Connect. Communicate. Collaborate. Securely.

Home » Kerio User Forums » Kerio Connect » WebMail Send taking 30 seconds (WebMail Send taking 30 seconds)
  •  
Tim Heger

Messages: 4
Karma: 0
Send a private message to this user
After upgrading to 7.4 it takes on average 30 seconds from the time you click send in webmail till the window disappears. This is with a simple test email with no attachments.

Is anyone else seeing this behavior?

Thanks,

Tim
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
OK - since I seem to be the only person with this issue I could use some help in trying to figure out what the problem is.

What debugging do I need to turn on to see what is taking the email to send and the window to close? Maybe if I can track down what is causing the consistent 30 second delay from when I click the Send button in the web client till that window closes I can resolve the issue.

Thanks in advance for your help.

Tim
  •  
b-tom

Messages: 194
Karma: 4
Send a private message to this user
Sounds like a DNS or SSL problem. Try enabling "Network Connections and SSL". Do you use a self-signed certificate?

  •  
iamcj

Messages: 70
Karma: 1
Send a private message to this user
ssl will significantly slow the speed
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
Here's a bit more detail on my set up.

-OSX 10.7 with SSL cert
-Proxy to Kerio
-Kerio has self signed cert
-Prior to upgrading to 7.4 I didn't have any problems how long it took the compose email window to close upon clicking send

I enabled Network Connections and SSL debugging and don't see any delays in any of the logs. Everything starts and completes within a second.

Does anyone know what action closes the compose mail window after clicking send? Is it waiting on getting a specific response from the mail server that is keeping it open?
  •  
iamcj

Messages: 70
Karma: 1
Send a private message to this user
It's your browser taking long time to verify the cert.

I have the experience in an intranet visiting the ssl kerio webmail. Because the IE cannot connect the internet, it takes about 60sec before showing an error.
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
Sounds plausible - how do I fix it?
  •  
iamcj

Messages: 70
Karma: 1
Send a private message to this user
ssl(https) is a more secure way than http, also, slow...

your http speed ok?
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
Very fast.

I am using https on the osx server with an externally signed cert and https on Kerio using the self signed cert.
  •  
iamcj

Messages: 70
Karma: 1
Send a private message to this user
try to use a externally signed cert for test?
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
I'm going to ask this question every day till I get some assistance from Kerio to fix this issue. This behavior didn't manifest itself till after the upgrade to 7.4 so it's not something I did.

Does anyone know what action closes the compose mail window after clicking send? Is it waiting on getting a specific response from the mail server that is keeping it open?

[Updated on: Tue, 17 July 2012 23:37]

  •  
MarkK

Messages: 454
Karma: 46
Send a private message to this user
Can you try using Wireshark or some other packet sniffer on the end machine to see what is being transmitted or retransmitted?
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
Here's the wireshark capture from when I clicked on "Send" till the window disappeared. Thanks for any help you can provide...

No. Time Source Destination Protocol Length Info
1 0.000000000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 Encrypted Alert

Frame 1: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:01.757211000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724641.757211000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x8101 (33025)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x2676 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xb493 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
2 0.920897000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 2: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:02.678108000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724642.678108000 seconds
[Time delta from previous captured frame: 0.920897000 seconds]
[Time delta from previous displayed frame: 0.920897000 seconds]
[Time since reference or first frame: 0.920897000 seconds]
Frame Number: 2
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x5307 (21255)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x5470 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xb16f [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
3 1.927115000 10.0.1.2 xxx.xxx.xxx.xxx TCP 78 56303 > https [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=8 TSval=603265445 TSecr=0 SACK_PERM=1

Frame 3: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.684326000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.684326000 seconds
[Time delta from previous captured frame: 1.006218000 seconds]
[Time delta from previous displayed frame: 1.006218000 seconds]
[Time since reference or first frame: 1.927115000 seconds]
Frame Number: 3
Frame Length: 78 bytes (624 bits)
Capture Length: 78 bytes (624 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 64
Identification: 0x96d9 (38617)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xcbb6 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 0, Len: 0
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 0 (relative sequence number)
Header length: 44 bytes
Flags: 0x002 (SYN)
Window size value: 65535
[Calculated window size: 65535]
Checksum: 0x0f88 [validation disabled]
Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL)

No. Time Source Destination Protocol Length Info
4 1.931788000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 4: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.688999000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.688999000 seconds
[Time delta from previous captured frame: 0.004673000 seconds]
[Time delta from previous displayed frame: 0.004673000 seconds]
[Time since reference or first frame: 1.931788000 seconds]
Frame Number: 4
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x3604 (13828)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x7173 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xacbc [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
5 1.944190000 xxx.xxx.xxx.xxx 10.0.1.2 TCP 78 https > 56303 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460 WS=2 TSval=708286872 TSecr=603265445 SACK_PERM=1

Frame 5: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.701401000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.701401000 seconds
[Time delta from previous captured frame: 0.012402000 seconds]
[Time delta from previous displayed frame: 0.012402000 seconds]
[Time since reference or first frame: 1.944190000 seconds]
Frame Number: 5
Frame Length: 78 bytes (624 bits)
Capture Length: 78 bytes (624 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP SYN/FIN]
[Coloring Rule String: tcp.flags & 0x02 || tcp.flags.fin == 1]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 64
Identification: 0x1509 (5385)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x9287 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 0, Ack: 1, Len: 0
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 0 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
Header length: 44 bytes
Flags: 0x012 (SYN, ACK)
Window size value: 65535
[Calculated window size: 65535]
Checksum: 0xe1f3 [validation disabled]
Options: (24 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), Timestamps, SACK permitted, End of Option List (EOL)
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
6 1.944266000 10.0.1.2 xxx.xxx.xxx.xxx TCP 66 56303 > https [ACK] Seq=1 Ack=1 Win=524280 Len=0 TSval=603265461 TSecr=708286872

Frame 6: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.701477000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.701477000 seconds
[Time delta from previous captured frame: 0.000076000 seconds]
[Time delta from previous displayed frame: 0.000076000 seconds]
[Time since reference or first frame: 1.944266000 seconds]
Frame Number: 6
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0xb38c (45964)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xaf0f [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 1, Ack: 1, Len: 0
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 1 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x21af [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
7 1.944518000 10.0.1.2 xxx.xxx.xxx.xxx TLSv1 477 Client Hello

Frame 7: 477 bytes on wire (3816 bits), 477 bytes captured (3816 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.701729000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.701729000 seconds
[Time delta from previous captured frame: 0.000252000 seconds]
[Time delta from previous displayed frame: 0.000252000 seconds]
[Time since reference or first frame: 1.944518000 seconds]
Frame Number: 7
Frame Length: 477 bytes (3816 bits)
Capture Length: 477 bytes (3816 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 463
Identification: 0xb8fc (47356)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xa804 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 1, Ack: 1, Len: 411
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 1 (relative sequence number)
[Next sequence number: 412 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x3a66 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Handshake Protocol: Client Hello

No. Time Source Destination Protocol Length Info
8 1.963701000 xxx.xxx.xxx.xxx 10.0.1.2 TCP 66 https > 56303 [ACK] Seq=1 Ack=412 Win=66196 Len=0 TSval=708286891 TSecr=603265461

Frame 8: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.720912000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.720912000 seconds
[Time delta from previous captured frame: 0.019183000 seconds]
[Time delta from previous displayed frame: 0.019183000 seconds]
[Time since reference or first frame: 1.963701000 seconds]
Frame Number: 8
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0x6668 (26216)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x4134 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 1, Ack: 412, Len: 0
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 1 (relative sequence number)
Acknowledgment number: 412 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 33098
[Calculated window size: 66196]
[Window size scaling factor: 2]
Checksum: 0x9eb6 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
9 1.966369000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 211 Server Hello, Change Cipher Spec, Encrypted Handshake Message

Frame 9: 211 bytes on wire (1688 bits), 211 bytes captured (1688 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.723580000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.723580000 seconds
[Time delta from previous captured frame: 0.002668000 seconds]
[Time delta from previous displayed frame: 0.002668000 seconds]
[Time since reference or first frame: 1.966369000 seconds]
Frame Number: 9
Frame Length: 211 bytes (1688 bits)
Capture Length: 211 bytes (1688 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 197
Identification: 0x7874 (30836)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x2e97 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 1, Ack: 412, Len: 145
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 1 (relative sequence number)
[Next sequence number: 146 (relative sequence number)]
Acknowledgment number: 412 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 33304
[Calculated window size: 66608]
[Window size scaling factor: 2]
Checksum: 0x73d9 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Handshake Protocol: Server Hello
TLSv1 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
TLSv1 Record Layer: Handshake Protocol: Encrypted Handshake Message

No. Time Source Destination Protocol Length Info
10 1.966441000 10.0.1.2 xxx.xxx.xxx.xxx TCP 66 56303 > https [ACK] Seq=412 Ack=146 Win=524280 Len=0 TSval=603265482 TSecr=708286891

Frame 10: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.723652000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.723652000 seconds
[Time delta from previous captured frame: 0.000072000 seconds]
[Time delta from previous displayed frame: 0.000072000 seconds]
[Time since reference or first frame: 1.966441000 seconds]
Frame Number: 10
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0xef81 (61313)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x731a [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 412, Ack: 146, Len: 0
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 412 (relative sequence number)
Acknowledgment number: 146 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x1f5b [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
11 1.967007000 10.0.1.2 xxx.xxx.xxx.xxx TLSv1 125 Change Cipher Spec, Encrypted Handshake Message

Frame 11: 125 bytes on wire (1000 bits), 125 bytes captured (1000 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.724218000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.724218000 seconds
[Time delta from previous captured frame: 0.000566000 seconds]
[Time delta from previous displayed frame: 0.000566000 seconds]
[Time since reference or first frame: 1.967007000 seconds]
Frame Number: 11
Frame Length: 125 bytes (1000 bits)
Capture Length: 125 bytes (1000 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 111
Identification: 0xf5dd (62941)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x6c83 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 412, Ack: 146, Len: 59
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 412 (relative sequence number)
[Next sequence number: 471 (relative sequence number)]
Acknowledgment number: 146 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x49a9 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
TLSv1 Record Layer: Handshake Protocol: Encrypted Handshake Message

No. Time Source Destination Protocol Length Info
12 1.967601000 10.0.1.2 xxx.xxx.xxx.xxx TLSv1 860 Application Data, Application Data

Frame 12: 860 bytes on wire (6880 bits), 860 bytes captured (6880 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.724812000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.724812000 seconds
[Time delta from previous captured frame: 0.000594000 seconds]
[Time delta from previous displayed frame: 0.000594000 seconds]
[Time since reference or first frame: 1.967601000 seconds]
Frame Number: 12
Frame Length: 860 bytes (6880 bits)
Capture Length: 860 bytes (6880 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 846
Identification: 0x3193 (12691)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x2def [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 471, Ack: 146, Len: 794
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 471 (relative sequence number)
[Next sequence number: 1265 (relative sequence number)]
Acknowledgment number: 146 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0xb664 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http

No. Time Source Destination Protocol Length Info
13 1.988751000 xxx.xxx.xxx.xxx 10.0.1.2 TCP 66 https > 56303 [ACK] Seq=146 Ack=1265 Win=65814 Len=0 TSval=708286914 TSecr=603265483

Frame 13: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.745962000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.745962000 seconds
[Time delta from previous captured frame: 0.021150000 seconds]
[Time delta from previous displayed frame: 0.021150000 seconds]
[Time since reference or first frame: 1.988751000 seconds]
Frame Number: 13
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0x103f (4159)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x975d [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 146, Ack: 1265, Len: 0
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 146 (relative sequence number)
Acknowledgment number: 1265 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 32907
[Calculated window size: 65814]
[Window size scaling factor: 2]
Checksum: 0x9b62 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
14 2.080696000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 930 Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data

Frame 14: 930 bytes on wire (7440 bits), 930 bytes captured (7440 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.837907000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.837907000 seconds
[Time delta from previous captured frame: 0.091945000 seconds]
[Time delta from previous displayed frame: 0.091945000 seconds]
[Time since reference or first frame: 2.080696000 seconds]
Frame Number: 14
Frame Length: 930 bytes (7440 bits)
Capture Length: 930 bytes (7440 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 916
Identification: 0x2106 (8454)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x8336 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 146, Ack: 1265, Len: 864
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 146 (relative sequence number)
[Next sequence number: 1010 (relative sequence number)]
Acknowledgment number: 1265 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 33304
[Calculated window size: 66608]
[Window size scaling factor: 2]
Checksum: 0xdd6d [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http

No. Time Source Destination Protocol Length Info
15 2.080906000 10.0.1.2 xxx.xxx.xxx.xxx TCP 66 56303 > https [ACK] Seq=1265 Ack=1010 Win=524280 Len=0 TSval=603265595 TSecr=708287004

Frame 15: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.838117000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.838117000 seconds
[Time delta from previous captured frame: 0.000210000 seconds]
[Time delta from previous displayed frame: 0.000210000 seconds]
[Time since reference or first frame: 2.080906000 seconds]
Frame Number: 15
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0xe4a5 (58533)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x7df6 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 1265, Ack: 1010, Len: 0
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 1265 (relative sequence number)
Acknowledgment number: 1010 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x17c4 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
16 2.105644000 10.0.1.2 xxx.xxx.xxx.xxx TLSv1 1514 Application Data

Frame 16: 1514 bytes on wire (12112 bits), 1514 bytes captured (12112 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.862855000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.862855000 seconds
[Time delta from previous captured frame: 0.024738000 seconds]
[Time delta from previous displayed frame: 0.024738000 seconds]
[Time since reference or first frame: 2.105644000 seconds]
Frame Number: 16
Frame Length: 1514 bytes (12112 bits)
Capture Length: 1514 bytes (12112 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 1500
Identification: 0x96a9 (38569)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0xc64a [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 1265, Ack: 1010, Len: 1448
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 1265 (relative sequence number)
[Next sequence number: 2713 (relative sequence number)]
Acknowledgment number: 1010 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0xc832 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
TCP segment data (1411 bytes)
Secure Sockets Layer
TLSv1 Record Layer: Application Data Protocol: http

No. Time Source Destination Protocol Length Info
17 2.105714000 10.0.1.2 xxx.xxx.xxx.xxx TCP 1514 [TCP segment of a reassembled PDU]

Frame 17: 1514 bytes on wire (12112 bits), 1514 bytes captured (12112 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.862925000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.862925000 seconds
[Time delta from previous captured frame: 0.000070000 seconds]
[Time delta from previous displayed frame: 0.000070000 seconds]
[Time since reference or first frame: 2.105714000 seconds]
Frame Number: 17
Frame Length: 1514 bytes (12112 bits)
Capture Length: 1514 bytes (12112 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 1500
Identification: 0xc281 (49793)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x9a72 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 2713, Ack: 1010, Len: 1448
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 2713 (relative sequence number)
[Next sequence number: 4161 (relative sequence number)]
Acknowledgment number: 1010 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x390d [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
[Reassembled PDU in frame: 18]
TCP segment data (1448 bytes)

No. Time Source Destination Protocol Length Info
18 2.105732000 10.0.1.2 xxx.xxx.xxx.xxx TLSv1 668 Application Data

Frame 18: 668 bytes on wire (5344 bits), 668 bytes captured (5344 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.862943000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.862943000 seconds
[Time delta from previous captured frame: 0.000018000 seconds]
[Time delta from previous displayed frame: 0.000018000 seconds]
[Time since reference or first frame: 2.105732000 seconds]
Frame Number: 18
Frame Length: 668 bytes (5344 bits)
Capture Length: 668 bytes (5344 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 654
Identification: 0xe9f0 (59888)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x7651 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 4161, Ack: 1010, Len: 602
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 4161 (relative sequence number)
[Next sequence number: 4763 (relative sequence number)]
Acknowledgment number: 1010 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x0a50 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
TCP segment data (602 bytes)
[3 Reassembled TCP Segments (3461 bytes): #16(1411), #17(1448), #18(602)]
Secure Sockets Layer
TLSv1 Record Layer: Application Data Protocol: http

No. Time Source Destination Protocol Length Info
19 2.126716000 xxx.xxx.xxx.xxx 10.0.1.2 TCP 66 https > 56303 [ACK] Seq=1010 Ack=4763 Win=64558 Len=0 TSval=708287051 TSecr=603265619

Frame 19: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:03.883927000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724643.883927000 seconds
[Time delta from previous captured frame: 0.020984000 seconds]
[Time delta from previous displayed frame: 0.020984000 seconds]
[Time since reference or first frame: 2.126716000 seconds]
Frame Number: 19
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0xa472 (42098)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x032a [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 1010, Ack: 4763, Len: 0
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 1010 (relative sequence number)
Acknowledgment number: 4763 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 32279
[Calculated window size: 64558]
[Window size scaling factor: 2]
Checksum: 0x8bbb [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]

No. Time Source Destination Protocol Length Info
20 4.607548000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 20: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:06.364759000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724646.364759000 seconds
[Time delta from previous captured frame: 2.480832000 seconds]
[Time delta from previous displayed frame: 2.480832000 seconds]
[Time since reference or first frame: 4.607548000 seconds]
Frame Number: 20
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x300c (12300)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x776b [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xa29b [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
21 6.757929000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 21: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:08.515140000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724648.515140000 seconds
[Time delta from previous captured frame: 2.150381000 seconds]
[Time delta from previous displayed frame: 2.150381000 seconds]
[Time since reference or first frame: 6.757929000 seconds]
Frame Number: 21
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x8b68 (35688)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x1c0f [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x9a03 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
23 9.215567000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 23: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:10.972778000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724650.972778000 seconds
[Time delta from previous captured frame: 0.308896000 seconds]
[Time delta from previous displayed frame: 2.457638000 seconds]
[Time since reference or first frame: 9.215567000 seconds]
Frame Number: 23
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x6658 (26200)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x411f [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x916c [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
30 11.674001000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 30: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:13.431212000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724653.431212000 seconds
[Time delta from previous captured frame: 0.924538000 seconds]
[Time delta from previous displayed frame: 2.458434000 seconds]
[Time since reference or first frame: 11.674001000 seconds]
Frame Number: 30
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0xf92a (63786)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0xae4c [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x873d [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
33 13.823519000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 33: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:15.580730000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724655.580730000 seconds
[Time delta from previous captured frame: 0.616516000 seconds]
[Time delta from previous displayed frame: 2.149518000 seconds]
[Time since reference or first frame: 13.823519000 seconds]
Frame Number: 33
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0xd875 (55413)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0xcf01 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x7e9c [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
40 16.588259000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 103 [TCP Retransmission] Encrypted Alert

Frame 40: 103 bytes on wire (824 bits), 103 bytes captured (824 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:18.345470000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724658.345470000 seconds
[Time delta from previous captured frame: 2.132761000 seconds]
[Time delta from previous displayed frame: 2.764740000 seconds]
[Time since reference or first frame: 16.588259000 seconds]
Frame Number: 40
Frame Length: 103 bytes (824 bits)
Capture Length: 103 bytes (824 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: Bad TCP]
[Coloring Rule String: tcp.analysis.flags && !tcp.analysis.window_update]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 89
Identification: 0x1d33 (7475)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x8a44 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 1, Ack: 1, Len: 37
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 1 (relative sequence number)
[Next sequence number: 38 (relative sequence number)]
Acknowledgment number: 1 (relative ack number)
Header length: 32 bytes
Flags: 0x019 (FIN, PSH, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0x7471 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Encrypted Alert

No. Time Source Destination Protocol Length Info
41 19.046061000 xxx.xxx.xxx.xxx 10.0.1.2 TCP 54 https > 56295 [RST, ACK] Seq=39 Ack=1 Win=33304 Len=0

Frame 41: 54 bytes on wire (432 bits), 54 bytes captured (432 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:20.803272000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724660.803272000 seconds
[Time delta from previous captured frame: 2.457802000 seconds]
[Time delta from previous displayed frame: 2.457802000 seconds]
[Time since reference or first frame: 19.046061000 seconds]
Frame Number: 41
Frame Length: 54 bytes (432 bits)
Capture Length: 54 bytes (432 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP RST]
[Coloring Rule String: tcp.flags.reset eq 1]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 40
Identification: 0xa747 (42823)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x0061 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56295 (56295), Seq: 39, Ack: 1, Len: 0
Source port: https (443)
Destination port: 56295 (56295)
[Stream index: 0]
Sequence number: 39 (relative sequence number)
Acknowledgment number: 1 (relative ack number)
Header length: 20 bytes
Flags: 0x014 (RST, ACK)
Window size value: 33304
[Calculated window size: 33304]
[Window size scaling factor: -1 (unknown)]
Checksum: 0xedb0 [validation disabled]

No. Time Source Destination Protocol Length Info
43 32.564702000 xxx.xxx.xxx.xxx 10.0.1.2 TLSv1 1394 Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data, Application Data

Frame 43: 1394 bytes on wire (11152 bits), 1394 bytes captured (11152 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:34.321913000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724674.321913000 seconds
[Time delta from previous captured frame: 8.913009000 seconds]
[Time delta from previous displayed frame: 13.518641000 seconds]
[Time since reference or first frame: 32.564702000 seconds]
Frame Number: 43
Frame Length: 1394 bytes (11152 bits)
Capture Length: 1394 bytes (11152 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp:ssl]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_f8:11:a1 (f8:1e:df:f8:11:a1), Dst: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f)
Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: 10.0.1.2 (10.0.1.2)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 1380
Identification: 0x0b58 (2904)
Flags: 0x00
Fragment offset: 0
Time to live: 59
Protocol: TCP (6)
Header checksum: 0x9714 [correct]
Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Destination: 10.0.1.2 (10.0.1.2)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: https (443), Dst Port: 56303 (56303), Seq: 1010, Ack: 4763, Len: 1328
Source port: https (443)
Destination port: 56303 (56303)
[Stream index: 1]
Sequence number: 1010 (relative sequence number)
[Next sequence number: 2338 (relative sequence number)]
Acknowledgment number: 4763 (relative ack number)
Header length: 32 bytes
Flags: 0x018 (PSH, ACK)
Window size value: 33304
[Calculated window size: 66608]
[Window size scaling factor: 2]
Checksum: 0x2ae3 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
Secure Sockets Layer
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http
TLSv1 Record Layer: Application Data Protocol: http

No. Time Source Destination Protocol Length Info
44 32.564883000 10.0.1.2 xxx.xxx.xxx.xxx TCP 66 56303 > https [ACK] Seq=4763 Ack=2338 Win=524280 Len=0 TSval=603296027 TSecr=708317057

Frame 44: 66 bytes on wire (528 bits), 66 bytes captured (528 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Jul 19, 2012 15:04:34.322094000 EDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1342724674.322094000 seconds
[Time delta from previous captured frame: 0.000181000 seconds]
[Time delta from previous displayed frame: 0.000181000 seconds]
[Time since reference or first frame: 32.564883000 seconds]
Frame Number: 44
Frame Length: 66 bytes (528 bits)
Capture Length: 66 bytes (528 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:tcp]
[Coloring Rule Name: TCP]
[Coloring Rule String: tcp]
Ethernet II, Src: Apple_e6:3b:1f (c8:bc:c8:e6:3b:1f), Dst: Apple_f8:11:a1 (f8:1e:df:f8:11:a1)
Internet Protocol Version 4, Src: 10.0.1.2 (10.0.1.2), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
Total Length: 52
Identification: 0x3b95 (15253)
Flags: 0x02 (Don't Fragment)
Fragment offset: 0
Time to live: 64
Protocol: TCP (6)
Header checksum: 0x2707 [correct]
Source: 10.0.1.2 (10.0.1.2)
Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
[Source GeoIP: Unknown]
[Destination GeoIP: Unknown]
Transmission Control Protocol, Src Port: 56303 (56303), Dst Port: https (443), Seq: 4763, Ack: 2338, Len: 0
Source port: 56303 (56303)
Destination port: https (443)
[Stream index: 1]
Sequence number: 4763 (relative sequence number)
Acknowledgment number: 2338 (relative ack number)
Header length: 32 bytes
Flags: 0x010 (ACK)
Window size value: 65535
[Calculated window size: 524280]
[Window size scaling factor: 8]
Checksum: 0x18a4 [validation disabled]
Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
[SEQ/ACK analysis]
  •  
Tim H

Messages: 22
Karma: 0
Send a private message to this user
What event/response from the server closes the compose email window? It seems logical to start there and trace it backwards. Unfortunately I'm not technical enough to accomplish this on my own. Does anyone know?
BastiaanH

Messages: 7
Karma: 1
Send a private message to this user
I'm having the same issue since 7.4.1 too (skipped 7.4). It takes about 8 to 10 seconds to send (using SSL only), but still is significant longer than it used to be in earlier versions, when it used to be just 1 or 2 seconds.

I'm still using the same hardware, ISP and SSL-certificates etcetera, so I'm quite confident that the cause is in Kerio Connect somewhere.
Previous Topic: Perfomance issues
Next Topic: User interaction is required by registration
Goto Forum:
  


Disclaimer:
Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Mon Nov 20 12:52:40 CET 2017

Total time taken to generate the page: 0.00633 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.