[prev in list] [next in list] [prev in thread] [next in thread] 

List:       wireshark-users
Subject:    Re: [Wireshark-users] Any wireshark filter to differentiate between NXDOMAIN and NXRRSET
From:       Jaap Keuter <jaap.keuter () xs4all ! nl>
Date:       2017-03-29 11:30:23
Message-ID: 364FC715-35FB-44FD-883A-245ABCB85DD1 () xs4all ! nl
[Download RAW message or body]

[Attachment #2 (multipart/alternative)]


Hi,

So we're back at the question 'Why are you convinced NXRRSET should be present?' 
You assume they are there, but so far I've seen no evidence that they are there.
As for the reason why NXRRSET is not set Wireshark cannot answer you, that depends on \
your DNS server software. I think you'll want to seek more information there.

Thanks,
Jaap


> On 29 Mar 2017, at 11:56, Abdul Khader <akhader@ies.etisalat.ae> wrote:
> 
> Clarification, when I said !(dns.flags.rcode == 0) works, I mean the filter is \
> working but not giving me the what I am looking for. 
> I want to list only NXRRSET packets.
> 
> 
> On 3/29/2017 1:54 PM, Abdul Khader wrote:
> > Hi, 
> > 
> > Yes the filter !(dns.flags.rcode == 0) works. 
> > 
> > 
> > I have a domain for example, abc.com. 
> > I have A record for abc,com but NO SRV record. 
> > If a client queries for SRV record for abc.com, it should result in NXRRSET ? 
> > 
> > I have lot of such queries for SRV record, so I feel I should see NXRRSET in my \
> > wireshark for all those queries.  
> > 
> > 
> > Regards 
> > Abdul Khader 
> > 
> > 
> > 
> > 
> > 
> > On 3/29/2017 1:44 PM, Jaap Keuter wrote: 
> > > Hi, 
> > > 
> > > Oke, so you're using an up to date Wireshark version, that's good. 
> > > How about filtering out all ‘problems', using: 
> > > 
> > > !(dns.flags.rcode == 0) 
> > > 
> > > Does anything show up? Does it give you a clue? Why are you convinced NXRRSET \
> > > should be present?  
> > > Thanks, 
> > > Jaap 
> > > 
> > > 
> > > > On 29 Mar 2017, at 11:35, Abdul Khader <akhader@ies.etisalat.ae> \
> > > > <mailto:akhader@ies.etisalat.ae> wrote:  
> > > > Hi, 
> > > > 
> > > > I am using Version 2.2.5 (v2.2.5-0-g440fd4d). 
> > > > 
> > > > dns.flags.rcode == 8 does not work. It's not giving any results. 
> > > > 
> > > > 
> > > > Regards 
> > > > 
> > > > 
> > > > 
> > > > On 3/29/2017 1:32 PM, Jaap Keuter wrote: 
> > > > > Hi, 
> > > > > 
> > > > > According to RFC 6895 that value (8) is used as RCODE for NXRRSET, so the \
> > > > > filter  
> > > > > dns.flags.rcode == 8 
> > > > > 
> > > > > Should be fine. What Wireshark version are you using? 
> > > > > 
> > > > > Thanks, 
> > > > > Jaap 
> > > > > 
> > > > > 
> > > > > 
> > > > > > On 29 Mar 2017, at 10:23, Abdul Khader <akhader@ies.etisalat.ae> \
> > > > > > <mailto:akhader@ies.etisalat.ae> wrote:  
> > > > > > Dear All, 
> > > > > > 
> > > > > > Any wireshark filter which would give me NXRRSET and does not include \
> > > > > > NXDOMAIN  
> > > > > > To get NXDOMAIN, we can use dns.flags.rcode == 3 
> > > > > > 
> > > > > > But how do we get NXRRSET ? 
> > > > > > 
> > > > > > 
> > > > > > dns.flags.rcode == 8 or dns.flags.rcode == 0x8  does not work. 
> > > > > > 


[Attachment #5 (multipart/related)]

[Attachment #7 (unknown)]

<html><head><meta http-equiv="Content-Type" content="text/html \
charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; \
-webkit-line-break: after-white-space;" class=""><div class="">Hi,</div><div \
class=""><br class=""></div><div class="">So we're back at the question 'Why are you \
convinced NXRRSET should be present?'&nbsp;</div><div class="">You assume they are \
there, but so far I've seen no evidence that they are there.</div><div class="">As \
for the reason why NXRRSET is not set Wireshark cannot answer you, that depends on \
your DNS server software.</div><div class="">I think you'll want to seek more \
information there.</div><div class=""><br class=""></div><div \
class="">Thanks,</div><div class="">Jaap</div><div class=""><br class=""></div><br \
class=""><div><blockquote type="cite" class=""><div class="">On 29 Mar 2017, at \
11:56, Abdul Khader &lt;<a href="mailto:akhader@ies.etisalat.ae" \
class="">akhader@ies.etisalat.ae</a>&gt; wrote:</div><br \
class="Apple-interchange-newline"><div class="">  
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" class="">
  
  <div bgcolor="#FFFFFF" text="#000000" class=""><p class="">Clarification, when I \
                said !(dns.flags.rcode == 0) works, I mean
      the filter is working but not giving me the what I am looking for.</p><p \
class="">I want to list only NXRRSET packets.<br class="">  </p>
    <div class="moz-signature"><br class="">
      <img border="0" class="" apple-inline="yes" \
id="AEF699A8-B513-4F25-825D-B4B861EBC680" \
src="cid:part1.1874516C.CAF7E4BE@ies.etisalat.ae"></div>  <div \
class="moz-cite-prefix">On 3/29/2017 1:54 PM, Abdul Khader  wrote:<br class="">
    </div>
    <blockquote cite="mid:a8615744-083c-9858-2130-c7531e2ce512@ies.etisalat.ae" \
type="cite" class="">Hi,  <br class="">
      <br class="">
      Yes the filter !(dns.flags.rcode == 0) works.
      <br class="">
      <br class="">
      <br class="">
      I have a domain for example, <a href="http://abc.com" class="">abc.com</a>.
      <br class="">
      I have A record for abc,com but NO SRV record.
      <br class="">
      If a client queries for SRV record for <a href="http://abc.com" \
class="">abc.com</a>, it should result  in NXRRSET ?
      <br class="">
      <br class="">
      I have lot of such queries for SRV record, so I feel I should see
      NXRRSET in my wireshark for all those queries.
      <br class="">
      <br class="">
      <br class="">
      <br class="">
      Regards
      <br class="">
      Abdul Khader
      <br class="">
      <br class="">
      <br class="">
      <br class="">
      <br class="">
      <br class="">
      On 3/29/2017 1:44 PM, Jaap Keuter wrote:
      <br class="">
      <blockquote type="cite" class="">Hi,
        <br class="">
        <br class="">
        Oke, so you're using an up to date Wireshark version, that's
        good.
        <br class="">
        How about filtering out all ‘problems', using:
        <br class="">
        <br class="">
        &nbsp;&nbsp;&nbsp;&nbsp;!(dns.flags.rcode == 0)
        <br class="">
        <br class="">
        Does anything show up? Does it give you a clue? Why are you
        convinced NXRRSET should be present?
        <br class="">
        <br class="">
        Thanks,
        <br class="">
        Jaap
        <br class="">
        <br class="">
        <br class="">
        <blockquote type="cite" class="">On 29 Mar 2017, at 11:35, Abdul Khader
          <a class="moz-txt-link-rfc2396E" \
href="mailto:akhader@ies.etisalat.ae">&lt;akhader@ies.etisalat.ae&gt;</a> wrote:  <br \
class="">  <br class="">
          Hi,
          <br class="">
          <br class="">
          I am using Version 2.2.5 (v2.2.5-0-g440fd4d).
          <br class="">
          <br class="">
          dns.flags.rcode == 8 does not work. It's not giving any
          results.
          <br class="">
          <br class="">
          <br class="">
          Regards
          <br class="">
          <br class="">
          <br class="">
          <br class="">
          On 3/29/2017 1:32 PM, Jaap Keuter wrote:
          <br class="">
          <blockquote type="cite" class="">Hi,
            <br class="">
            <br class="">
            According to RFC 6895 that value (8) is used as RCODE for
            NXRRSET, so the filter
            <br class="">
            <br class="">
            &nbsp;&nbsp;&nbsp;&nbsp;dns.flags.rcode == 8
            <br class="">
            <br class="">
            Should be fine. What Wireshark version are you using?
            <br class="">
            <br class="">
            Thanks,
            <br class="">
            Jaap
            <br class="">
            <br class="">
            <br class="">
            <br class="">
            <blockquote type="cite" class="">On 29 Mar 2017, at 10:23, Abdul
              Khader <a class="moz-txt-link-rfc2396E" \
href="mailto:akhader@ies.etisalat.ae">&lt;akhader@ies.etisalat.ae&gt;</a> wrote:  <br \
class="">  <br class="">
              Dear All,
              <br class="">
              <br class="">
              Any wireshark filter which would give me NXRRSET and does
              not include NXDOMAIN
              <br class="">
              <br class="">
              To get NXDOMAIN, we can use dns.flags.rcode == 3
              <br class="">
              <br class="">
              But how do we get NXRRSET ?
              <br class="">
              <br class="">
              <br class="">
              dns.flags.rcode == 8 or dns.flags.rcode == 0x8&nbsp; does not
              work.
              <br class="">
              <br class="">
            </blockquote>
          </blockquote>
        </blockquote></blockquote></blockquote></div></div></blockquote></div><br \
class=""></body></html>


["Signature.png" (Signature.png)]

PNG


IHDRUzysRGBgAMAa	pHYsttfxWIDATx^|UR \
t=!Ћ4 *-	!	EtEEjz(twn߻wݻ;oN2y)0ɼ3s3< \
L2edBՔ)SQ&TM2eeBՔ)SQ&TM2eeBՔ)SQB'bͯ.^`fʔ)S \
?ӟ?WTCo[kdʔ+W!=?_RNWׅ/M2ue* \
$TW2A\obLOޔ+[!4+ٳ:x&oo&zsN8qByZ)MW2eTPaѣ:uꄨ(4yEfh<>} \
-- ˗/ǧ~ezL]
	U/-RlV[Y:a 6k
x7sfqqq{5eʔ)3_Z:vt \
Af!::v6+y|p"rzrpb;@6fu=R, \
;Z,`5̡rͫK-`+zꊫ痮>~ߔ)SMY>`kL<Y0T}>%j \
<68N8)>.Vx^Fv	0mns9+UiV1+qTCҮfQl\srЛˆׇ \
UvRאݫt}	US,|u@^^^%P	pjRe){j	KsFqS<V'A)tɒFpSa^VegNWv<Uoˆyulԩ!2jTӗ
 R4]o~dBC{cl !<vx4?ڥow h_:6zS<MzQKm~! \
[1'=]Y[Ӹh9{4^-[k \
߼>\k׮[5eՊ&TMjRPtџ]/t#"@z}MY,l1WXlH!Y% \
c5VL t #+L \
BA)PurY,5uTFdd|pIo˅Vk?ez5SL5EYI*j`!!uST	DU(NXӓM8:J,K^߸,df*C鹔cyY`4
 ݊o	>,>vwkT
ֿW֔)SMW
|gnݺjBCyCv+P E]Q	7 !0 \
bzd06K@:e)8fV$`vy}R./=`T8nw)MUaH>Qӓ߯'MX"M2մzg
 Bh,=U@ﭺ#	L 
t	#w53z= 5Q \
!axxfeq46B4}Td=4j=ʬz੊Q׃`KGWFEiNWkړNb>bSq \
+AjjVm?Y7ե߄K\ *JC*PyK?`|,ahYвFw \
Gyp󼑘`n(w8A1:g8) \
Jg\3QLފ\]}z>M/B6J\ٖd-+ \
zikPzhU=8[u.k%UoKCUu[d?Qvҷ+jkAȶx̙-~ \
3̹0zoL'f<̋?`rg"vEhwiЋ+%ޱT<V+Jҏ \
67ޥV'՞`e̫w57D:WaAns#66Lӧt쇆ᮅC`n2{" \
Nͣth,ZkS0wPܓ;1~`OL7ُඅw,0qWpGWe^F3{@@4TQ*fh
 |P:y_xMͯ@30C=F\
R9r @N=k k,/.MDzXV>
Y<9[G!wx䖍*%'R0g@a/L[Mmb8t1欿%`6WյZ]+QV+LS#h` \
0ʪ76=B3*R&usy+:U.ٽ略ڇE`rXQ0مӒdj22ˇ`qz9˟OҒD,,L \
$,-NҢXR8%]v2ύ?;J cqp1kT8g,%BT+&e:!.e \
p5S3F jѪnB^<Hڵ4xes(\ Tw)MH7 \
TmZz!Y,,--3zy:mJ \
ðd[?,-I(xdCnI*'#hrh֜A-G#wP,HƚxF<ٌ d \
Z3Zc{f %cԎhɮ,n \
7xrna98jDTd+iQ/+T_X}}uUe?p[K\pouU=!~\=f`B=\)6C\穦Mto.oU^+8|0>
 7"g{*@Fi
2S($@M5KZ0L_lmNrK
\\Ñ' 4dne[GcqQ*|*evôb꽽1g(M뉫D^61f('7vD?,=NBݱUenX@&T<>0ʳKE \
֐W	a穦MŖpA_T	hnA$h, \
^hp?HKd)ifTw:B@;JllK)LoExb1Ecl"MVˬxQ+{0fg/޸mA"n$EC27u1F!aW&a,g#U9o?X%#F \
7Sע1ZuU0|ܪ8ϣy*<K}έ2V=u=F\ K {7{=/OD3
R`,K@Fq@u*g	`YǺtxcm4Bx˶*^+m[x)۞&.MŪ-2Ffdvz \
lrc]0@G|wFvFtۊV6j٭9l"xSUfP*GtVћV[azV=0*X,졬O[?XWZz^7B)PTSbCűVX
 U=ipxC|,2Q(PUUR \N)/.x \
[z`I~/,)#[~ljy[#/_`,`yQF`yIrJ%t,#G5񘱰#&~f=<w<~ \
#PdŃxp;7|.z:U4k%T W4T	D5P bVuvkx \
xpEUiqn5\S2\j8Td x8(e[ⱼ8UdN* f20%P-MY/ \
E8~~~%^OĦb[ظ3Ͻ2O \
gcr6FΖX!ǯdزD,@gǻU*Ls`C1.}Pܽx\ *fm \
Z9ٷ8I5cl.TCܔ[+ \
(Jx*>T7u1ZxkIM*]n[a@G4wm8=J]KXW]V"E~z].Ȳ \
?Geq(ؙm{S}n<v.ŞscxD*>:;A)xnG.-xܲ-*pUݰX	:	
 ǜ>ᡮ^1d$6@F&zVo@_<*rgu5jʔC3\<> \
/ENXU2SM&!dr9\eRd=wsߙ4$?;CrbM{gF`$ \
|(E;`]DZ[`t$}x#1ɡ7n7OÔ[ѩ~{^QR	MjR`LU'X*PV@U \
P5eʔAa@eؔN-+`+)C.|eEt@/{$@șD<8'#{ɾuc%A^;w=6lj
 $#lzIK`}qcܳ`_'.ciǞ% \
dojW6Nߔ)SMMAU$j:r; \
{`*"@^kI*gvGniO<0?cg3pD/?U]pLw?GOd7<OavSaϙnw..&G#tlg \
ʂ ,	ECQ<L<:Ecd(ܱt&s'bnd]=~Z-EVo.'""iQZ8/S5jʔ
  6΂8L<76J'-[,`(?<>cs߉/@=, \
<|n8"`=rJ<Փk#ݰ_l \
4Χ#xxlk#dˊX T(1w0Lf<sM̹?j88 \
5Bjj -	USL UReέw"L>#prӤ-Pe5@ \
d]~]C{ \
T3w;.}#UzPX/wHأ#ztwlW87;J \
.斥 ,I= k_	צaC=p=pÂ)<"bjت; \
*e+f?J,fߔ)S6T'GҧSZe)I *<ds> \
w]ݧ;Å'NO;_g*>p<IywÁ]dgg{;遽@y?HtxIX)Q@:Y\ăMŒT< \
L4^	vìGaނ[VV_a{\j&TM2L *[,Х%bdl|a \
>[dbіIⵎ xeo?9=\gg[ql=ٹ7'ᶙpӑq+^C<w^S \
?:{O\O]#:68~_肣GxD5W#{]SCi'`Y,*LCV9H-1yn[x:ܾd(FWKhݑ8
 SԵ0jʔ@UpU{J_tY,YEVX?%XQ?~`kpwx6֮K \
*"-Z-K.HW @yO%b8(š3]`qD<֓gpD{/8Ϗ \
ַxa5x p}Nxօ*KGt5θn=?#oG,?"r1-zD fwe \
ULnK["-Z~6Bʗܲ.P(jh'pû7Z&fiAS*:b[Yk \
w낷şMđql?_<޾{NlCRhؓ5E?Vce(x%XV6R7py&7/=&aؾĸ*X`up/| \
m,V1Zh䏻q2eT}T=jzYw_!at26%![<%EÐ'`ޖ~!8|av \
xlq'P	%**q8^o\Y0kq-ع}pBOs39?HÁc[)xtVcG+g]46œ/ހǞ-s`(qLlPs4b˿NU
 2qdBՔo[a@U<4Cl;7Or*BUK"<yRO7`3ХZ{jIZaF \
fmR䎍"b$,8BXUmIg#'b8,{Oȅ8?5OOīFau~7d?9 \
X%jnHGbd(ScwƭFׁm7U#%Or]ܑbUzL555⡹R,yK[Pz֖&
 RK㐷5cw:	T?63f_XeT
FVhx6xc#~gxk[	hG{ci88}'Cg"$lӱ<]<X-P]Q8y<K<=֍-bU'ɟ*fuqG5Z' \
Z5l=AE/pb[3~2դ*	gLO7Pů*$d!<+6 lg \
|=c<n)>{ڊw*uꎅZm%06ϣÂOVK-}v?i^}z~:N@ \
Otācq\O9{ƞcwz4^(jw.NA^(D,.&^Z(c$@z0	#dlX@55ȂW3j]UjյUdUxXMę \
cE@dn),PlFoI<\6(>z/ GP TmFw!pfF \
]Yn>x8WuMxt`8y?{#F' \
:bM0j:VMVd/*(-j*Y67=4mm \
&KU#B2?Aʰ-JB@ϴ7eRxj6CBk:|2Ome[!d6 \
R	iO56[{]-Xg)xL˦TeUmdݜbZG.1~u=ɾ{> \
bG'aX[\ܢ	ޚIX\į,%ϥa#}q#Ñ2ׯ6.TyRm^7jm4~S,U;.nz \
.N~,o89T>1{OQKueVR M \
jU='#&Z/۳3ayb%1rsqLu38v.[-xmx]l~]ґY"p"`M
 -Ъa 玄-_hP
D
kMT->[1"q)xǒ
)'xgTt_GIXJAS]bnNS{V8FT8}Xv/bнO"4:cc8~?~<[&y%OAf(,.Lr~P< \
xd&`7 AjUɧ_.Wx!X \
2ue)LrNHlUZ-[_NّQ-UE]P8,NJ^[s8,Nn_^'Gk|nep٣$A+rvDEo`ڤb`˚8}VRp\
 G 3}pؾg(2!gk
aIxP"+Fx49EctJիZd \
CSp@rԵ߄)Sa@U/V \
9:͂Q8(5KMT+W$2	UKYv~UK[Ex?Po \
IN".rF.Ϥ{ga8}vÁ]qt/8hwAX\❎Ǣ45luYx[ \
hb3pۼH,~O Ph~ \
A^<?Fo7eRáSVx=>KdHl#ױ	OĪm7bax<r6&NmE-%6n/g2B'4rK \
V;ga+ʼnsq|_s9&cގ`d."X'n폌2`KҐYRjq8vq|7&xkɫ
 TzVSL}k
o"^w$<mй
e/_v,rJ''GJܦWq۫.T2BC6L)x^Oeb^r勆+{lO܃ \
=p|oxvʒlCj`)?]$^@$bE95H;w?W4=pW \
klث)SRxu.-(>KK5C_+G#s,T/7!!VRp;RdWPdKOV
 zRM\-vJ恋+sXOCba|IG \
HՅO2~!@-'6%cY4R!8	yXY'KakuEpN\5T*2eVXPek턝V&9&}lk
 }6Jz!kS*rұ 76%/NQSqOd+=^TCJuY;a,ˎxrE/7 \
ъ',p_-3p\v>xx]>KJ|2 f \
3'P{MGd<&\	%nO VU<L`:(z`	PlQdq]*8'~>
!j
K{qI?-xN%~U`˱6	SXUessm) \
|-d%^xx]nΕ_#X9GIq~;g	X (jy<nò-7: \
`)BYn Tv
D	USUODk8n)jyPt<'r%9僱rc/N\sU}@Y66#b\F\ \
ϖ,]^ح>8,6bUPm.ƭpg7I8H~|JމCN5.C^Y2&ᱢX}([FNF^i`1Oz_(
 >UL0){\RdwKѝL{x<Wun~9+#c,Og{=âUijX);[6#J \
Qn*K"i9c\pD?F-K޲nE4$X, \
?Oîxl]سS'5 \
l"`ǢmCW8y坑*y,vz`ξY`'ʪ&TM2eTáadQ\Eǝvķ`K	8Z
 6ʢZM/O nս$͂f#vMs3W)[%^+8ˎf-[9V='Ov!8>&}jJU	 \
 )ί,!ET,+fXds*#/UxH9T \
eavVD9+OՄ)S+OթdMJ Xaow_?9 \
o'bUiJ߾3i@\J]R@tl]WIܭ;懗3ڂū`p)8x \
z!cSOdJvVNH,+JGV!? \
D,g_샅OE#c]k6|?+qC=`gY^bpXzS \
k󪿪G@4ucBZul͞p|m<ZCBofzm%_sՎ5}}켫o<v֚v-DžD!QΧ
 .5	T(Vzs:[mYĞCgcKi)Z-pb$K%g \
[^0Tlւ1ӛc[cpspqر?X^z9kϏGfA*nIBvxvNKWO<~X]:Oo퍗N \
_.Caܴ ?7Z4IP~MZ%ހYM&1ħCP7Z PB4v
#K!hTm*65F1}Gjȹ }`g<VN!ӮZ/oZ<aO-
16)T=grq"; \
G$!~RNBƖ>xx⽸@'gvX}j#>bX=frG<a~zx5VwEzw<27%Hz⥊wZLt@dDkă/ĎFfs
 oTyT>M	+ߨҸ=VkBٯu|j;eWjW9Wj*l \
1jk;kVxP)F`Jѽ@(,;ƪuxEM֝ѥ \
OE<?@5zvxnWZ,ᶎT>݊OV(jpPd=QRUQv/T,ʗ8X \
`ض_3??1rbywֈcCd[<gyX/'OVuV)S!4uHbiԐ1 \
i1 $J
<BH}KkN-Pm}@Eu 积o(EATI \
juF>8LmZکwq2ژG7>5ǣϴ?_w<Ix*I \
#m"{]ɟ՛o3,+H%ixlCnFa)xӉqix|s'D9?,ä剂r5kഴzryn]1oS
 `7j| \'U
_MWGk*=jB>@*0B_1HZjWZTZҦBWU5j}] kryē \
ϺT6TE}W-~q'v"c] aM,0O
>v<=|Xw(h,?K~n:ⱭaaiO5  \
-cX;.p>8A8!x	xq \
uN"EXz/xK	ݲH̥1e*2T7t H	CpS`, \
UFUp^ ׁ2^2x]yK}#_!QS *;WBU \
/Nc~xxnG?WEf~o,+쇕	j \
dog^w'37aIxX<(ly9	OBFY?dҒ(+L~DX`'넬-^xAx@dfaش}duCX'{0,KhV.S.s
  nW#D-iU<,ax?xΗ:WB]?PG*ॆz \
˿Oh5TY+jG ń'`sIaglGvq 6c4d< XU 
ƲqXi VÒ
W<kau8,Mސ-87ЗCq׉8MĶF`AFOu
Zfu@ׅEM%)/z
Q@An@7V%A8^_Ƽ6o|cGPGqT4/>W<y>(L3̈́xy
 4nALհl-I FbŎa,>[ps,K{'+ݜ
㑹<]<ObھXux<_KW'<_߉='Njo%G`gk(ClTYF˺beGOΕ_$mZ_NMS
 ,AS7j@z@)<ޮj;ηPquԖ/qYWڡUG^u>WX
U *ުmW9<^	o*b637ǒ͜^o,J#,+^'2y{ j_e$<7o- \
7	8qpqmxZ6S C{'o \
RTxQ	xWeo-Z	eߔ)SMEAU<R;:RNUహwaY)Or)sҜ \
dwmtsK(Ͻ6EӰb<|=g6?o'q]26_1@up9,c6vՒy \
}VDDxᴳ+WK8$aj)xV,̈́)SB)LPu<^UPupb_fY4V޽{?kJ;#oux4+7m \
XS_{Lɟ߆o/ǂk2!}h&h' T =.{ \
Hzy`oX٧C`o[yBG~2Ώv9/.v 8&XM2e* v*4: \
_rWK)fT*ςqIX= x2x-.obކ
[g~Z9?HG^q)yq x6SR	O\~xWiJm
̯KlY[xH#& \
Xl&TM2`Uxy<޲TN;UxފYƌD:	v{||6}=ߌgv#oTM:me׬(xV0Vq!ܫ-`q
 4eA!Nuv/ŻV0LX! 4[jt	USL5DS/ao- \
b8Gazzto.ƁI8va  \
6ׂh7?Lb.Q$NÎU7>ԇYF2Zd)ɬ9VM j \
{to~TP;"g<~Z )`M 3@5jʔ&T| *^JQ #` \
bǘ(7]OCӑjƎf8%-m>9>6	b&TubiZ񔯂ɏX?ox \
X-`2`s$0'^pSL5PAUgsnWIX?֟rB9UP,HJk	[cH \
O5,io7B<B~w/Xa(2.YBn$3Ƀj9zq,1zf'D%=?T%>x6b%7"b]9PCT
 OZߍU?.DpƎR1]8OSy}C͔jFVpZ \
ܣl\c~0o+DD4Woh⼵;0klDd}V' \
{oڶT`L@g+I^"=Q[XΗN UL$',!Ix՝~TnA \
*UW LUx/U54+=5~Z \
(bVdi?"5?D.ZjYR8ɵ,.Y3jHN?BbǴv)l*^ \
GQG@Zsn9iq61LҡkU(۷O=thsN&DjA=GdH$GٮU
 jRoPxP
a<cZ;͛F2<m͚5x뭷oϣ>3jԨpG)q]F \
pL4>dgg+x\gϞܹsvWHL*_8>^>d8N,>*pፕ@vq!~VrPilS^Z+<8~~k
 JDD&Ӑ"P6
7+4B
Uu 0H54a'go˖-8qS/GBB4</T`A5>
2' a:^K[trmRT!`{iTG0
j,
7\(u&F'Iq;"[Îa	7~X=n8N
qx.q
enLLJ_###o6]@T{굯b
j~$2[-lۂS5 \
UAai$WB񵜟&F--ZPwYyO?xJT{޶m[Wk!qu]֭͛i&Uի
 a!8x`2Dm?~ۥx4ajX<*/Pm`ί`k=^sZ \
7noI+l"7rl֬:~СxY/=v옂*dP;vXinܸQ|PYPeS%X3F~XOS/G?Q%	czӦM:Vng9pQR@@PC#<Wtz6/
 ^7zن8iHWI-2oPZTVXP%XlfB 1ܮrݻwWʢ9hs=R?x \
~~׫ s*RSSѿwQQ.  \
=nf_^mg|jzJ[hZ'	4hstPz05`q2Tu?ޤve|̀)Qqʫke\ZUu!!SWH8s5
 Ng)+,<zɰٳi]. :t \
u!P?bĉUBXE@0ٳG5:Q?0gΜJX7ÛoYY󞕕%uxzլSe׷UJ \
]U6#p3@~6o@*XZ0BcioW5~%so5~嶪0Ov~U \
C{\粤˖-< GJX'5? +P}VqcǪ0Ѻ5

ZՅ۹_kxv:k׮o)jz|L5e
U#\YI/i*؄+56(4B	'z,k+mٲe1r,'T6BM!0aM2bҥ* \
jz\:USL59UmLlen6ۂAʺQB46:د233=;	&p˗/to~ \
aKSqN^SL59U}ߪF"6<ذa}':g)jJvb~;t׫~;<Ӣ^uj%kg>
 4TܹSozLj Tu;ho#{2-z[M[pae#R(obM7ݤ \
$u?SL5Evaq|FFŋ+%K.Rl|b%6?*'RDzOz'OVquў \
ݡfϞ<Gy/+L7SuF:1\NNNe+?ϋ*Jm^9|U}}M2մ6T	<!4nU*iXFO~ \
=@mLSCuuL Tu\(4
 *#|tx'441ai`:p8iv՟y36^|x~Cuc.GΓ}<΄)SW \
S%ظq *]vU)88f{%x,	W6mT`<SW/Yg#Z޽+5BP}|uAUe04c|	UaV \
/  8B2mx1> l7ӧO<T̔ *8:
 4w؁ÇWihcQqj2
,Or<1
#d~afv^	صW3NcxGkL/Qf͚ \
.`.\Ps'{U>Ê#j/~'9p<T2G': \
p1^~*>=\.ǺmsoobL#o80/`62NSW \
.&F2~6,qSOc9zh0/a<'ua9nuƂ*Fh*2.^zIXmѣGU8^ڴw^jvKM(!޽bKp;
 aHykyO+4x9i+/8_f\UB0Eg'OUABr,V@ \
Eٵkbj?3E_š^0\q6+;exIWs8S٫hzn3~9?AysW~~]Jϕס \
?i}Y!T76ez|!pwF*5!Y}{\P( \
#mW4Ϝ9S/&֭z|S4ؗ0 \
*$\b%(Xҳ>NϺ_|"DMC^h0itŊj]HLt<@u]xx-p \
8<>1xX7ב/)Em۶M]Z1cƌbQa9b)$mNRV` \
X"Xy+y_4J-0RGuȦ *=Tf8	 v \
1bOݨr	~LwhIq6b5i![4z:GcT \
]SPS_	κB6 q*A7v1_Փ'OzH`xpd_X|ynjN`"PGD \
                Hi֭[Ǘ$g$X 7Swj
-B/ť3]l,9o4z/3ܧ归R2ȹ$SK17>/wNִxh \
0MzÄZ	ŴX24V5OCJiNSߌ1N0HiLڻdі`$44h571F[nE"=m2<%$
  U_j+׽x<AcA#G* \
&b-N:aZ,%H~`R0+p6&ൗ<8P \
k;5Z|қ=zpR'	I!V=.P|!b|	N>]A4ywXT*KL*./m&Duj \
Tya6WѣnV"4S \
UCH%HXϗǛ7=a\Jq;(9Y,EX+:=Ç"'Ū>zN]c"xsk \
x%>,3s#DSe5ṅ=JZ3kOQp"EOuQ*^ \
b		N~A{B]zpgKo^fK./Ojhy@ӻe9l@c^?C̜ԧ>CW߯P
 9'Ae5tV_I@ʲq1OX+]'|G|t, \
h|FOwaQN7h"YVsz'>(T \
E@1L"oR%czx1ƀ*[G,|`9a7@ \
EAp}vR]XlNf<,' Qk~ \
1SLQ-WO@ieAƪO</8ҤI +ͺ(/ٰIc#' \
3@\.@g{1~s"T<+n`uԟb7tTu \
=?]#	zjuq`6ތq6zP> =8 SyE[zXnV7>zC \
ayp>z A'?sq[Peo) X4P	BC{Z,ʲHP \
(b'XnG:n/#	> xN6 KpGjϗ7ڮR_ \ \
Xj2/X/0y{zh%le>y/秡JR<xYtD݄jӔE?Ad`Y \
Tu h7ѸNGBN`])A0lp \
|N:U=֭Qaчhզ5""%~՗h۾*qN  Gz`X$KAÔF \
pߌz'DL_+F01l")^c_U_rWR	AFR7tz(ViOg	R \
n3֞*>`2o{qV֯Xjc"KI,4Te/5/Z{j!M5-)\RuA \
#'HW	oWeXCa?FްK|%}xEO]zاüif\aLwE{1|H豰Z͚7/2g\
 ͙D,VNKAX Pe~#.:օaE_0z١:3n֑jo !t-
z|ļzBUBR;K5Ss07"cu=`/
\F>ݕUUP(SU-IT{KƗޫ|]j@U{r," \
TCU{-у0Û%&⃡Xl:)]ʇF7neb8>tK0agsz5 \
G1Kԭo~m:s=uVRz߿/+6m٬}^vj1 s`Y?%`b \
bU=']@{N*NBAuQ \
1,~\,!7Y$&L8b/0zEjo(,6j[N ub}(`V,\Y \
øxQW_|%aO3<3χמb}-+旽"X`#Ty\/Izsa/cP[kS-Հ*ob0 \
hzE.	vz7b : ((o*~!u̙
zFOJ:+a>v!tZ3nBu	˺6/5Y,R0鵝:b܄qL \
Vb`C_4,1Ь`=G1a[0b.jkas/Ej./ \
EΘQ,Z.|aeLWsNYL|1p<O-=kB/mMh&y<!O_ldW*%(
 2mypfxB~DEL}UXFp"(dM]g`; \
I(ri<N78Uv][6U'ۭq⿫ \
J`|E`!+u{U9>mF꾯<_)`"u>uዘL]U]jHkK \
N3X0Ǹ6&nð]ǧ1\z>88?ρ[4o!HJ&हQj;۸![ϕݚx]*ź>zvJ(Л
 ɟb=P}&Xփ⹰F"]JB=8zu0k;!mLܥ \
J6&8aAxon#Dmð40.0SǥpM8X&qh1<ӌẆ83M \
sB)=P36aW \
Vĥ<46iU[(}Baĸ	`bx6n_,BӣdHoWKlh$|Y}qungzZKDZO-A8\
 <eCNٝ
gzSTuq75[	Aj JkhXFb޼N+fy8KK3
%zzM` Fz,[#1?,0\Gp>lf] cd[	P#	m \
h	SV-2]zJ{lH , mMbvx5Bׇ
e?:}c$4xMڭ_ZLjR*4]F-,.@dzu!"?og^*T	Vc)S,~Yg+=Tzd\lY1h$`ʔʆ*R?c	
 W]ڔbk **g
RZ2ei b)-|uÎ\sM5\Fn?_Jli@L2մf
&  гb]+[*ˡM4}%hVn2L2U'Ta TudzL
	U-
zǎw\u0 L2eT.^'Tun<W
@D	XSl驚2eʔ
-.?)IENDB`



___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@wireshark.org?subject=unsubscribe

[prev in list] [next in list] [prev in thread] [next in thread]

Configure | About | News | Add a list | Sponsored by KoreLogic