Frame 840: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:34.944065549 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034114.944065549 seconds [Time delta from previous captured frame: 0.000127608 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 80.594610588 seconds] Frame Number: 840 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb6fa (46842) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x869a [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 1, Ack: 1, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 1 (relative sequence number) [Next sequence number: 432 (relative sequence number)] Acknowledgment number: 1 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 229 [Calculated window size: 29312] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294908479, TSecr 2758322078 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294908479 Timestamp echo reply: 2758322078 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 1/1] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: dfaa12e328b1094193e29f4282ce4740429558a3 issuerKeyHash: b13ec36903f8bf4701d498261a0802ef63642bc3 serialNumber: 0x0c79a944b08c11952092615fe26b1d83 Frame 852: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:34.976520033 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034114.976520033 seconds [Time delta from previous captured frame: 0.009338680 seconds] [Time delta from previous displayed frame: 0.032454484 seconds] [Time since reference or first frame: 80.627065072 seconds] Frame Number: 852 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb6fc (46844) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8698 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 432, Ack: 797, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 432 (relative sequence number) [Next sequence number: 863 (relative sequence number)] Acknowledgment number: 797 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 241 [Calculated window size: 30848] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294908488, TSecr 2758322084 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294908488 Timestamp echo reply: 2758322084 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 2/2] [Prev request in frame: 840] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 49f4bd8a18bf760698c5de402d683b716ae4e686 issuerKeyHash: 3dd350a5d6a0adeef34a600a65d321d4f8f8d60f serialNumber: 0x0f66013edd026949df19a464e7aad312 Frame 853: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:34.976552187 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034114.976552187 seconds [Time delta from previous captured frame: 0.000032154 seconds] [Time delta from previous displayed frame: 0.000032154 seconds] [Time since reference or first frame: 80.627097226 seconds] Frame Number: 853 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Sent by us (4) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb6fc (46844) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8698 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 432, Ack: 797, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 432 (relative sequence number) [Next sequence number: 863 (relative sequence number)] Acknowledgment number: 797 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 241 [Calculated window size: 30848] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294908488, TSecr 2758322084 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294908488 Timestamp echo reply: 2758322084 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] [TCP Analysis Flags] [Expert Info (Note/Sequence): This frame is a (suspected) fast retransmission] [This frame is a (suspected) fast retransmission] [Severity level: Note] [Group: Sequence] [Expert Info (Note/Sequence): This frame is a (suspected) retransmission] [This frame is a (suspected) retransmission] [Severity level: Note] [Group: Sequence] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 3/3] [Prev request in frame: 852] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 49f4bd8a18bf760698c5de402d683b716ae4e686 issuerKeyHash: 3dd350a5d6a0adeef34a600a65d321d4f8f8d60f serialNumber: 0x0f66013edd026949df19a464e7aad312 Frame 854: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:34.976520033 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034114.976520033 seconds [Time delta from previous captured frame: -0.000032154 seconds] [Time delta from previous displayed frame: -0.000032154 seconds] [Time since reference or first frame: 80.627065072 seconds] Frame Number: 854 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb6fc (46844) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8698 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 432, Ack: 797, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 432 (relative sequence number) [Next sequence number: 863 (relative sequence number)] Acknowledgment number: 797 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 241 [Calculated window size: 30848] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294908488, TSecr 2758322084 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294908488 Timestamp echo reply: 2758322084 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] [TCP Analysis Flags] [Expert Info (Note/Sequence): This frame is a (suspected) fast retransmission] [This frame is a (suspected) fast retransmission] [Severity level: Note] [Group: Sequence] [Expert Info (Note/Sequence): This frame is a (suspected) retransmission] [This frame is a (suspected) retransmission] [Severity level: Note] [Group: Sequence] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 4/4] [Prev request in frame: 853] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 49f4bd8a18bf760698c5de402d683b716ae4e686 issuerKeyHash: 3dd350a5d6a0adeef34a600a65d321d4f8f8d60f serialNumber: 0x0f66013edd026949df19a464e7aad312 Frame 933: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:36.448091377 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034116.448091377 seconds [Time delta from previous captured frame: 0.057695068 seconds] [Time delta from previous displayed frame: 1.471571344 seconds] [Time since reference or first frame: 82.098636416 seconds] Frame Number: 933 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb6fe (46846) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8696 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 863, Ack: 1593, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 863 (relative sequence number) [Next sequence number: 1294 (relative sequence number)] Acknowledgment number: 1593 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 253 [Calculated window size: 32384] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294908855, TSecr 2758322092 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294908855 Timestamp echo reply: 2758322092 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 5/5] [Prev request in frame: 854] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 105fa67a80089db5279f35ce830b43889ea3c70d issuerKeyHash: 0f80611c823161d52f28e78d4638b42ce1c6d9e2 serialNumber: 0x094b3312f2df9617295ff82f467624d0 Frame 1455: 494 bytes on wire (3952 bits), 494 bytes captured (3952 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:37.865462190 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034117.865462190 seconds [Time delta from previous captured frame: 0.005660341 seconds] [Time delta from previous displayed frame: 1.417370813 seconds] [Time since reference or first frame: 83.516007229 seconds] Frame Number: 1455 Frame Length: 494 bytes (3952 bits) Capture Length: 494 bytes (3952 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 23.37.43.27 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 478 Identification: 0x6d2d (27949) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0xc802 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 23.37.43.27 Transmission Control Protocol, Src Port: 44662 (44662), Dst Port: http (80), Seq: 1, Ack: 1, Len: 426 Source Port: 44662 (44662) Destination Port: http (80) [Stream index: 6] [TCP Segment Len: 426] Sequence number: 1 (relative sequence number) [Next sequence number: 427 (relative sequence number)] Acknowledgment number: 1 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 229 [Calculated window size: 29312] [Window size scaling factor: 128] Checksum: 0x05bb [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909210, TSecr 1519333597 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909210 Timestamp echo reply: 1519333597 [SEQ/ACK analysis] [iRTT: 0.024182620 seconds] [Bytes in flight: 426] [Bytes sent since last PSH flag: 426] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ss.symcd.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ss.symcd.com/] [HTTP request 1/1] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: d1b1648b8c9f0dd16ba38acd2b5017d5f9cfc064 issuerKeyHash: 5f60cf619055df8443148a602ab2f57af44318ef serialNumber: 0x2cce9534e5b419729799389c244c63d7 Frame 2451: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:38.646393516 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034118.646393516 seconds [Time delta from previous captured frame: 0.016595022 seconds] [Time delta from previous displayed frame: 0.780931326 seconds] [Time since reference or first frame: 84.296938555 seconds] Frame Number: 2451 Frame Length: 497 bytes (3976 bits) Capture Length: 497 bytes (3976 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 216.58.214.46 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 481 Identification: 0xdc3a (56378) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0xecc8 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 216.58.214.46 Transmission Control Protocol, Src Port: 56787 (56787), Dst Port: http (80), Seq: 1, Ack: 1, Len: 429 Source Port: 56787 (56787) Destination Port: http (80) [Stream index: 11] [TCP Segment Len: 429] Sequence number: 1 (relative sequence number) [Next sequence number: 430 (relative sequence number)] Acknowledgment number: 1 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 229 [Calculated window size: 29312] [Window size scaling factor: 128] Checksum: 0x71e7 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909405, TSecr 662428132 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909405 Timestamp echo reply: 662428132 [SEQ/ACK analysis] [iRTT: 0.028895292 seconds] [Bytes in flight: 429] [Bytes sent since last PSH flag: 429] Hypertext Transfer Protocol POST /ocsp HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST /ocsp HTTP/1.1\r\n] [POST /ocsp HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: /ocsp Request Version: HTTP/1.1 Host: clients1.google.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 75\r\n [Content length: 75] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://clients1.google.com/ocsp] [HTTP request 1/1] File Data: 75 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: f2e06af9858a1d8d709b4919237aa9b51a287e64 issuerKeyHash: 4add06161bbcf668b576f581b6bb621aba5a812f serialNumber: 7092905809424204954 Frame 2475: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:38.738501726 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034118.738501726 seconds [Time delta from previous captured frame: 0.012582312 seconds] [Time delta from previous displayed frame: 0.092108210 seconds] [Time since reference or first frame: 84.389046765 seconds] Frame Number: 2475 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb700 (46848) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8694 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 1294, Ack: 2389, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 1294 (relative sequence number) [Next sequence number: 1725 (relative sequence number)] Acknowledgment number: 2389 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 266 [Calculated window size: 34048] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909425, TSecr 2758322460 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909425 Timestamp echo reply: 2758322460 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 6/6] [Prev request in frame: 933] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: cf26f518fac97e8f8cb342e01c2f6a109e8e5f0a issuerKeyHash: 5168ff90af0207753cccd9656462a212b859723b serialNumber: 0x068f3eeb2ee35e0a8cf8e3e8f4324bda Frame 3114: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:39.841242886 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034119.841242886 seconds [Time delta from previous captured frame: 0.019250513 seconds] [Time delta from previous displayed frame: 1.102741160 seconds] [Time since reference or first frame: 85.491787925 seconds] Frame Number: 3114 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb702 (46850) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8692 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 1725, Ack: 3185, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 1725 (relative sequence number) [Next sequence number: 2156 (relative sequence number)] Acknowledgment number: 3185 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 278 [Calculated window size: 35584] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909701, TSecr 2758323033 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909701 Timestamp echo reply: 2758323033 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 7/7] [Prev request in frame: 2475] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 105fa67a80089db5279f35ce830b43889ea3c70d issuerKeyHash: 0f80611c823161d52f28e78d4638b42ce1c6d9e2 serialNumber: 0x0fef62075d715dc5e1d8bd03775c9686 Frame 3711: 497 bytes on wire (3976 bits), 497 bytes captured (3976 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:40.290833895 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034120.290833895 seconds [Time delta from previous captured frame: 0.001081573 seconds] [Time delta from previous displayed frame: 0.449591009 seconds] [Time since reference or first frame: 85.941378934 seconds] Frame Number: 3711 Frame Length: 497 bytes (3976 bits) Capture Length: 497 bytes (3976 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 216.58.214.46 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 481 Identification: 0xdc3c (56380) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0xecc6 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 216.58.214.46 Transmission Control Protocol, Src Port: 56787 (56787), Dst Port: http (80), Seq: 430, Ack: 747, Len: 429 Source Port: 56787 (56787) Destination Port: http (80) [Stream index: 11] [TCP Segment Len: 429] Sequence number: 430 (relative sequence number) [Next sequence number: 859 (relative sequence number)] Acknowledgment number: 747 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 240 [Calculated window size: 30720] [Window size scaling factor: 128] Checksum: 0x71e7 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909815, TSecr 662428185 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909815 Timestamp echo reply: 662428185 [SEQ/ACK analysis] [iRTT: 0.028895292 seconds] [Bytes in flight: 429] [Bytes sent since last PSH flag: 429] Hypertext Transfer Protocol POST /ocsp HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST /ocsp HTTP/1.1\r\n] [POST /ocsp HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: /ocsp Request Version: HTTP/1.1 Host: clients1.google.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 75\r\n [Content length: 75] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://clients1.google.com/ocsp] [HTTP request 2/2] [Prev request in frame: 2451] File Data: 75 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: f2e06af9858a1d8d709b4919237aa9b51a287e64 issuerKeyHash: 4add06161bbcf668b576f581b6bb621aba5a812f serialNumber: 9180354292432689776 Frame 3834: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:40.424157538 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034120.424157538 seconds [Time delta from previous captured frame: 0.000812088 seconds] [Time delta from previous displayed frame: 0.133323643 seconds] [Time since reference or first frame: 86.074702577 seconds] Frame Number: 3834 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb704 (46852) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x8690 [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 2156, Ack: 3981, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 2156 (relative sequence number) [Next sequence number: 2587 (relative sequence number)] Acknowledgment number: 3981 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 291 [Calculated window size: 37248] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294909849, TSecr 2758323308 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294909849 Timestamp echo reply: 2758323308 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 8/8] [Prev request in frame: 3114] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 105fa67a80089db5279f35ce830b43889ea3c70d issuerKeyHash: 0f80611c823161d52f28e78d4638b42ce1c6d9e2 serialNumber: 0x053595ddc488e3bd2185316c9e024a57 Frame 5757: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:42.204836125 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034122.204836125 seconds [Time delta from previous captured frame: 0.002648436 seconds] [Time delta from previous displayed frame: 1.780678587 seconds] [Time since reference or first frame: 87.855381164 seconds] Frame Number: 5757 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb706 (46854) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x868e [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 2587, Ack: 4777, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 2587 (relative sequence number) [Next sequence number: 3018 (relative sequence number)] Acknowledgment number: 4777 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 303 [Calculated window size: 38784] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294910295, TSecr 2758323454 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294910295 Timestamp echo reply: 2758323454 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 9/9] [Prev request in frame: 3834] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 105fa67a80089db5279f35ce830b43889ea3c70d issuerKeyHash: 0f80611c823161d52f28e78d4638b42ce1c6d9e2 serialNumber: 0x0e8fb3a3be3a42035152afc44614c863 Frame 5844: 499 bytes on wire (3992 bits), 499 bytes captured (3992 bits) on interface 0 Interface id: 0 (any) Encapsulation type: Linux cooked-mode capture (25) Arrival Time: Feb 25, 2017 15:48:42.835596480 CET [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1488034122.835596480 seconds [Time delta from previous captured frame: 0.000799235 seconds] [Time delta from previous displayed frame: 0.630760355 seconds] [Time since reference or first frame: 88.486141519 seconds] Frame Number: 5844 Frame Length: 499 bytes (3992 bits) Capture Length: 499 bytes (3992 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: sll:ethertype:ip:tcp:http:ocsp:x509af] Linux cooked capture Packet type: Unicast to another host (3) Link-layer address type: 1 Link-layer address length: 6 Source: RealtekU_12:34:56 (52:54:00:12:34:56) Protocol: IPv4 (0x0800) Internet Protocol Version 4, Src: 192.168.1.2, Dst: 93.184.220.29 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 483 Identification: 0xb708 (46856) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (6) Header checksum: 0x868c [validation disabled] [Header checksum status: Unverified] Source: 192.168.1.2 Destination: 93.184.220.29 Transmission Control Protocol, Src Port: 43030 (43030), Dst Port: http (80), Seq: 3018, Ack: 5573, Len: 431 Source Port: 43030 (43030) Destination Port: http (80) [Stream index: 1] [TCP Segment Len: 431] Sequence number: 3018 (relative sequence number) [Next sequence number: 3449 (relative sequence number)] Acknowledgment number: 5573 (relative ack number) Header Length: 32 bytes Flags: 0x018 (PSH, ACK) 000. .... .... = Reserved: Not set ...0 .... .... = Nonce: Not set .... 0... .... = Congestion Window Reduced (CWR): Not set .... .0.. .... = ECN-Echo: Not set .... ..0. .... = Urgent: Not set .... ...1 .... = Acknowledgment: Set .... .... 1... = Push: Set .... .... .0.. = Reset: Not set .... .... ..0. = Syn: Not set .... .... ...0 = Fin: Not set [TCP Flags: ·······AP···] Window size value: 316 [Calculated window size: 40448] [Window size scaling factor: 128] Checksum: 0xfd55 [unverified] [Checksum Status: Unverified] Urgent pointer: 0 Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) No-Operation (NOP) Type: 1 0... .... = Copy on fragmentation: No .00. .... = Class: Control (0) ...0 0001 = Number: No-Operation (NOP) (1) Timestamps: TSval 4294910452, TSecr 2758323899 Kind: Time Stamp Option (8) Length: 10 Timestamp value: 4294910452 Timestamp echo reply: 2758323899 [SEQ/ACK analysis] [iRTT: 0.022817899 seconds] [Bytes in flight: 431] [Bytes sent since last PSH flag: 431] Hypertext Transfer Protocol POST / HTTP/1.1\r\n [Expert Info (Chat/Sequence): POST / HTTP/1.1\r\n] [POST / HTTP/1.1\r\n] [Severity level: Chat] [Group: Sequence] Request Method: POST Request URI: / Request Version: HTTP/1.1 Host: ocsp.digicert.com\r\n User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n Accept-Language: en-US,en;q=0.5\r\n Accept-Encoding: gzip, deflate\r\n Content-Length: 83\r\n [Content length: 83] Content-Type: application/ocsp-request\r\n Connection: keep-alive\r\n \r\n [Full request URI: http://ocsp.digicert.com/] [HTTP request 10/10] [Prev request in frame: 5757] File Data: 83 bytes Online Certificate Status Protocol tbsRequest requestList: 1 item Request reqCert hashAlgorithm (SHA-1) Algorithm Id: 1.3.14.3.2.26 (SHA-1) issuerNameHash: 49f4bd8a18bf760698c5de402d683b716ae4e686 issuerKeyHash: 3dd350a5d6a0adeef34a600a65d321d4f8f8d60f serialNumber: 0x0d28aa10b39842a135e8a10ea7c265ae