .......5...p....
0x0020   0214 22ff fed9 fbdc 0035 f780 2bd3 56fc        .."......5..+.V.
0x0030   de88 e821 8010 8160 1ac5 0000 0101 080a        ...!...`........
0x0040   0000 0014 0000 0000                            ........
^C
27 packets received by filter
0 packets dropped by kernel


-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka@isc.org