No. Time Source Destination Protocol Info 28 12.417144 192.168.1.34 195.85.225.145 Tor Tor Cell: (Negotiate proto version) Frame 28 (140 bytes on wire, 140 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.529931000 [Time delta from previous captured frame: 0.000341000 seconds] [Time delta from previous displayed frame: 12.417144000 seconds] [Time since reference or first frame: 12.417144000 seconds] Frame Number: 28 Frame Length: 140 bytes Capture Length: 140 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 195.85.225.145 (195.85.225.145) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 126 Identification: 0xbe10 (48656) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x15b8 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 195.85.225.145 (195.85.225.145) Transmission Control Protocol, Src Port: 44458 (44458), Dst Port: 9001 (9001), Seq: 1757, Ack: 2575, Len: 74 Source port: 44458 (44458) Destination port: 9001 (9001) [Stream index: 0] Sequence number: 1757 (relative sequence number) [Next sequence number: 1831 (relative sequence number)] Acknowledgement number: 2575 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10624 (scaled) Checksum: 0x6722 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793810, TSecr 796829859 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 27] [The RTT to ACK the segment was: 0.000341000 seconds] [Number of bytes in flight: 74] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 48AAD72FF6C65F3E722A7148D4054E315846B3DBCF13FAFE... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 7246B63FAB7B5D0E601D6478B60DC66B1B3B5A6387B1A419... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 No. Time Source Destination Protocol Info 34 12.487428 195.85.225.145 192.168.1.34 Tor Tor Cell: (Negotiate proto version), Tor Cell: (Time and address info) Frame 34 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.600215000 [Time delta from previous captured frame: 0.003876000 seconds] [Time delta from previous displayed frame: 0.070284000 seconds] [Time since reference or first frame: 12.487428000 seconds] Frame Number: 34 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xb51d35ec [correct] Internet Protocol, Src: 195.85.225.145 (195.85.225.145), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xca09 (51721) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: TCP (0x06) Header checksum: 0x0fbf [correct] [Good: True] [Bad : False] Source: 195.85.225.145 (195.85.225.145) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 44458 (44458), Seq: 2575, Ack: 1831, Len: 586 Source port: 9001 (9001) Destination port: 44458 (44458) [Stream index: 0] Sequence number: 2575 (relative sequence number) [Next sequence number: 3161 (relative sequence number)] Acknowledgement number: 1831 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 9583 Checksum: 0x4c10 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 796829866, TSecr 3793810 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 28] [The RTT to ACK the segment was: 0.070284000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: B5D3A0E13907075CDEDB64B43439266C63D9AF74D67FD576... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 19A93EF6CBADD23E641387695E507003BD9D0B8EA6CA1917... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081678 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 78.16.255.227 (78.16.255.227) Number of Addresses: 1 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 This OR's Address: 195.85.225.145 (195.85.225.145) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 36 12.497797 192.168.1.34 195.85.225.145 Tor Tor Cell: (Time and address info) Frame 36 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.610584000 [Time delta from previous captured frame: 0.000181000 seconds] [Time delta from previous displayed frame: 0.010369000 seconds] [Time since reference or first frame: 12.497797000 seconds] Frame Number: 36 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 195.85.225.145 (195.85.225.145) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xbe11 (48657) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x13b7 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 195.85.225.145 (195.85.225.145) Transmission Control Protocol, Src Port: 44458 (44458), Dst Port: 9001 (9001), Seq: 1831, Ack: 3161, Len: 586 Source port: 44458 (44458) Destination port: 9001 (9001) [Stream index: 0] Sequence number: 1831 (relative sequence number) [Next sequence number: 2417 (relative sequence number)] Acknowledgement number: 3161 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x6922 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793830, TSecr 796829866 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 34] [The RTT to ACK the segment was: 0.010369000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: BC322B988CEDE35DD6B919A881C7B2D4A0BB50BA087CA70B... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 21263E9C4E53596F387B061F3E322381749307554205A5ED... Tor Protocol CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081678 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 195.85.225.145 (195.85.225.145) Number of Addresses: 0 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 39 12.599721 192.168.1.34 91.208.34.1 Tor Tor Cell: (Negotiate proto version) Frame 39 (140 bytes on wire, 140 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.712508000 [Time delta from previous captured frame: 0.000352000 seconds] [Time delta from previous displayed frame: 0.101924000 seconds] [Time since reference or first frame: 12.599721000 seconds] Frame Number: 39 Frame Length: 140 bytes Capture Length: 140 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 126 Identification: 0x54dc (21724) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa602 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 1757, Ack: 2603, Len: 74 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 1757 (relative sequence number) [Next sequence number: 1831 (relative sequence number)] Acknowledgement number: 2603 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10624 (scaled) Checksum: 0x400c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793856, TSecr 936171687 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 38] [The RTT to ACK the segment was: 0.000352000 seconds] [Number of bytes in flight: 74] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4D81D44CD472AA823B75C142C040572DED403B633AF53B4F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: A186D27B48D3F0FBB511643E01A985AA67A17728BDA96364... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 No. Time Source Destination Protocol Info 41 12.610283 192.168.1.34 195.85.225.145 Tor Tor Cell: (Create a circuit, no PK) Frame 41 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.723070000 [Time delta from previous captured frame: 0.000020000 seconds] [Time delta from previous displayed frame: 0.010562000 seconds] [Time since reference or first frame: 12.610283000 seconds] Frame Number: 41 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 195.85.225.145 (195.85.225.145) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xbe12 (48658) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x13b6 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 195.85.225.145 (195.85.225.145) Transmission Control Protocol, Src Port: 44458 (44458), Dst Port: 9001 (9001), Seq: 2417, Ack: 3161, Len: 586 Source port: 44458 (44458) Destination port: 9001 (9001) [Stream index: 0] Sequence number: 2417 (relative sequence number) [Next sequence number: 3003 (relative sequence number)] Acknowledgement number: 3161 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x6922 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793858, TSecr 796829879 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 40] [The RTT to ACK the segment was: 0.000020000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 8EF878A820FC1474D5A5C01B3222F68E251E8D76211A6E69... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 5873102F723860CC06455D742781A6F545FFA9338B51E0E1... Tor Protocol CircID: 12511 Command: (Create a circuit, no PK) (0x05) Payload: Key Material (X): 8D22DA60CCD537E8F9B7AAA4498F1CECC318AF94 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 44 12.721724 195.85.225.145 192.168.1.34 Tor Tor Cell: (Circuit created, no PK) Frame 44 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.834511000 [Time delta from previous captured frame: 0.033547000 seconds] [Time delta from previous displayed frame: 0.111441000 seconds] [Time since reference or first frame: 12.721724000 seconds] Frame Number: 44 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xf2698ba9 [correct] Internet Protocol, Src: 195.85.225.145 (195.85.225.145), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xca0c (51724) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: TCP (0x06) Header checksum: 0x0fbc [correct] [Good: True] [Bad : False] Source: 195.85.225.145 (195.85.225.145) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 44458 (44458), Seq: 3161, Ack: 3003, Len: 586 Source port: 9001 (9001) Destination port: 44458 (44458) [Stream index: 0] Sequence number: 3161 (relative sequence number) [Next sequence number: 3747 (relative sequence number)] Acknowledgement number: 3003 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13478 Checksum: 0xa30f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 796829890, TSecr 3793858 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 274714AA0F2BEA34E9784DBB64DE64CEEBC9EF724F74DE5E... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 8A8AA23D1E72304C9224CD36AA6D156978C145400B3B4350... Tor Protocol CircID: 12511 Command: (Circuit created, no PK) (0x06) Payload: Key Material (Y): 4B0EC370127A9ECF2842CA6F22F15946C88219D8 Derivative key data: 62F5D5EEC7086CF303B4F0ACD1C377284967F9D8 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 45 12.722035 192.168.1.34 195.85.225.145 Tor Tor Cell: (End-to-end data) Frame 45 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.834822000 [Time delta from previous captured frame: 0.000311000 seconds] [Time delta from previous displayed frame: 0.000311000 seconds] [Time since reference or first frame: 12.722035000 seconds] Frame Number: 45 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 195.85.225.145 (195.85.225.145) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xbe13 (48659) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x13b5 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 195.85.225.145 (195.85.225.145) Transmission Control Protocol, Src Port: 44458 (44458), Dst Port: 9001 (9001), Seq: 3003, Ack: 3747, Len: 586 Source port: 44458 (44458) Destination port: 9001 (9001) [Stream index: 0] Sequence number: 3003 (relative sequence number) [Next sequence number: 3589 (relative sequence number)] Acknowledgement number: 3747 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14592 (scaled) Checksum: 0x6922 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793886, TSecr 796829890 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 44] [The RTT to ACK the segment was: 0.000311000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 71D2E42976969F6918DCCA74C9B6BFD07439B64A7CD3CC51... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 1AA279328E7B0834C02FE729511013E4D33C2F4622B244D4... Tor Protocol CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_BEGIN_DIR (0x0d) Recognized: 0000 Stream ID: 39358 Digest: CF11D681 Relay Data Length: 0 Relay Data: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 47 12.810435 195.85.225.145 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 47 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.923222000 [Time delta from previous captured frame: 0.033808000 seconds] [Time delta from previous displayed frame: 0.088400000 seconds] [Time since reference or first frame: 12.810435000 seconds] Frame Number: 47 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xdb1cfbdf [correct] Internet Protocol, Src: 195.85.225.145 (195.85.225.145), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xca0e (51726) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: TCP (0x06) Header checksum: 0x0fba [correct] [Good: True] [Bad : False] Source: 195.85.225.145 (195.85.225.145) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 44458 (44458), Seq: 3747, Ack: 3589, Len: 586 Source port: 9001 (9001) Destination port: 44458 (44458) [Stream index: 0] Sequence number: 3747 (relative sequence number) [Next sequence number: 4333 (relative sequence number)] Acknowledgement number: 3589 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14650 Checksum: 0xb6ec [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 796829899, TSecr 3793886 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 2C1ADDDCEEB57BA2655C6646B43D185DC2929C50EAD03D53... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: CBD6524629015338F6F39EBD8413D0B2BC7377F1718E2561... Tor Protocol CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_CONNECTED (0x04) Recognized: 0000 Stream ID: 39358 Digest: DE6EB5DE Relay Data Length: 0 Relay Connected IP: 0.0.0.0 (0.0.0.0) Relay Connected TTL: 0 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 48 12.810871 192.168.1.34 195.85.225.145 HTTP GET /tor/server/d/C68987EC6B966EC4A8DC7528C7CE3D8FEE15DE69.z HTTP/1.0 Frame 48 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:58.923658000 [Time delta from previous captured frame: 0.000436000 seconds] [Time delta from previous displayed frame: 0.000436000 seconds] [Time since reference or first frame: 12.810871000 seconds] Frame Number: 48 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 195.85.225.145 (195.85.225.145) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xbe14 (48660) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x13b4 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 195.85.225.145 (195.85.225.145) Transmission Control Protocol, Src Port: 44458 (44458), Dst Port: 9001 (9001), Seq: 3589, Ack: 4333, Len: 586 Source port: 44458 (44458) Destination port: 9001 (9001) [Stream index: 0] Sequence number: 3589 (relative sequence number) [Next sequence number: 4175 (relative sequence number)] Acknowledgement number: 4333 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15744 (scaled) Checksum: 0x6922 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3793908, TSecr 796829899 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 47] [The RTT to ACK the segment was: 0.000436000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: CE8408C0B86B8D281754EC5DBCEAC188F7A0DBE44D8C779B... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 89E5889F4A27D076922A6810E45A96B803C8B7B6DA983C02... Tor Protocol CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 39358 Digest: 4511C1C0 Relay Data Length: 150 Hypertext Transfer Protocol GET /tor/server/d/C68987EC6B966EC4A8DC7528C7CE3D8FEE15DE69.z HTTP/1.0\r\n Request Method: GET Request URI: /tor/server/d/C68987EC6B966EC4A8DC7528C7CE3D8FEE15DE69.z Request Version: HTTP/1.0 Host: 195.85.225.145:9001\r\n If-Modified-Since: Sun, 04 Jan 2009 14:03:00 GMT\r\n \r\n No. Time Source Destination Protocol Info 50 13.001657 195.85.225.145 192.168.1.34 HTTP HTTP/1.0 200 OK (application/octet-stream) Frame 50 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.114444000 [Time delta from previous captured frame: 0.135588000 seconds] [Time delta from previous displayed frame: 0.190786000 seconds] [Time since reference or first frame: 13.001657000 seconds] Frame Number: 50 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http:media] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x6be5ce9c [correct] Internet Protocol, Src: 195.85.225.145 (195.85.225.145), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xca10 (51728) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: TCP (0x06) Header checksum: 0x0fb8 [correct] [Good: True] [Bad : False] Source: 195.85.225.145 (195.85.225.145) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 44458 (44458), Seq: 4333, Ack: 4175, Len: 586 Source port: 9001 (9001) Destination port: 44458 (44458) [Stream index: 0] Sequence number: 4333 (relative sequence number) [Next sequence number: 4919 (relative sequence number)] Acknowledgement number: 4175 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15822 Checksum: 0xd863 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 796829918, TSecr 3793908 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 7EBFB88DEC615078B8A1A7490F526287189C2BB16FDC2064... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: ADD95B41E80424079D8741FF07A4868A3322B5988DEDFC3A... Tor Protocol CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 39358 Digest: 82CF88F1 Relay Data Length: 498 Hypertext Transfer Protocol HTTP/1.0 200 OK\r\n Request Version: HTTP/1.0 Response Code: 200 Date: Sun, 04 Jan 2009 15:07:58 GMT\r\n Content-Type: application/octet-stream\r\n X-Your-Address-Is: 78.16.255.227\r\n Content-Encoding: deflate\r\n Expires: Tue, 06 Jan 2009 15:07:58 GMT\r\n \r\n Content-encoded entity body (deflate): 301 bytes -> 320 bytes Media Type Media Type: application/octet-stream (320 bytes) No. Time Source Destination Protocol Info 54 13.068645 195.85.225.145 192.168.1.34 Tor Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data) Frame 54 (804 bytes on wire, 804 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.181432000 [Time delta from previous captured frame: 0.039207000 seconds] [Time delta from previous displayed frame: 0.066988000 seconds] [Time since reference or first frame: 13.068645000 seconds] Frame Number: 54 Frame Length: 804 bytes Capture Length: 804 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:data:data] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x51918976 [correct] Internet Protocol, Src: 195.85.225.145 (195.85.225.145), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 786 Identification: 0xca12 (51730) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: TCP (0x06) Header checksum: 0x0f22 [correct] [Good: True] [Bad : False] Source: 195.85.225.145 (195.85.225.145) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 44458 (44458), Seq: 6307, Ack: 4175, Len: 734 Source port: 9001 (9001) Destination port: 44458 (44458) [Stream index: 0] Sequence number: 6307 (relative sequence number) [Next sequence number: 7041 (relative sequence number)] Acknowledgement number: 4175 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15822 Checksum: 0x6834 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 796829924, TSecr 3793961 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 52] [The RTT to ACK the segment was: 0.045779000 seconds] [Number of bytes in flight: 734] TCP segment data (734 bytes) [Reassembled TCP Segments (2085 bytes): #51(1351), #54(734)] [Frame: 51, payload: 0-1350 (1351 bytes)] [Frame: 54, payload: 1351-2084 (734 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 2080 Encrypted Application Data: C5F0AE0DC516F779A586DA006E3693122FE4431E689DD814... Tor Protocol CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 39358 Digest: 36E54AE5 Relay Data Length: 498 Data (498 bytes) 0000 7b 8e 47 95 81 1b 2e a6 e9 e7 b4 dc 76 d9 84 d5 {.G.........v... 0010 fc c6 28 2f 5a f1 f1 54 9b d5 b7 af fb c7 4d 73 ..(/Z..T......Ms 0020 50 ca f1 57 b1 1a dc 3c b8 bc 35 fc 90 c7 33 eb P..W...<..5...3. 0030 4c da 9d b2 c9 36 e5 22 ab 34 9b f9 f6 3e 5d ca L....6.".4...>]. 0040 bc bd 9c da f6 97 12 8b 1f 23 3b 1e 66 87 87 ef .........#;.f... 0050 4f fd d2 c5 a7 cb d7 b9 31 fa 21 56 c2 8c 75 5f O.......1.!V..u_ 0060 ad 3a cd 9b ac b6 e9 d7 6b b5 f8 b7 2b ba 78 d0 .:......k...+.x. 0070 fc 8f d8 8e bb cd 01 6c ff 5f 34 f4 ca 74 55 34 .......l._4..tU4 0080 9e 27 5f 7b b6 ee 26 dd 56 67 5e f0 d3 64 30 3c .'_{..&.Vg^..d0< 0090 1d d2 cb fe 3d 3e 30 3f f0 8d da 67 9f bd bc b4 ....=>0?...g.... 00a0 f3 f7 45 6f d6 1d 3f dd a4 ae 52 1f d4 2f 49 6b ..Eo..?...R../Ik 00b0 e7 0b 9f 29 b9 56 83 dd e4 f5 c5 f4 f4 4b 72 b0 ...).V.......Kr. 00c0 af 96 f3 f7 f8 46 0f df 36 ee e6 dc 3b bf 6d 1a .....F..6...;.m. 00d0 5d dd 31 dd 19 b7 cb d7 e6 72 f5 11 27 a7 4d e5 ].1......r..'.M. 00e0 fb d7 cf f1 3c 3f fa cb e1 71 6b 67 8d 91 cd 7a .........g.r... 0150 54 ca 21 9d 54 89 b6 a0 ec 48 29 34 5a 93 cc f9 T.!.T....H)4Z... 0160 d0 1a 33 8e d6 49 86 38 80 53 64 81 f9 c0 be e4 ..3..I.8.Sd..... 0170 f0 3f ee 7b a9 21 0f bc ac 48 46 01 51 a5 08 16 .?.{.!...HF.Q... 0180 21 a1 40 96 53 a4 b7 f4 2c 38 85 73 74 4a 94 58 !.@.S...,8.stJ.X 0190 65 28 c3 9e 8e 03 46 46 25 be e8 c8 08 01 c5 d1 e(....FF%....... 01a0 40 4c 3b af 15 1d 49 e4 62 92 00 b0 c9 a8 e0 c3 @L;...I.b....... 01b0 33 4d d5 14 82 c3 29 67 3a d8 0b fc 68 ca a8 c5 3M....)g:...h... 01c0 72 4c 23 92 c1 d2 bf 06 84 9f 3a 02 82 90 54 ef rL#.......:...T. 01d0 50 dc 53 15 e4 8f b0 01 bf 20 43 69 41 d0 b1 9b P.S...... CiA... 01e0 23 3b 31 e4 12 1e 26 2e 11 53 ea 19 72 21 30 e0 #;1...&..S..r!0. 01f0 d2 d1 .. Data: BDD2A0C4A0A5AAA5422807BE158811E896F6E7A0D71B1F88... CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 39358 Digest: C95EA2A0 Relay Data Length: 351 Data (351 bytes) 0000 b1 82 79 16 48 e9 39 c2 43 f2 29 7f c5 86 59 01 ..y.H.9.C.)...Y. 0010 0e be 2a 38 cd d3 30 69 70 2e 33 68 ff 6a c7 d0 ..*8..0ip.3h.j.. 0020 89 44 1c c3 51 2c 90 6b ca 84 77 22 b0 2c 39 92 .D..Q,.k..w".,9. 0030 4b 72 09 ef af bc 41 c6 6b 3e fe 79 76 e1 f4 c4 Kr....A.k>.yv... 0040 99 cb 48 4f 43 cc 80 07 ca 74 95 e2 49 b5 2c 64 ..HOC....t..I.,d 0050 0b b5 40 cc f5 3c 35 d6 2a 32 1f 1c 66 ae 92 43 ..@..<5.*2..f..C 0060 3f 4d 61 07 ac 10 49 8e 43 45 5d 9d ce ae 88 38 ?Ma...I.CE]....8 0070 bd 08 b0 6d 65 99 1e 8a f9 b2 08 1f 21 cd fb 18 ...me.......!... 0080 1f 36 22 6e b4 a2 ce 68 12 3d 97 59 86 cf ab e8 .6"n...h.=.Y.... 0090 ef c7 eb c5 3f 8a bc 3c 17 e9 e1 6e 99 ee 7f af ....?..<...n.... 00a0 e4 c9 5b 82 75 bf 7e fb b5 92 87 cf b1 5b 7a 6b ..[.u.~......[zk 00b0 cf 8b 32 4f fe fc ce 7e ee b4 07 b5 c9 74 1c 5f ..2O...~.....t._ 00c0 5f 69 d3 e6 a2 b7 38 77 92 63 f9 7e 5f 9b ff 98 _i....8w.c.~_... 00d0 cb 87 d1 e3 aa eb fa fd a7 24 3b 0c 17 3f d8 74 .........$;..?.t 00e0 20 eb eb e2 e5 cc ca 63 73 db 29 9e 3b af af db ......cs.).;... 00f0 87 f3 99 37 3f 7a 03 2b a7 95 75 d1 8c d7 6d 3d ...7?z.+..u...m= 0100 1e 3d bd f8 fd bc 90 e5 cd 79 39 5f 8f d3 69 7d .=.......y9_..i} 0110 b8 1b c6 2d 79 11 ad d3 39 4d 8b ef 3d 35 fb d9 ...-y...9M..=5.. 0120 c9 b2 c9 e5 be 5b c6 ee 73 f7 96 ac 4f 69 eb b9 .....[..s...Oi.. 0130 b2 ca 7e ee b3 56 2d f3 ba 33 3b 6e a7 a2 7e ff ..~..V-..3;n..~. 0140 e8 67 ad 62 77 5e 17 a2 f3 99 de eb 07 f7 7e 2a .g.bw^........~* 0150 0f b3 c3 eb 9f 5f cf 7f 81 f1 07 67 4f 89 f9 ....._.....gO.. Data: B182791648E939C243F2297FC58659010EBE2A38CDD33069... CircID: 12511 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 39358 Digest: C7142EF2 Relay Data Length: 1 Relay End Reason: (Anonymized TCP connection was closed) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 56 13.346311 91.208.34.1 192.168.1.34 Tor Tor Cell: (Negotiate proto version), Tor Cell: (Time and address info) Frame 56 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.459098000 [Time delta from previous captured frame: 0.239066000 seconds] [Time delta from previous displayed frame: 0.277666000 seconds] [Time since reference or first frame: 13.346311000 seconds] Frame Number: 56 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x4c86d6a4 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc337 (49975) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4387 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 2603, Ack: 1831, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 2603 (relative sequence number) [Next sequence number: 3189 (relative sequence number)] Acknowledgement number: 1831 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 9728 (scaled) Checksum: 0x72d1 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936171879, TSecr 3793856 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: AF085D2E519FD89E0A263CD680A3259C75BF0919A2D8C50A... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: D43D138FCA70A724B6FA1D45E06751F4CCE8CF75E717725A... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231079218 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 78.16.255.227 (78.16.255.227) Number of Addresses: 1 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 This OR's Address: 91.208.34.1 (91.208.34.1) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 57 13.346570 192.168.1.34 91.208.34.1 Tor Tor Cell: (Time and address info) Frame 57 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.459357000 [Time delta from previous captured frame: 0.000259000 seconds] [Time delta from previous displayed frame: 0.000259000 seconds] [Time since reference or first frame: 13.346570000 seconds] Frame Number: 57 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54dd (21725) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa401 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 1831, Ack: 3189, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 1831 (relative sequence number) [Next sequence number: 2417 (relative sequence number)] Acknowledgement number: 3189 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794042, TSecr 936171879 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 56] [The RTT to ACK the segment was: 0.000259000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: C656C15D4B39F835B26027CD0C99C9A76E196B0219095F0F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: D4328DA0D6BBA56ABA4E28B031C4B9D3C9A3E9EA08831BA1... Tor Protocol CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081679 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 91.208.34.1 (91.208.34.1) Number of Addresses: 0 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 59 13.424414 192.168.1.34 91.208.34.1 Tor Tor Cell: (Create a circuit, no PK) Frame 59 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.537201000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.077844000 seconds] [Time since reference or first frame: 13.424414000 seconds] Frame Number: 59 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54de (21726) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa400 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 2417, Ack: 3189, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 2417 (relative sequence number) [Next sequence number: 3003 (relative sequence number)] Acknowledgement number: 3189 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794062, TSecr 936171894 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 58] [The RTT to ACK the segment was: 0.000025000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 7B8AFB039FE3F53BDA843EC8C93B40D52B32B70E0A846693... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 789858C5CBC740F2BAF24B3871A7ABABE6E1EAA4B1E1CBAB... Tor Protocol CircID: 45644 Command: (Create a circuit, no PK) (0x05) Payload: Key Material (X): E894D8A56DBD24E99DFA78D1EFACBCC20745FE4F Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 61 13.604602 91.208.34.1 192.168.1.34 Tor Tor Cell: (Circuit created, no PK) Frame 61 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.717389000 [Time delta from previous captured frame: 0.086121000 seconds] [Time delta from previous displayed frame: 0.180188000 seconds] [Time since reference or first frame: 13.604602000 seconds] Frame Number: 61 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x9bf56ea5 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc33a (49978) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4384 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 3189, Ack: 3003, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 3189 (relative sequence number) [Next sequence number: 3775 (relative sequence number)] Acknowledgement number: 3003 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13568 (scaled) Checksum: 0x629f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936171934, TSecr 3794062 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4B33FCD4A4B1E69712F4662EE56E6BCD809161C1AA08F828... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 080858B237BE083984DBFF32150008F615789C2E5F0252E3... Tor Protocol CircID: 45644 Command: (Circuit created, no PK) (0x06) Payload: Key Material (Y): E04E2CC7CF94B252A60C125DCE6A55978643242D Derivative key data: EF63303B5457DAE8071BABA76DA7CECD5575ECD4 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 62 13.606955 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 62 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:07:59.719742000 [Time delta from previous captured frame: 0.002353000 seconds] [Time delta from previous displayed frame: 0.002353000 seconds] [Time since reference or first frame: 13.606955000 seconds] Frame Number: 62 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54df (21727) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ff [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 3003, Ack: 3775, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 3003 (relative sequence number) [Next sequence number: 3589 (relative sequence number)] Acknowledgement number: 3775 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14592 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794107, TSecr 936171934 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 61] [The RTT to ACK the segment was: 0.002353000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: C03EAEDEBF4CCE4CAB06EF96D5985D2AF3606F4537C1A5FB... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: ABD1D6FE1B74F9F9FD1556D3AAA368F30281DFC387BD7311... Tor Protocol CircID: 45644 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 65F336F1 Relay Data Length: 212 Relay Data: 80D001A79C4DA1A97FE6D82D5707E9DA61B8864A8740429E... No. Time Source Destination Protocol Info 64 14.621121 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 64 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:00.733908000 [Time delta from previous captured frame: 0.955031000 seconds] [Time delta from previous displayed frame: 1.014166000 seconds] [Time since reference or first frame: 14.621121000 seconds] Frame Number: 64 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x51f0fc3c [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc33c (49980) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4382 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 3775, Ack: 3589, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 3775 (relative sequence number) [Next sequence number: 4361 (relative sequence number)] Acknowledgement number: 3589 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14720 (scaled) Checksum: 0x2c97 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936172189, TSecr 3794107 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 944F59E54FA1CEE8AD09FD16CB829BFB3237F83D2D9F0FF4... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 9524A1BF60ACE7CB647194E031CB367CF6E1177ADFD66E81... Tor Protocol CircID: 45644 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 9B40FDBC Relay Data Length: 148 Relay Data: 0F5FBD9586708A737E7F3B9011DB5E5BD43F65932C68AAC4... No. Time Source Destination Protocol Info 65 14.625446 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 65 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:00.738233000 [Time delta from previous captured frame: 0.004325000 seconds] [Time delta from previous displayed frame: 0.004325000 seconds] [Time since reference or first frame: 14.625446000 seconds] Frame Number: 65 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e0 (21728) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3fe [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 3589, Ack: 4361, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 3589 (relative sequence number) [Next sequence number: 4175 (relative sequence number)] Acknowledgement number: 4361 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15744 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794362, TSecr 936172189 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 64] [The RTT to ACK the segment was: 0.004325000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 555CA955475B7AF6EF9A8716D25A699668ACCA30A7F9AFFA... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: C4D1D6AB5E4FAAA48AF1E2A7A66C676E29EAC3FCCF259E23... Tor Protocol CircID: 45644 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 50A12517 Relay Data Length: 212 Relay Data: D12C72B223293A41BF5E77F056304C641575EBE0997CC790... No. Time Source Destination Protocol Info 67 15.040788 192.168.1.34 91.208.34.1 Tor Tor Cell: (Create a circuit, no PK) Frame 67 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:01.153575000 [Time delta from previous captured frame: 0.352017000 seconds] [Time delta from previous displayed frame: 0.415342000 seconds] [Time since reference or first frame: 15.040788000 seconds] Frame Number: 67 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e1 (21729) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3fd [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 4175, Ack: 4361, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 4175 (relative sequence number) [Next sequence number: 4761 (relative sequence number)] Acknowledgement number: 4361 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15744 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794466, TSecr 936172214 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 66] [The RTT to ACK the segment was: 0.352017000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: A174D27CF17220DFE15FACF73B302BD2C10E01374CCE4277... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: C0B7298AD5C095455E69E1CA356AE7AB5AD6F241EEBC2261... Tor Protocol CircID: 45645 Command: (Create a circuit, no PK) (0x05) Payload: Key Material (X): AE49D128806984961E14B0722E8B323249DAD8ED Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 69 15.405860 91.208.34.1 192.168.1.34 Tor Tor Cell: (Circuit created, no PK) Frame 69 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:01.518647000 [Time delta from previous captured frame: 0.308513000 seconds] [Time delta from previous displayed frame: 0.365072000 seconds] [Time since reference or first frame: 15.405860000 seconds] Frame Number: 69 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x8b3dbbbf [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc33f (49983) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x437f [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 4361, Ack: 4761, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 4361 (relative sequence number) [Next sequence number: 4947 (relative sequence number)] Acknowledgement number: 4761 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17152 (scaled) Checksum: 0x88ca [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936172393, TSecr 3794466 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: C849FB3EBC8573ACD3A3A2E3F92154EDF6CCC296F2D8250F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: C419CE5F1B6C8A4B77630337ADC6F21C90774D8221C96E11... Tor Protocol CircID: 45645 Command: (Circuit created, no PK) (0x06) Payload: Key Material (Y): 9FFBF1B3F85B0A9DFCD194F052F0B7F7FF97A4D2 Derivative key data: A5FA9525611B26CA2BC679685D2BFBE98841D2CF Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 70 15.408190 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 70 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:01.520977000 [Time delta from previous captured frame: 0.002330000 seconds] [Time delta from previous displayed frame: 0.002330000 seconds] [Time since reference or first frame: 15.408190000 seconds] Frame Number: 70 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e2 (21730) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3fc [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 4761, Ack: 4947, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 4761 (relative sequence number) [Next sequence number: 5347 (relative sequence number)] Acknowledgement number: 4947 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16896 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794557, TSecr 936172393 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 69] [The RTT to ACK the segment was: 0.002330000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: A4FC6094656F53553CA86D234FC1618E5FD13E2741008EBD... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 5FB27359D584248EDC56BB897068B3B85BA69C5C3B3E3F76... Tor Protocol CircID: 45645 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 5216FBE8 Relay Data Length: 212 Relay Data: 5B8F5B6F01BB287D166389A2D6502A32FAB0EA3B42279869... No. Time Source Destination Protocol Info 73 16.451514 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 73 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:02.564301000 [Time delta from previous captured frame: 0.423256000 seconds] [Time delta from previous displayed frame: 1.043324000 seconds] [Time since reference or first frame: 16.451514000 seconds] Frame Number: 73 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x1c47cb07 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc341 (49985) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x437d [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 4947, Ack: 5347, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 4947 (relative sequence number) [Next sequence number: 5533 (relative sequence number)] Acknowledgement number: 5347 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 18304 (scaled) Checksum: 0xeae5 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936172655, TSecr 3794557 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 46EEAE54C2D9807F779A640D5F9F6EBE9451F2AF27DDDEA3... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: DB436F4C7C11ED03C612AE3CFF35EBB53AA414B79CB68C87... Tor Protocol CircID: 45644 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_TRUNCATED (0x09) Recognized: 0000 Stream ID: 0 Digest: BFE279F9 Relay Data Length: 1 Destroy Reason: (Unable to reach server.) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 74 16.451720 192.168.1.34 91.208.34.1 Tor Tor Cell: (Stop using a circuit) Frame 74 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:02.564507000 [Time delta from previous captured frame: 0.000206000 seconds] [Time delta from previous displayed frame: 0.000206000 seconds] [Time since reference or first frame: 16.451720000 seconds] Frame Number: 74 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e3 (21731) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3fb [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 5347, Ack: 5533, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 5347 (relative sequence number) [Next sequence number: 5933 (relative sequence number)] Acknowledgement number: 5533 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 18176 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794819, TSecr 936172655 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 73] [The RTT to ACK the segment was: 0.000206000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: D47C50A3AD579B3E0877F09648261DBE5BB0E85E38B1EA33... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: A5E8A143D13FCB27306E2AF587DD7497CAC4D7AE7C2D7982... Tor Protocol CircID: 45644 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (No reason given.) (0x00) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 75 16.523226 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 75 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:02.636013000 [Time delta from previous captured frame: 0.071506000 seconds] [Time delta from previous displayed frame: 0.071506000 seconds] [Time since reference or first frame: 16.523226000 seconds] Frame Number: 75 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x17516bf6 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc342 (49986) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x437c [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 5533, Ack: 5933, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 5533 (relative sequence number) [Next sequence number: 6119 (relative sequence number)] Acknowledgement number: 5933 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 19456 (scaled) Checksum: 0x7b68 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936172670, TSecr 3794819 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 74] [The RTT to ACK the segment was: 0.071506000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 61DD88A570FA2F7D017E11B7AA4695E2DCC9E6B6AA34DEEB... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: F483AFDF088B8760DFA82675C0B92BB0747E1F7DF357C956... Tor Protocol CircID: 45645 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 8399FB42 Relay Data Length: 148 Relay Data: 4EE912B804A296AFBA6E0217715EE6E1919CFADF2B60DBC4... No. Time Source Destination Protocol Info 76 16.527433 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 76 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:02.640220000 [Time delta from previous captured frame: 0.004207000 seconds] [Time delta from previous displayed frame: 0.004207000 seconds] [Time since reference or first frame: 16.527433000 seconds] Frame Number: 76 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e4 (21732) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3fa [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 5933, Ack: 6119, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 5933 (relative sequence number) [Next sequence number: 6519 (relative sequence number)] Acknowledgement number: 6119 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 19328 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794837, TSecr 936172670 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 75] [The RTT to ACK the segment was: 0.004207000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 1B70D8E2C79B64CAC80388C8CB0FBAE4F3646B9939A311E4... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 5897DAAA9EEC97B7821FDA2B4BF8C5E9F917B45FF90FD627... Tor Protocol CircID: 45645 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: DCD76CEB Relay Data Length: 212 Relay Data: 9C38676723291A4903205074EE0D89121EDF847EC9359D50... No. Time Source Destination Protocol Info 78 17.049389 192.168.1.34 91.208.34.1 Tor Tor Cell: (Create a circuit, no PK) Frame 78 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:03.162176000 [Time delta from previous captured frame: 0.384933000 seconds] [Time delta from previous displayed frame: 0.521956000 seconds] [Time since reference or first frame: 17.049389000 seconds] Frame Number: 78 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e5 (21733) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f9 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 6519, Ack: 6119, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 6519 (relative sequence number) [Next sequence number: 7105 (relative sequence number)] Acknowledgement number: 6119 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 19328 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3794968, TSecr 936172699 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 77] [The RTT to ACK the segment was: 0.384933000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: CD8B9AE7AC863EDE601DF250EDE4995CD4B109AA3D8E9915... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 672550B17FE63450E866A5614B7985AFB8BC052CE5FB0EFD... Tor Protocol CircID: 45646 Command: (Create a circuit, no PK) (0x05) Payload: Key Material (X): D38E874D3F005F742AD8CB2AAF95A1925E345374 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 80 17.489126 91.208.34.1 192.168.1.34 Tor Tor Cell: (Circuit created, no PK) Frame 80 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:03.601913000 [Time delta from previous captured frame: 0.381526000 seconds] [Time delta from previous displayed frame: 0.439737000 seconds] [Time since reference or first frame: 17.489126000 seconds] Frame Number: 80 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x73933c57 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc345 (49989) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4379 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 6119, Ack: 7105, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 6119 (relative sequence number) [Next sequence number: 6705 (relative sequence number)] Acknowledgement number: 7105 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 21760 (scaled) Checksum: 0xe619 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936172914, TSecr 3794968 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: E406574911CAF7F7EB26D672079DC2ABE3DE27A3CA8E9161... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 45C11944706E58AF66B2907A6C84768EE5E06279F947B6BE... Tor Protocol CircID: 45646 Command: (Circuit created, no PK) (0x06) Payload: Key Material (Y): 08FE4DB605B57F80043ADDFEB4754D58A38C7F56 Derivative key data: AE64F215895D60A2BD194F9FF1D21BF600DBAE9E Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 81 17.491465 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 81 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:03.604252000 [Time delta from previous captured frame: 0.002339000 seconds] [Time delta from previous displayed frame: 0.002339000 seconds] [Time since reference or first frame: 17.491465000 seconds] Frame Number: 81 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e6 (21734) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f8 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 7105, Ack: 6705, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 7105 (relative sequence number) [Next sequence number: 7691 (relative sequence number)] Acknowledgement number: 6705 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 20480 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795079, TSecr 936172914 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 80] [The RTT to ACK the segment was: 0.002339000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: B7FA2EEF1D9E2C3C3F1F41759468BF0E162B6EEF55A33BFB... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 79760683C5DDBDD85B2A932331D35EB91C86F86BF058549F... Tor Protocol CircID: 45646 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: F034E52C Relay Data Length: 212 Relay Data: C31F82F823299C009B805D35871B2215868F20179AAB0D30... No. Time Source Destination Protocol Info 85 18.516054 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 85 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:04.628841000 [Time delta from previous captured frame: 0.235923000 seconds] [Time delta from previous displayed frame: 1.024589000 seconds] [Time since reference or first frame: 18.516054000 seconds] Frame Number: 85 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x8b621c88 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc347 (49991) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4377 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 6705, Ack: 7691, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 6705 (relative sequence number) [Next sequence number: 7291 (relative sequence number)] Acknowledgement number: 7691 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 22912 (scaled) Checksum: 0x6b0d [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936173171, TSecr 3795079 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: FD896230729A2B115013476B85ACAA9D15EF6FFC44CE191E... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 316F1654F70E56FA2CA4256147D31445A5A53C10EFF537F9... Tor Protocol CircID: 45646 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 81E0AC7D Relay Data Length: 148 Relay Data: FE393F23004AFE184B1D2C2EC397C73751226DDA6794827F... No. Time Source Destination Protocol Info 86 18.520288 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 86 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:04.633075000 [Time delta from previous captured frame: 0.004234000 seconds] [Time delta from previous displayed frame: 0.004234000 seconds] [Time since reference or first frame: 18.520288000 seconds] Frame Number: 86 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54e7 (21735) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f7 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 7691, Ack: 7291, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 7691 (relative sequence number) [Next sequence number: 8277 (relative sequence number)] Acknowledgement number: 7291 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 21632 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795336, TSecr 936173171 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 85] [The RTT to ACK the segment was: 0.004234000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: CF6F3DB0D01B732D7A1B557FC35A0BB4955C459412D4E50F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 726ACBC4C126EAE499DF649B7CEDC4766A2DCDD0163E8D2A... Tor Protocol CircID: 45646 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 0DDCE3CC Relay Data Length: 212 Relay Data: 5EFFD1F501BB1EB13AD6D5D3EF9C767446A46023B6DB7726... No. Time Source Destination Protocol Info 88 19.553764 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 88 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:05.666551000 [Time delta from previous captured frame: 0.960918000 seconds] [Time delta from previous displayed frame: 1.033476000 seconds] [Time since reference or first frame: 19.553764000 seconds] Frame Number: 88 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x5745253c [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc349 (49993) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4375 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 7291, Ack: 8277, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 7291 (relative sequence number) [Next sequence number: 7877 (relative sequence number)] Acknowledgement number: 8277 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 24064 (scaled) Checksum: 0xf4e3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936173430, TSecr 3795336 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F67879F4E40E415AF713141887991981866F3548401982F6... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 892728B16C12529DA1C1F8E9EE2BFB7171726882FA154D74... Tor Protocol CircID: 45645 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 65934EB4 Relay Data Length: 148 Relay Data: 05E1DE40D521EE6D66446EB6BB35FE98F6F9437A353283B2... No. Time Source Destination Protocol Info 106 20.002448 192.168.1.34 212.112.242.89 Tor Tor Cell: (Negotiate proto version) Frame 106 (140 bytes on wire, 140 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.115235000 [Time delta from previous captured frame: 0.000328000 seconds] [Time delta from previous displayed frame: 0.448684000 seconds] [Time since reference or first frame: 20.002448000 seconds] Frame Number: 106 Frame Length: 140 bytes Capture Length: 140 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 212.112.242.89 (212.112.242.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 126 Identification: 0x14bc (5308) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9d29 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 212.112.242.89 (212.112.242.89) Transmission Control Protocol, Src Port: 41332 (41332), Dst Port: 9001 (9001), Seq: 1741, Ack: 2554, Len: 74 Source port: 41332 (41332) Destination port: 9001 (9001) [Stream index: 4] Sequence number: 1741 (relative sequence number) [Next sequence number: 1815 (relative sequence number)] Acknowledgement number: 2554 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10624 (scaled) Checksum: 0x8905 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795706, TSecr 275320848 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 105] [The RTT to ACK the segment was: 0.000328000 seconds] [Number of bytes in flight: 74] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 9E766E1457AC39AB50F554E6E3EBF301F33704F27A98FD28... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 8DC1BAEFC5EC23583CB991ACC317159925B06277779EAD4A... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 No. Time Source Destination Protocol Info 108 20.074866 192.168.1.34 212.112.242.89 Tor Tor Cell: (Time and address info) Frame 108 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.187653000 [Time delta from previous captured frame: 0.002242000 seconds] [Time delta from previous displayed frame: 0.072418000 seconds] [Time since reference or first frame: 20.074866000 seconds] Frame Number: 108 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 212.112.242.89 (212.112.242.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x14bd (5309) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9b28 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 212.112.242.89 (212.112.242.89) Transmission Control Protocol, Src Port: 41332 (41332), Dst Port: 9001 (9001), Seq: 1815, Ack: 3140, Len: 586 Source port: 41332 (41332) Destination port: 9001 (9001) [Stream index: 4] Sequence number: 1815 (relative sequence number) [Next sequence number: 2401 (relative sequence number)] Acknowledgement number: 3140 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x8b05 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795724, TSecr 275320866 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 107] [The RTT to ACK the segment was: 0.002242000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 9E09D62DF41EBF32D97191C7D2219BD8C9AB9AC13D3F1462... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 381D0F340D962379AD8F5D6D63C7E09C4561C8E1351D882A... Tor Protocol CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081686 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 212.112.242.89 (212.112.242.89) Number of Addresses: 1 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 This OR's Address: 78.16.255.227 (78.16.255.227) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 110 20.188451 192.168.1.34 212.112.242.89 Tor Tor Cell: (Create a circuit) Frame 110 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.301238000 [Time delta from previous captured frame: 0.000030000 seconds] [Time delta from previous displayed frame: 0.113585000 seconds] [Time since reference or first frame: 20.188451000 seconds] Frame Number: 110 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 212.112.242.89 (212.112.242.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x14be (5310) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9b27 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 212.112.242.89 (212.112.242.89) Transmission Control Protocol, Src Port: 41332 (41332), Dst Port: 9001 (9001), Seq: 2401, Ack: 3140, Len: 586 Source port: 41332 (41332) Destination port: 9001 (9001) [Stream index: 4] Sequence number: 2401 (relative sequence number) [Next sequence number: 2987 (relative sequence number)] Acknowledgement number: 3140 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x8b05 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795753, TSecr 275320896 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 109] [The RTT to ACK the segment was: 0.000030000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: BC66E3935801E21C7347E87D382BE6A5132D3F8B5A037DD9... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 8C5C8FCBA067A78959E2EB9D695D5B649CA6F7F640B3C032... Tor Protocol CircID: 20360 Command: (Create a circuit) (0x01) Payload: Create Payload: 018B3F84BCC572AB6F387BFE5EA176623EA17BBA55E927DF... No. Time Source Destination Protocol Info 113 20.284590 192.168.1.34 212.112.242.89 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 113 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.397377000 [Time delta from previous captured frame: 0.004157000 seconds] [Time delta from previous displayed frame: 0.096139000 seconds] [Time since reference or first frame: 20.284590000 seconds] Frame Number: 113 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 212.112.242.89 (212.112.242.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x14bf (5311) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9b26 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 212.112.242.89 (212.112.242.89) Transmission Control Protocol, Src Port: 41332 (41332), Dst Port: 9001 (9001), Seq: 2987, Ack: 3726, Len: 586 Source port: 41332 (41332) Destination port: 9001 (9001) [Stream index: 4] Sequence number: 2987 (relative sequence number) [Next sequence number: 3573 (relative sequence number)] Acknowledgement number: 3726 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14592 (scaled) Checksum: 0x8b05 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795777, TSecr 275320918 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 112] [The RTT to ACK the segment was: 0.004157000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 11FB2AF11E18D9E93FA12EF8A0F50887BD5F792A1747D458... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: DEEF3136D5FE300424855813410DB003A59CEF1976A271FE... Tor Protocol CircID: 20360 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 3CBB25F3 Relay Data Length: 212 Relay Data: 551FBB04210F80986302F34E5F6F9057A9E3ABC5529A787B... No. Time Source Destination Protocol Info 116 20.403095 192.168.1.34 212.112.242.89 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 116 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.515882000 [Time delta from previous captured frame: 0.004169000 seconds] [Time delta from previous displayed frame: 0.118505000 seconds] [Time since reference or first frame: 20.403095000 seconds] Frame Number: 116 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 212.112.242.89 (212.112.242.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x14c0 (5312) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x9b25 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 212.112.242.89 (212.112.242.89) Transmission Control Protocol, Src Port: 41332 (41332), Dst Port: 9001 (9001), Seq: 3573, Ack: 4312, Len: 586 Source port: 41332 (41332) Destination port: 9001 (9001) [Stream index: 4] Sequence number: 3573 (relative sequence number) [Next sequence number: 4159 (relative sequence number)] Acknowledgement number: 4312 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15744 (scaled) Checksum: 0x8b05 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795806, TSecr 275320948 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 115] [The RTT to ACK the segment was: 0.004169000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 049A425488FF92D83F07531ACE991B1C3A3DC7BA07159C86... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 2C1DD6B33AB1F3F974C3F8ACBB4FF0E325E446E4BFEBB21F... Tor Protocol CircID: 20360 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: DBB2741B Relay Data Length: 212 Relay Data: 4E10FFE301BB0EB21EE400262B46DB2EA98AEFC1117B1633... No. Time Source Destination Protocol Info 118 20.589934 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 118 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.702721000 [Time delta from previous captured frame: 0.113298000 seconds] [Time delta from previous displayed frame: 0.186839000 seconds] [Time since reference or first frame: 20.589934000 seconds] Frame Number: 118 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xaca26fb5 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc34a (49994) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4374 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 7877, Ack: 8277, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 7877 (relative sequence number) [Next sequence number: 8463 (relative sequence number)] Acknowledgement number: 8277 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 24064 (scaled) Checksum: 0x1687 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936173689, TSecr 3795604 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 90] [The RTT to ACK the segment was: 0.997208000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: A613E5CB77C67150455F2CEADBE497F788F23C6C3FC9EB25... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 9E01DD6B7A70FFF15920820E93CD5311EDF8AD6BCA39D39B... Tor Protocol CircID: 45646 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 8F6D18E4 Relay Data Length: 148 Relay Data: 8BA92AB0A646298C8563FF063ADE7EC560C030FE9A1EAA6C... No. Time Source Destination Protocol Info 120 20.592117 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 120 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:06.704904000 [Time delta from previous captured frame: 0.002156000 seconds] [Time delta from previous displayed frame: 0.002183000 seconds] [Time since reference or first frame: 20.592117000 seconds] Frame Number: 120 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ea (21738) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f4 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 8277, Ack: 8463, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 8277 (relative sequence number) [Next sequence number: 8863 (relative sequence number)] Acknowledgement number: 8463 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 23936 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3795854, TSecr 936173689 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: FA5FC3811B18275830E7F2C7EE4E3653F84B8E1B6369E39F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 1B6DD2E5A1D5871C865A83CD7315AAF5EC131FB3D76E723F... Tor Protocol CircID: 45646 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 50579 Digest: 3648730F Relay Data Length: 17 Resolve Address: 78.16.255.227:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 123 30.100566 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 123 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:16.213353000 [Time delta from previous captured frame: 8.072514000 seconds] [Time delta from previous displayed frame: 9.508449000 seconds] [Time since reference or first frame: 30.100566000 seconds] Frame Number: 123 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54eb (21739) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f3 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 8863, Ack: 8463, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 8863 (relative sequence number) [Next sequence number: 9449 (relative sequence number)] Acknowledgement number: 8463 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 23936 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798231, TSecr 936173705 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 121] [The RTT to ACK the segment was: 9.436562000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 9923BC6380821A3A14D193F2788EAFE7F6C9A6AFD6345E08... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: C7F74950262B72A3FDBC8E0C49E154728F9D73C3BBA3B0A0... Tor Protocol CircID: 45646 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 50579 Digest: 96CD483B Relay Data Length: 1 Relay End Reason: (catch-all for unlisted reasons) (0x01) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 125 30.156828 192.168.1.34 91.208.34.1 Tor Tor Cell: (Create a circuit) Frame 125 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:16.269615000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.056262000 seconds] [Time since reference or first frame: 30.156828000 seconds] Frame Number: 125 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ec (21740) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f2 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 9449, Ack: 8463, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 9449 (relative sequence number) [Next sequence number: 10035 (relative sequence number)] Acknowledgement number: 8463 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 23936 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798245, TSecr 936176082 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 124] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: E5B00F284250BE2E4C277160DCA5203AD151DEDE58B7D4C9... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 2EDF0A81888ECFD0DA3439428B0764B53925D2AFBB26B572... Tor Protocol CircID: 45647 Command: (Create a circuit) (0x01) Payload: Create Payload: 65E84E0F1318EC49CB10F3D847E35E27018048FA664998F4... No. Time Source Destination Protocol Info 127 30.977297 91.208.34.1 192.168.1.34 Tor Tor Cell: (Acknowledge create) Frame 127 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:17.090084000 [Time delta from previous captured frame: 0.762463000 seconds] [Time delta from previous displayed frame: 0.820469000 seconds] [Time since reference or first frame: 30.977297000 seconds] Frame Number: 127 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x1ad19c54 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc34e (49998) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4370 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 8463, Ack: 10035, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 8463 (relative sequence number) [Next sequence number: 9049 (relative sequence number)] Acknowledgement number: 10035 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 27648 (scaled) Checksum: 0x37ce [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936176286, TSecr 3798245 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: B2E1055460FBC95F72E486FE7E15E7DC8E335B7E457551F2... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: AC97C6BC8B5934EF0520B1E72A79BDBAA49B9A9B1E432FCA... Tor Protocol CircID: 45647 Command: (Acknowledge create) (0x02) Payload: Diffie Hellman data: 82644E6671D6BED92CF86A71B0A13C99F39550A661913D02... Derivative key data: EF15092DEB73DB0A1F81C5B2855B45D7C5A2BDD9 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 128 30.981516 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 128 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:17.094303000 [Time delta from previous captured frame: 0.004219000 seconds] [Time delta from previous displayed frame: 0.004219000 seconds] [Time since reference or first frame: 30.981516000 seconds] Frame Number: 128 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ed (21741) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f1 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 10035, Ack: 9049, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 10035 (relative sequence number) [Next sequence number: 10621 (relative sequence number)] Acknowledgement number: 9049 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 25216 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798451, TSecr 936176286 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 127] [The RTT to ACK the segment was: 0.004219000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: C8E88D0742F17F03C781595B97507A831F125892483D7757... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: B3DCB47E0E8FDA6AF6657B0422B556947A32C8A7E580AA12... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 40818677 Relay Data Length: 212 Relay Data: C2FF7051232934D1A958D30580C30EC41C0F3A7865F422C3... No. Time Source Destination Protocol Info 130 32.038643 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 130 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:18.151430000 [Time delta from previous captured frame: 0.984390000 seconds] [Time delta from previous displayed frame: 1.057127000 seconds] [Time since reference or first frame: 32.038643000 seconds] Frame Number: 130 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x12bbe04b [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc350 (50000) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x436e [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 9049, Ack: 10621, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 9049 (relative sequence number) [Next sequence number: 9635 (relative sequence number)] Acknowledgement number: 10621 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 28800 (scaled) Checksum: 0x6a25 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936176552, TSecr 3798451 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 0BD0E326A012587BA643A2D7FE9AE122A1FEF64613CF85D1... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: BD1D5A8FB8065D4575F75BA1E73FB96611BBA38DC1F45ADB... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 544D90D4 Relay Data Length: 148 Relay Data: BC023119647E77AC1E5EC2C7CBDA74B517D8DFB3D96BD111... No. Time Source Destination Protocol Info 131 32.042900 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 131 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:18.155687000 [Time delta from previous captured frame: 0.004257000 seconds] [Time delta from previous displayed frame: 0.004257000 seconds] [Time since reference or first frame: 32.042900000 seconds] Frame Number: 131 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ee (21742) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3f0 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 10621, Ack: 9635, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 10621 (relative sequence number) [Next sequence number: 11207 (relative sequence number)] Acknowledgement number: 9635 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 26368 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798716, TSecr 936176552 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 130] [The RTT to ACK the segment was: 0.004257000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 23A51DCF25D234DFDCDD05852F51FD8062368FC6F80BE32A... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 06E6707EE908B66A93C1653AEDABC52054746B61100D00AC... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 6FF67340 Relay Data Length: 212 Relay Data: C0FBE2CD01BB25085A126DB493E55C8A99A7339C65179E0C... No. Time Source Destination Protocol Info 133 33.082056 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 133 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:19.194843000 [Time delta from previous captured frame: 0.969995000 seconds] [Time delta from previous displayed frame: 1.039156000 seconds] [Time since reference or first frame: 33.082056000 seconds] Frame Number: 133 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x5f7b948e [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc352 (50002) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x436c [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 9635, Ack: 11207, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 9635 (relative sequence number) [Next sequence number: 10221 (relative sequence number)] Acknowledgement number: 11207 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 29952 (scaled) Checksum: 0x98f4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936176812, TSecr 3798716 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: EBB9D909A3C30DF889CD0C4874704E9DEE1913647B1F8A4D... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 377AB0CA2970A7F0B37F299C4B36ECFB528BD52522D161FA... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 3F485D4F Relay Data Length: 148 Relay Data: DDFA3A32B94C64BC6F75201B124B4B37365477ACA9055109... No. Time Source Destination Protocol Info 134 33.084369 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 134 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:19.197156000 [Time delta from previous captured frame: 0.002313000 seconds] [Time delta from previous displayed frame: 0.002313000 seconds] [Time since reference or first frame: 33.084369000 seconds] Frame Number: 134 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ef (21743) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ef [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 11207, Ack: 10221, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 11207 (relative sequence number) [Next sequence number: 11793 (relative sequence number)] Acknowledgement number: 10221 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 27520 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798977, TSecr 936176812 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 133] [The RTT to ACK the segment was: 0.002313000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: BE172CBBC8624663151CB087FF93772BF673A6110F37AB4D... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 696EED54D7F82106A7A4683424BBE0549DFF6BF1656690D0... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 19219 Digest: 87446232 Relay Data Length: 17 Resolve Address: 78.16.255.227:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 136 33.156297 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 136 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:19.269084000 [Time delta from previous captured frame: 0.000041000 seconds] [Time delta from previous displayed frame: 0.071928000 seconds] [Time since reference or first frame: 33.156297000 seconds] Frame Number: 136 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54f0 (21744) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ee [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 11793, Ack: 10221, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 11793 (relative sequence number) [Next sequence number: 12379 (relative sequence number)] Acknowledgement number: 10221 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 27520 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3798995, TSecr 936176828 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 135] [The RTT to ACK the segment was: 0.000041000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F7E79E275735AF11444FDC3238E939F6FC686C6FE1B3B444... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 88BF124E58742E2C60E761D64802E9B8D6EE1A25DD4F6B99... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 19220 Digest: 40B90E86 Relay Data Length: 20 Resolve Address: en.wikipedia.org:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 143 34.375186 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 143 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:20.487973000 [Time delta from previous captured frame: 0.197465000 seconds] [Time delta from previous displayed frame: 1.218889000 seconds] [Time since reference or first frame: 34.375186000 seconds] Frame Number: 143 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xad6a9bbe [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc355 (50005) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4369 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 10221, Ack: 12379, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 10221 (relative sequence number) [Next sequence number: 10807 (relative sequence number)] Acknowledgement number: 12379 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 32384 (scaled) Checksum: 0xd8e4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936177129, TSecr 3798995 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4ED84F8279B09A49BFBD027731FAE88E6124D30D7193009E... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 948AFE6B1EC67C508DBA2BC3C2AD27EFF40F7954000C2DFD... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_CONNECTED (0x04) Recognized: 0000 Stream ID: 19220 Digest: 203A6B40 Relay Data Length: 8 Relay Connected IP: 91.198.174.2 (91.198.174.2) Relay Connected TTL: 3598 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 144 34.375561 192.168.1.34 91.208.34.1 HTTP GET /wiki/Special:Search?search=tor&go=Go HTTP/1.1 Frame 144 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:20.488348000 [Time delta from previous captured frame: 0.000375000 seconds] [Time delta from previous displayed frame: 0.000375000 seconds] [Time since reference or first frame: 34.375561000 seconds] Frame Number: 144 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54f1 (21745) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ed [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 12379, Ack: 10807, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 12379 (relative sequence number) [Next sequence number: 12965 (relative sequence number)] Acknowledgement number: 10807 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 28672 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3799300, TSecr 936177129 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 143] [The RTT to ACK the segment was: 0.000375000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 353C8D6D16AD2589CDCA6F39AD91566BE69B4BBE28EF1516... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 97E89FD531EE97A8D4C41641C1964BD23DC6286868724140... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19220 Digest: BCA2243B Relay Data Length: 278 Hypertext Transfer Protocol GET /wiki/Special:Search?search=tor&go=Go HTTP/1.1\r\n Request Method: GET Request URI: /wiki/Special:Search?search=tor&go=Go Request Version: HTTP/1.1 Accept: text/html, image/jpeg, image/png, text/*, image/*, */*\r\n Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n Accept-Charset: utf-8, utf-8;q=0.5, *;q=0.5\r\n Accept-Language: en\r\n Host: en.wikipedia.org\r\n Connection: close\r\n \r\n No. Time Source Destination Protocol Info 159 35.794372 192.168.1.34 89.253.105.39 Tor Tor Cell: (Negotiate proto version) Frame 159 (140 bytes on wire, 140 bytes captured) Arrival Time: Jan 4, 2009 15:08:21.907159000 [Time delta from previous captured frame: 0.000368000 seconds] [Time delta from previous displayed frame: 1.418811000 seconds] [Time since reference or first frame: 35.794372000 seconds] Frame Number: 159 Frame Length: 140 bytes Capture Length: 140 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 126 Identification: 0xfa8f (64143) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xbafb [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 1741, Ack: 2561, Len: 74 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 1741 (relative sequence number) [Next sequence number: 1815 (relative sequence number)] Acknowledgement number: 2561 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 10624 (scaled) Checksum: 0x855f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3799654, TSecr 4248441059 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 158] [The RTT to ACK the segment was: 0.000368000 seconds] [Number of bytes in flight: 74] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 2C8C82E9815798BEBCD90B41670331CC03E0DF838A34E129... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 0289963C8A16F316C481572EFC5F19AB139555D1D6B5B71B... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 No. Time Source Destination Protocol Info 161 36.222733 91.208.34.1 192.168.1.34 HTTP HTTP/1.0 302 Moved Temporarily Frame 161 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:22.335520000 [Time delta from previous captured frame: 0.354121000 seconds] [Time delta from previous displayed frame: 0.428361000 seconds] [Time since reference or first frame: 36.222733000 seconds] Frame Number: 161 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xeba55c21 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc357 (50007) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4367 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 10807, Ack: 12965, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 10807 (relative sequence number) [Next sequence number: 11393 (relative sequence number)] Acknowledgement number: 12965 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 33536 (scaled) Checksum: 0x3024 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936177598, TSecr 3799300 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 2066F71C8BBFA5FDC75BE6441ECF2C5A7A694EDCFBBEFD7C... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 9CE73E2FBB0E77FDD1F1359D5BB0C65B42747B1818372723... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19220 Digest: 0E7E3641 Relay Data Length: 498 Hypertext Transfer Protocol HTTP/1.0 302 Moved Temporarily\r\n Request Version: HTTP/1.0 Response Code: 302 Date: Sun, 04 Jan 2009 15:08:21 GMT\r\n Server: Apache\r\n X-Powered-By: PHP/5.2.4-2ubuntu5wm1\r\n Cache-Control: private, s-maxage=0, max-age=0, must-revalidate\r\n Vary: Accept-Encoding,Cookie\r\n [truncated] X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=enwikiToken;string-contains=enwikiLoggedOut;string-contains=enwiki_session;string-contains=centralauth_Token;string-contains=centralauth_Session;string-c Expires: Thu, 01 Jan 197 No. Time Source Destination Protocol Info 164 36.283494 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data) Frame 164 (292 bytes on wire, 292 bytes captured) Arrival Time: Jan 4, 2009 15:08:22.396281000 [Time delta from previous captured frame: 0.055439000 seconds] [Time delta from previous displayed frame: 0.060761000 seconds] [Time since reference or first frame: 36.283494000 seconds] Frame Number: 164 Frame Length: 292 bytes Capture Length: 292 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:data] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x9ebe1c02 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 274 Identification: 0xc359 (50009) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x44d1 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 12781, Ack: 12965, Len: 222 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 12781 (relative sequence number) [Next sequence number: 13003 (relative sequence number)] Acknowledgement number: 12965 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 33536 (scaled) Checksum: 0x8c7b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936177611, TSecr 3799763 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 163] [The RTT to ACK the segment was: 0.055439000 seconds] [Number of bytes in flight: 222] TCP segment data (222 bytes) [Reassembled TCP Segments (1573 bytes): #162(1351), #164(222)] [Frame: 162, payload: 0-1350 (1351 bytes)] [Frame: 164, payload: 1351-1572 (222 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1568 Encrypted Application Data: D362B57B3E12701147CA68DC6CABF1A40DF1F40985C520C4... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19220 Digest: 7A81926B Relay Data Length: 498 Data (498 bytes) 0000 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 0 00:00:00 GMT.. 0010 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 3a 2f Location: http:/ 0020 2f 65 6e 2e 77 69 6b 69 70 65 64 69 61 2e 6f 72 /en.wikipedia.or 0030 67 2f 77 69 6b 69 2f 54 6f 72 0d 0a 43 6f 6e 74 g/wiki/Tor..Cont 0040 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a ent-Encoding: gz 0050 69 70 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 ip..Content-Leng 0060 74 68 3a 20 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d th: 20..Content- 0070 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b Type: text/html; 0080 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a charset=utf-8.. 0090 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 20 66 72 X-Cache: MISS fr 00a0 6f 6d 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 om sq20.wikimedi 00b0 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d 4c a.org..X-Cache-L 00c0 6f 6f 6b 75 70 3a 20 4d 49 53 53 20 66 72 6f 6d ookup: MISS from 00d0 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 61 2e sq20.wikimedia. 00e0 6f 72 67 3a 33 31 32 38 0d 0a 58 2d 43 61 63 68 org:3128..X-Cach 00f0 65 3a 20 4d 49 53 53 20 66 72 6f 6d 20 6b 6e 73 e: MISS from kns 0100 71 32 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 q2.knams.wikimed 0110 69 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d ia.org..X-Cache- 0120 4c 6f 6f 6b 75 70 3a 20 4d 49 53 53 20 66 72 6f Lookup: MISS fro 0130 6d 20 6b 6e 73 71 32 2e 6b 6e 61 6d 73 2e 77 69 m knsq2.knams.wi 0140 6b 69 6d 65 64 69 61 2e 6f 72 67 3a 33 31 32 38 kimedia.org:3128 0150 0d 0a 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 20 ..X-Cache: MISS 0160 66 72 6f 6d 20 6b 6e 73 71 32 2e 6b 6e 61 6d 73 from knsq2.knams 0170 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 0d 0a .wikimedia.org.. 0180 58 2d 43 61 63 68 65 2d 4c 6f 6f 6b 75 70 3a 20 X-Cache-Lookup: 0190 4d 49 53 53 20 66 72 6f 6d 20 6b 6e 73 71 32 2e MISS from knsq2. 01a0 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e knams.wikimedia. 01b0 6f 72 67 3a 38 30 0d 0a 56 69 61 3a 20 31 2e 30 org:80..Via: 1.0 01c0 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 61 2e sq20.wikimedia. 01d0 6f 72 67 3a 33 31 32 38 20 28 73 71 75 69 64 2f org:3128 (squid/ 01e0 32 2e 36 2e 53 54 41 42 4c 45 32 31 29 2c 20 31 2.6.STABLE21), 1 01f0 2e 30 .0 Data: 302030303A30303A303020474D540D0A4C6F636174696F6E... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19220 Digest: 2AA74BF5 Relay Data Length: 150 Data (150 bytes) 0000 20 6b 6e 73 71 32 2e 6b 6e 61 6d 73 2e 77 69 6b knsq2.knams.wik 0010 69 6d 65 64 69 61 2e 6f 72 67 3a 33 31 32 38 20 imedia.org:3128 0020 28 73 71 75 69 64 2f 32 2e 36 2e 53 54 41 42 4c (squid/2.6.STABL 0030 45 32 31 29 2c 20 31 2e 30 20 6b 6e 73 71 32 2e E21), 1.0 knsq2. 0040 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e knams.wikimedia. 0050 6f 72 67 3a 38 30 20 28 73 71 75 69 64 2f 32 2e org:80 (squid/2. 0060 36 2e 53 54 41 42 4c 45 32 31 29 0d 0a 43 6f 6e 6.STABLE21)..Con 0070 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a nection: close.. 0080 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 ................ 0090 00 00 00 00 00 00 ...... Data: 206B6E7371322E6B6E616D732E77696B696D656469612E6F... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 19220 Digest: AC22D606 Relay Data Length: 1 Relay End Reason: (Anonymized TCP connection was closed) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 165 36.290987 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 165 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:22.403774000 [Time delta from previous captured frame: 0.007493000 seconds] [Time delta from previous displayed frame: 0.007493000 seconds] [Time since reference or first frame: 36.290987000 seconds] Frame Number: 165 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54f3 (21747) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3eb [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 12965, Ack: 13003, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 12965 (relative sequence number) [Next sequence number: 13551 (relative sequence number)] Acknowledgement number: 13003 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35456 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3799778, TSecr 936177611 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 164] [The RTT to ACK the segment was: 0.007493000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F491E7D76913235A539D1B8248A3FA8DE490301D0F16229F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 1C4EA2E8E2DA3DBD0BB16CDA90164A4D363ACDC243D0D390... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 19221 Digest: 8C02851E Relay Data Length: 16 Resolve Address: 91.198.174.2:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 167 36.924690 89.253.105.39 192.168.1.34 Tor Tor Cell: (Negotiate proto version), Tor Cell: (Time and address info) Frame 167 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:23.037477000 [Time delta from previous captured frame: 0.550448000 seconds] [Time delta from previous displayed frame: 0.633703000 seconds] [Time since reference or first frame: 36.924690000 seconds] Frame Number: 167 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x941419b2 [correct] Internet Protocol, Src: 89.253.105.39 (89.253.105.39), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x9a0c (39436) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: TCP (0x06) Header checksum: 0x247f [correct] [Good: True] [Bad : False] Source: 89.253.105.39 (89.253.105.39) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 34813 (34813), Seq: 2561, Ack: 1815, Len: 586 Source port: 9001 (9001) Destination port: 34813 (34813) [Stream index: 2] Sequence number: 2561 (relative sequence number) [Next sequence number: 3147 (relative sequence number)] Acknowledgement number: 1815 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 9600 (scaled) Checksum: 0x1517 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 4248441342, TSecr 3799654 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4624CC3EE2C8A578F2A80C5D1A2C40B0B2A2D964375F014A... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: A28576B716CD8941FEB778A61DE1940DDE6FA4BAEC171D08... Tor Protocol CircID: 0 Command: (Negotiate proto version) (0x07) Payload: Length: 0004 Supported Version: 0001 Supported Version: 0002 CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081702 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 78.16.255.227 (78.16.255.227) Number of Addresses: 1 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 This OR's Address: 89.253.105.39 (89.253.105.39) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 168 36.929072 192.168.1.34 89.253.105.39 Tor Tor Cell: (Time and address info) Frame 168 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:23.041859000 [Time delta from previous captured frame: 0.004382000 seconds] [Time delta from previous displayed frame: 0.004382000 seconds] [Time since reference or first frame: 36.929072000 seconds] Frame Number: 168 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xfa90 (64144) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb8fa [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 1815, Ack: 3147, Len: 586 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 1815 (relative sequence number) [Next sequence number: 2401 (relative sequence number)] Acknowledgement number: 3147 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x875f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3799938, TSecr 4248441342 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 167] [The RTT to ACK the segment was: 0.004382000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 120FA73C74962E3CA0856478ED34DB90CE0BFBFBFD5CE813... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 29953A4A056131BA0DEC283EB7874442F26F5781D1348089... Tor Protocol CircID: 0 Command: (Time and address info) (0x08) Payload: Timestamp: 1231081703 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 Other OR's Address: 89.253.105.39 (89.253.105.39) Number of Addresses: 1 Address Type: IPV4_ADDRESS (0x04) Address Length: 4 This OR's Address: 78.16.255.227 (78.16.255.227) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 170 37.013329 192.168.1.34 89.253.105.39 Tor Tor Cell: (Create a circuit), Tor Cell: (Create a circuit) Frame 170 (1164 bytes on wire, 1164 bytes captured) Arrival Time: Jan 4, 2009 15:08:23.126116000 [Time delta from previous captured frame: 0.000019000 seconds] [Time delta from previous displayed frame: 0.084257000 seconds] [Time since reference or first frame: 37.013329000 seconds] Frame Number: 170 Frame Length: 1164 bytes Capture Length: 1164 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1150 Identification: 0xfa91 (64145) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb6f9 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 2401, Ack: 3147, Len: 1098 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 2401 (relative sequence number) [Next sequence number: 3499 (relative sequence number)] Acknowledgement number: 3147 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13440 (scaled) Checksum: 0x895f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3799959, TSecr 4248441364 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 169] [The RTT to ACK the segment was: 0.000019000 seconds] [Number of bytes in flight: 1098] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F7A6F6A283AC34DDD52BAB0DB2FA8DAACDD3D9CEB0909247... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1056 Encrypted Application Data: 8415B3936270B80339F25FFDA45BED3B6E7D5D9D08A98B8E... Tor Protocol CircID: 2069 Command: (Create a circuit) (0x01) Payload: Create Payload: 087AD0DAD6141E058FAE9C5B4BF9629D4C3938C47791B249... CircID: 2070 Command: (Create a circuit) (0x01) Payload: Create Payload: 8707B99DD59C12B5F0D3D0099320C706C32F1AB00C817B06... No. Time Source Destination Protocol Info 172 37.272336 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 172 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:23.385123000 [Time delta from previous captured frame: 0.166742000 seconds] [Time delta from previous displayed frame: 0.259007000 seconds] [Time since reference or first frame: 37.272336000 seconds] Frame Number: 172 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x6df585bf [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc35b (50011) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4363 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 13003, Ack: 13551, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 13003 (relative sequence number) [Next sequence number: 13589 (relative sequence number)] Acknowledgement number: 13551 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 34688 (scaled) Checksum: 0x21f2 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936177860, TSecr 3799778 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 68734C7EACE8D5EC8AAFB62BF135CACFCFD585901ADF7934... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: D61C29F5627ABC2ABE6D12C70BDFDBB8ED81CD5AA4A971CE... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_CONNECTED (0x04) Recognized: 0000 Stream ID: 19221 Digest: 2875B00B Relay Data Length: 8 Relay Connected IP: 91.198.174.2 (91.198.174.2) Relay Connected TTL: 1800 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 173 37.272655 192.168.1.34 91.208.34.1 HTTP GET /wiki/Tor HTTP/1.1 Frame 173 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:23.385442000 [Time delta from previous captured frame: 0.000319000 seconds] [Time delta from previous displayed frame: 0.000319000 seconds] [Time since reference or first frame: 37.272655000 seconds] Frame Number: 173 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54f4 (21748) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ea [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 13551, Ack: 13589, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 13551 (relative sequence number) [Next sequence number: 14137 (relative sequence number)] Acknowledgement number: 13589 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 38272 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3800024, TSecr 936177860 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 172] [The RTT to ACK the segment was: 0.000319000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4E625D13DE9A73386040DB62955165D07B075C4D193CF2C6... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: F40A353C49FDD4124FEC507020D87F4A4168876317F6ECC4... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: B17A3292 Relay Data Length: 250 Hypertext Transfer Protocol GET /wiki/Tor HTTP/1.1\r\n Request Method: GET Request URI: /wiki/Tor Request Version: HTTP/1.1 Accept: text/html, image/jpeg, image/png, text/*, image/*, */*\r\n Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n Accept-Charset: utf-8, utf-8;q=0.5, *;q=0.5\r\n Accept-Language: en\r\n Host: en.wikipedia.org\r\n Connection: close\r\n \r\n No. Time Source Destination Protocol Info 175 38.322268 91.208.34.1 192.168.1.34 HTTP HTTP/1.0 200 OK Frame 175 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.435055000 [Time delta from previous captured frame: 0.986167000 seconds] [Time delta from previous displayed frame: 1.049613000 seconds] [Time since reference or first frame: 38.322268000 seconds] Frame Number: 175 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x24060796 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc35d (50013) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4361 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 13589, Ack: 14137, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 13589 (relative sequence number) [Next sequence number: 14175 (relative sequence number)] Acknowledgement number: 14137 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35840 (scaled) Checksum: 0x4eeb [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178122, TSecr 3800024 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: EB286B8D2F5805D98B572595DF9D64783BF8FEA8D8001C02... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 9C37554C07F859047A47EC9CC685C17C6AB55F27AA300E2E... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: BB784641 Relay Data Length: 498 Hypertext Transfer Protocol HTTP/1.0 200 OK\r\n Request Version: HTTP/1.0 Response Code: 200 Date: Sat, 03 Jan 2009 13:25:16 GMT\r\n Server: Apache\r\n X-Powered-By: PHP/5.2.4-2ubuntu5wm1\r\n Cache-Control: private, s-maxage=0, max-age=0, must-revalidate\r\n Content-Language: en\r\n Vary: Accept-Encoding,Cookie\r\n [truncated] X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=enwikiToken;string-contains=enwikiLoggedOut;string-contains=enwiki_session;string-contains=centralauth_Token;string-contains=centralauth_Session;string-c Last-Modified: Sa No. Time Source Destination Protocol Info 180 38.387130 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data) Frame 180 (1458 bytes on wire, 1458 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.499917000 [Time delta from previous captured frame: 0.014394000 seconds] [Time delta from previous displayed frame: 0.064862000 seconds] [Time since reference or first frame: 38.387130000 seconds] Frame Number: 180 Frame Length: 1458 bytes Capture Length: 1458 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:data:data:data:data:data:data:ssl] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xe6cca4b2 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1440 Identification: 0xc360 (50016) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x403c [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 16951, Ack: 14137, Len: 1388 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 16951 (relative sequence number) [Next sequence number: 18339 (relative sequence number)] Acknowledgement number: 14137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35840 (scaled) Checksum: 0x614e [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178136, TSecr 3800288 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 179] [The RTT to ACK the segment was: 0.014394000 seconds] [Number of bytes in flight: 1388] TCP segment data (1362 bytes) TCP segment data (26 bytes) [Reassembled TCP Segments (4101 bytes): #176(1351), #178(1388), #180(1362)] [Frame: 176, payload: 0-1350 (1351 bytes)] [Frame: 178, payload: 1351-2738 (1388 bytes)] [Frame: 180, payload: 2739-4100 (1362 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: 10F6A1B7F5FC4A93CD7FB64A3734398D21FF57C497D6EDD7... SSL segment data (480 bytes) Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: CB59462B Relay Data Length: 498 Data (498 bytes) 0000 74 2c 20 32 30 20 44 65 63 20 32 30 30 38 20 31 t, 20 Dec 2008 1 0010 31 3a 33 39 3a 34 32 20 47 4d 54 0d 0a 43 6f 6e 1:39:42 GMT..Con 0020 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 tent-Encoding: g 0030 7a 69 70 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e zip..Content-Len 0040 67 74 68 3a 20 31 30 35 38 36 0d 0a 43 6f 6e 74 gth: 10586..Cont 0050 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 ent-Type: text/h 0060 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 tml; charset=utf 0070 2d 38 0d 0a 58 2d 43 61 63 68 65 3a 20 48 49 54 -8..X-Cache: HIT 0080 20 66 72 6f 6d 20 73 71 32 33 2e 77 69 6b 69 6d from sq23.wikim 0090 65 64 69 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 edia.org..X-Cach 00a0 65 2d 4c 6f 6f 6b 75 70 3a 20 48 49 54 20 66 72 e-Lookup: HIT fr 00b0 6f 6d 20 73 71 32 33 2e 77 69 6b 69 6d 65 64 69 om sq23.wikimedi 00c0 61 2e 6f 72 67 3a 33 31 32 38 0d 0a 41 67 65 3a a.org:3128..Age: 00d0 20 39 32 35 38 37 0d 0a 58 2d 43 61 63 68 65 3a 92587..X-Cache: 00e0 20 48 49 54 20 66 72 6f 6d 20 6b 6e 73 71 31 2e HIT from knsq1. 00f0 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e knams.wikimedia. 0100 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d 4c 6f 6f org..X-Cache-Loo 0110 6b 75 70 3a 20 48 49 54 20 66 72 6f 6d 20 6b 6e kup: HIT from kn 0120 73 71 31 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 sq1.knams.wikime 0130 64 69 61 2e 6f 72 67 3a 33 31 32 38 0d 0a 58 2d dia.org:3128..X- 0140 43 61 63 68 65 3a 20 4d 49 53 53 20 66 72 6f 6d Cache: MISS from 0150 20 6b 6e 73 71 37 2e 6b 6e 61 6d 73 2e 77 69 6b knsq7.knams.wik 0160 69 6d 65 64 69 61 2e 6f 72 67 0d 0a 58 2d 43 61 imedia.org..X-Ca 0170 63 68 65 2d 4c 6f 6f 6b 75 70 3a 20 4d 49 53 53 che-Lookup: MISS 0180 20 66 72 6f 6d 20 6b 6e 73 71 37 2e 6b 6e 61 6d from knsq7.knam 0190 73 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 3a s.wikimedia.org: 01a0 38 30 0d 0a 56 69 61 3a 20 31 2e 30 20 73 71 32 80..Via: 1.0 sq2 01b0 33 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 3a 3.wikimedia.org: 01c0 33 31 32 38 20 28 73 71 75 69 64 2f 32 2e 36 2e 3128 (squid/2.6. 01d0 53 54 41 42 4c 45 32 31 29 2c 20 31 2e 30 20 6b STABLE21), 1.0 k 01e0 6e 73 71 31 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d nsq1.knams.wikim 01f0 65 64 ed Data: 742C2032302044656320323030382031313A33393A343220... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 2797DF23 Relay Data Length: 452 Data (452 bytes) 0000 69 61 2e 6f 72 67 3a 33 31 32 38 20 28 73 71 75 ia.org:3128 (squ 0010 69 64 2f 32 2e 36 2e 53 54 41 42 4c 45 32 31 29 id/2.6.STABLE21) 0020 2c 20 31 2e 30 20 6b 6e 73 71 37 2e 6b 6e 61 6d , 1.0 knsq7.knam 0030 73 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 3a s.wikimedia.org: 0040 38 30 20 28 73 71 75 69 64 2f 32 2e 36 2e 53 54 80 (squid/2.6.ST 0050 41 42 4c 45 32 31 29 0d 0a 43 6f 6e 6e 65 63 74 ABLE21)..Connect 0060 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 1f 8b ion: close...... 0070 08 00 00 00 00 00 00 03 cd 7d e9 76 db 48 92 ee .........}.v.H.. 0080 ef f6 53 a4 59 b7 4a 56 8f 48 8a da 6c c9 12 e6 ..S.Y.JV.H..l... 0090 c8 f2 da 65 d9 1a cb 2e df 39 9e ba 3c 20 01 8a ...e.....9..< .. 00a0 b0 40 80 0d 80 a2 58 3d 7d 4e bf c3 cc 8b dc fb .@....X=}N...... 00b0 0a f3 26 f3 24 f7 8b c8 15 0b a9 a5 dc 9e ae ee ..&.$........... 00c0 63 11 c8 44 66 64 66 64 64 ec 79 f8 f0 f9 fb 93 c..Dfdfdd.y..... 00d0 8f ff 7a f6 42 8c 8b 49 2c ce 3e 3d 7b fb e6 44 ..z.B..I,.>={..D 00e0 b4 da dd ee e7 ed 93 6e f7 f9 c7 e7 e2 7f bf fe .......n........ 00f0 78 fa 56 f4 3a 9b e2 63 e6 27 79 54 44 69 e2 c7 x.V.:..c.'yTDi.. 0100 dd ee 8b 77 2d d1 1a 17 c5 f4 a0 db 9d cf e7 9d ...w-........... 0110 f9 76 27 cd 2e ba 1f 3f 74 af a9 ad 1e 7d ac 7e .v'....?t....}.~ 0120 b6 0b e7 cb 4e 50 04 2d ef c1 21 77 78 3d 89 93 ....NP.-..!wx=.. 0130 fc a8 a1 99 de fe fe be fc ba 45 95 0e 62 3f b9 ..........E..b?. 0140 38 6a 85 49 4b d8 5f 41 94 1d b5 e2 22 43 6b 7f 8j.IK._A...."Ck. 0150 38 1c 87 7e 80 bf 7f 38 9c 84 85 8f d1 14 d3 76 8..~...8.......v 0160 f8 e7 59 74 75 d4 3a 49 93 22 4c 8a f6 c7 c5 34 ..Ytu.:I."L....4 0170 6c 89 a1 7c 3a 6a 15 e1 75 d1 a5 0e 9e 8a e1 d8 l..|:j..u....... 0180 cf f2 b0 38 9a 15 a3 f6 93 96 e8 ae 6e e7 bc 58 ...8........n..X 0190 c4 61 63 6b c3 3c 2f 7d 9d f8 93 f0 a8 75 11 26 .ack...I. 01a0 96 5f cb e1 d1 fb ab 28 9c d7 67 fe 4d 40 65 db ._.....(..g.M@e. 01b0 bd ed c7 db 4e e1 9b 5c cd 19 0a 8b 6c e6 4c d7 ....N..\....l.L. 01c0 a7 3c cc 14 dc c9 2c 8e 2d 64 54 f0 0a 02 ef 94 .<....,.-dT..... 01d0 a6 b1 5e f4 16 f2 c0 0c 63 a6 de c0 ae da ef 94 ..^.....c....... 01e0 1e 61 69 f9 b3 2c f4 2f 5f 66 34 ad f5 b9 3a 99 .ai..,./_f4...:. 01f0 65 1f e. Data: C49B1762B7B3BBB9B9F9ABE790F6FB2C86998C372F76375F... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: BAF12170 Relay Data Length: 452 Data (452 bytes) 0000 c2 ab 28 c7 10 e5 40 b6 76 f7 7b 3b 4f 7a 8f 37 ..(...@.v.{;Oz.7 0010 5d 2c 08 33 aa 40 c5 56 2d 60 01 78 91 f8 83 38 ],.3.@.V-`.x...8 0020 3c 3e 7b 53 1b ab 2c f9 0c 99 bf b1 f8 1c 18 cf <>{S..,......... 0030 1a 08 d6 e0 8c 20 fa 7f a4 fa 68 e6 4b ab b5 81 ..... ....h.K... 0040 d5 ff d5 76 f2 3c ba 88 8a 5b d4 3b fd 7c 3e bb ...v.<...[.;.|>. 0050 80 e0 54 7c 0c 27 d3 18 ba 80 15 e8 07 a4 f7 a7 ..T|.'.......... 0060 11 0b f5 4a 8c b7 72 e7 bf 5d 6f ed 49 29 f5 e8 ...J..r..]o.I).. 0070 2f f2 ef c7 10 aa 89 bf d2 7b d2 9f 30 8a 1e fd /........{..0... 0080 c5 fc cc ff ea 4c d8 f3 67 f4 5e ae 14 6b 1d dc .....L..g.^..k.. 0090 3d 41 6d 19 14 a5 25 f9 b2 e9 8c d3 c0 7f 1a e6 =Am...%......... 00a0 39 96 9b 2b b4 e6 11 28 43 2e 07 86 95 c8 69 76 9..+...(C.....iv 00b0 92 b4 f4 c6 69 e3 03 6a 65 11 e3 2d ab 39 d0 42 ....i..je..-.9.B 00c0 73 e9 69 7a c5 b3 cd a5 dd 3f fe fa ab f7 c7 ae s.iz.....?...... 00d0 a5 90 55 1a 57 23 71 77 a4 c6 34 13 83 a8 28 91 ..U.W#qw..4...(. 00e0 63 f0 fd 42 bf 17 5f 73 01 5e bb 44 a2 a9 fc 35 c..B.._s.^.D...5 00f0 54 68 42 52 31 ae f0 ad e1 f2 bf fa d7 cb 8e 88 ThBR1........... 0100 6f 79 1a 4d e6 6a 05 1b 3b 5b 7d f0 55 4e 13 3a oy.M.j..;[}.UN.: 0110 4b e6 17 ef 52 d0 fe f0 68 6d ed a9 fb fc 36 05 K...R...hm....6. 0120 15 a5 97 0f aa 2b 5a 39 b3 ee b1 9e a4 99 c8 fc .....+Z9........ 0130 38 e1 8e f9 ac 61 e1 bd 1b 26 dd 52 d1 ef 98 ce 8....a...&.R.... 0140 06 9e af 91 d5 20 be e2 ab e1 bd e9 60 3d 32 a7 ..... ......`=2. 0150 2a ce 6a e0 0d 74 c2 61 1d a7 0e bb 52 25 7b 38 *.j..t.a....R%{8 0160 48 83 85 18 c6 7e 0e 45 2f b3 73 34 1c 48 a0 99 H....~.E/.s4.H.. 0170 48 f2 f6 26 fd 93 cf 06 5f c3 61 c1 1a c2 36 a9 H..&...._.a...6. 0180 31 a8 97 b6 ed 05 ea dd 20 ba 12 51 00 65 6a 9c 1....... ..Q.ej. 0190 0e fc f8 73 06 7d 5a c8 8a 5f 5b 34 4c e3 d9 24 ...s.}Z.._[4L..$ 01a0 69 2b 55 29 2b 85 f5 57 ce bb 3f 1c fa 42 ea 65 i+U)+..W..?..B.e 01b0 8b 14 ba 2e 6a 93 7e 60 37 f8 a5 d6 68 50 72 dd ....j.~`7...hPr. 01c0 51 e6 62 e7 Q.b. Data: C2AB28C710E540B676F77B3B4F7A8F375D2C0833AA40C556... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 31AD4154 Relay Data Length: 498 Data (498 bytes) 0000 5a 85 01 59 f3 20 4f 3f d2 48 22 1e 1e 89 b5 b5 Z..Y. O?.H"..... 0010 75 11 a4 c3 d9 04 8b d8 99 13 51 8e 13 53 61 fd u.........Q..Sa. 0020 a9 d9 77 87 5d c0 e7 61 04 e3 9e 9e 9f 51 94 e5 ..w.]..a.....Q.. 0030 05 ed c3 08 ea 41 d2 e8 60 16 7b 25 b8 68 36 d5 .....A..`.{%.h6. 0040 49 c4 c3 c7 d7 db 3c 0a 02 f8 7c 36 68 79 2f 33 I.....<...|6hy/3 0050 e8 9c 6e 56 03 8d b7 e5 e7 95 39 e2 26 24 64 54 ..nV......9.&$dT 0060 2c ff 33 95 be ce 26 53 68 3d db 89 7f d5 f2 fe ,.3...&Sh=...... 0070 84 07 51 a4 07 02 53 2a 35 80 3f a8 35 20 ad b1 ..Q...S*5.?.5 .. 0080 87 3a d1 05 eb 84 69 6e 37 9c 5a 92 ce bf 49 a6 .:....in7.Z...I. 0090 b3 a2 e5 c9 07 aa a2 e7 83 b5 14 22 2f fc ac d0 ..........."/... 00a0 8a 6f 45 8e 24 20 0a 97 02 9c 61 50 49 63 9a 48 .oE.$ ....aPIc.H 00b0 bb 8c ca c4 9f 09 fa 39 48 a1 42 f5 c5 45 98 c6 .......9H.B..E.. 00c0 e9 05 f1 3a 82 ce 3c 06 a5 23 c4 4b 20 18 a9 c6 ...:..<..#.K ... 00d0 88 11 5a 4c a2 df 30 d5 02 f4 39 8b 7d a0 69 3a ..ZL..0...9.}.i: 00e0 01 50 e0 65 92 b0 80 ea fd 72 43 e4 d0 9f 99 f1 .P.e.....rC..... 00f0 49 ae 0f cb d2 7f a4 be 2e 16 7d 55 15 1a 52 a5 I.........}U..R. 0100 a4 24 0c b6 e5 ba a9 75 5e cf a6 02 1a 7b 87 c1 .$.....u^....{.. 0110 4a 01 57 26 20 e2 e6 cb 3b 0e a2 dc 9f 0c 22 f0 J.W& ...;.....". 0120 28 34 9e 4a af d5 42 d9 65 e5 2d f7 a7 96 d8 9d (4.J..B.e.-..... 0130 d0 62 0c 3e 0e 5c 14 eb 74 b1 71 9d b9 e6 a2 28 .b.>.\..t.q....( 0140 81 21 03 a2 01 b1 d0 47 38 2a 83 62 7c b0 bd bb .!.....G8*.b|... 0150 35 bd 7e 0a 8c d1 28 20 a7 e8 65 14 87 07 af fd 5.~...( ..e..... 0160 f9 e5 8f 5b 8f f3 3e 80 e8 7c 9d 42 df ad 56 8e ...[..>..|.B..V. 0170 d9 7f 33 5d 54 6d 2d 17 64 d9 10 60 7e 1c 2b 06 ..3]Tm-.d..`~.+. 0180 9a 8d 26 17 02 e6 86 a3 d6 2d 44 92 12 99 64 88 ..&......-D...d. 0190 bb 8f bb 8f 9f 74 ab 70 74 b7 77 37 a7 d7 ed 3a .....t.pt.w7...: 01a0 78 3c a4 a3 16 8a a1 55 0e 69 1a 8e 5a 5b 7b db x<.....U.i..Z[{. 01b0 2d 31 80 15 26 84 b1 09 ef d5 10 e4 84 c8 71 40 -1..&.........q@ 01c0 64 21 e2 51 9b af a1 cf 2a f7 ca 54 e2 1b 58 5c d!.Q....*..T..X\ 01d0 16 77 9d 32 58 ad 60 72 b1 9a f0 17 49 ec 67 e8 .w.2X.`r....I.g. 01e0 5d 4e d1 dd c4 35 86 3b 87 ee 92 21 69 0f e3 68 ]N...5.;...!i..h 01f0 2a ed *. Data: 5A850159F3204F3FD248221E1E89B5B57511A4C3D9048BD8... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 47B38C6F Relay Data Length: 498 Data (498 bytes) 0000 11 6a 02 7a bb 76 fc bd 5e 4b 2f 80 1c a7 42 9c .j.z.v..^K/...B. 0010 ca aa 55 d6 5f 2e 62 9f 4c 51 66 9d 4b 0b eb 3c ..U._.b.LQf.K..< 0020 38 8d 6a a4 94 e4 e7 70 ea 1d 8b c3 81 07 c6 f5 8.j....p........ 0030 b0 3b f0 78 6b 57 f7 e2 87 74 78 d9 7f 24 77 fa .;.xkW...tx..$w. 0040 c2 6e 06 7a 2d ec 6b 2f c3 33 f5 23 40 19 86 59 .n.z-.k/.3.#@..Y 0050 3a 65 82 10 06 62 b0 a8 36 f8 39 84 80 15 42 53 :e...b..6.9...BS 0060 8c e9 d0 46 07 fb ca 9b 9b df 92 a8 cd f2 99 1f ...F............ 0070 c7 0b b4 37 4b 02 42 5f ec b7 04 14 8d 29 4c 3e ...7K.B_.....)L> 0080 9b 4c c0 16 a6 a3 3a dc af a3 d8 ae 25 3f 78 63 .L....:.....%?xc 0090 fc 2b 49 c1 9b 84 3f af cc e9 39 60 1f f7 3f 83 .+I...?...9`..?. 00a0 e7 ec bf 48 2e 60 06 85 52 57 41 c8 45 82 8a 84 ...H.`..RWA.E... 00b0 2e f2 9c 77 00 40 bd 96 40 cf 31 c0 90 bb 00 52 ...w.@..@.1....R 00c0 4d 00 32 78 7e 32 e7 05 1b 02 e0 d2 34 c7 79 0a M.2x~2......4.y. 00d0 98 c9 f8 48 d4 28 a0 e9 e2 fa 04 63 4e bf 26 79 ...H.(.....cN.&y 00e0 18 5f 81 69 fe ef bf fd 07 8e 6d a2 bd 33 e0 23 ._.i......m..3.# 00f0 26 42 d6 ba 18 8b 69 0a 6d 7b 4e 83 af 8c e3 39 &B....i.m{N....9 0100 aa 4f 5c c4 30 2f 3c fd 8b 97 0a 12 7c f5 cb 10 .O\.0/<.....|... 0110 66 4e 33 e8 e7 fc e4 f1 1f fe 00 33 52 fd e2 ae fN3........3R... 0120 78 d8 d0 e9 49 9a 25 73 ac b1 e9 d7 bc f0 f4 2f x...I.%s......./ 0130 45 50 a7 40 d9 82 05 2b c9 55 0c 2d b5 a0 df 84 EP.@...+.U.-.... 0140 0d 7e b6 30 06 e9 9c 08 43 91 d1 3f c4 26 e9 73 .~.0....C..?.&.s 0150 18 df f1 aa b2 8d 7c 0b 7d b0 bd 3a 07 23 b0 85 ......|.}..:.#.. 0160 37 6a 67 cc 62 fc 8e 23 43 8d 52 1c 7d 57 61 dc 7jg.b..#C.R.}Wa. 0170 ee 39 64 e5 07 12 7e 88 79 99 fa 89 53 31 61 61 .9d...~.y...S1aa 0180 bd e5 f5 c0 87 a0 c4 13 d5 0a c4 df b4 3c fa 58 .............<.X 0190 d5 90 1b 34 8e 6e d1 25 88 78 de 4f 93 be 5d d2 ...4.n.%.x.O..]. 01a0 65 dd 6f ad ee 9e 1a a2 ed 64 31 82 81 bd 03 28 e.o......d1....( 01b0 ef 69 1b f7 41 3b 30 cf cb 80 d8 5e 0d 04 37 01 .i..A;0....^..7. 01c0 0e 27 c3 ec 9b ee 1f 1c 2e 9b fc 2d 77 f2 95 01 .'.........-w... 01d0 be ff 26 87 61 6d 05 04 9d 1b d6 41 1b f2 b9 9d ..&.am.....A.... 01e0 5b 2d 48 09 8c 77 30 28 8f fb c7 13 50 b4 a1 bf [-H..w0(....P... 01f0 0a 8c .. Data: 116A027ABB76FCBD5E4B2F801CA7429CCAAA55D65F2E629F... Secure Socket Layer No. Time Source Destination Protocol Info 186 38.443222 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 186 (1458 bytes on wire, 1458 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.556009000 [Time delta from previous captured frame: 0.050707000 seconds] [Time delta from previous displayed frame: 0.056092000 seconds] [Time since reference or first frame: 38.443222000 seconds] Frame Number: 186 Frame Length: 1458 bytes Capture Length: 1458 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor:data:data:data:data:data:data:data:ssl] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x5f9ef3b8 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1440 Identification: 0xc363 (50019) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4039 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 21115, Ack: 14137, Len: 1388 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 21115 (relative sequence number) [Next sequence number: 22503 (relative sequence number)] Acknowledgement number: 14137 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35840 (scaled) Checksum: 0xe9e0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178147, TSecr 3800299 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 185] [The RTT to ACK the segment was: 0.050707000 seconds] [Number of bytes in flight: 1388] TCP segment data (1336 bytes) TCP segment data (15 bytes) [Reassembled TCP Segments (4101 bytes): #182(1377), #184(1388), #186(1336)] [Frame: 182, payload: 0-1376 (1377 bytes)] [Frame: 184, payload: 1377-2764 (1388 bytes)] [Frame: 186, payload: 2765-4100 (1336 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: DB7A9C3D5622DEDEB93AC887B6C1DC479547DBCB7C1ADA43... SSL segment data (4064 bytes) SSL segment data (448 bytes) [Reassembled SSL Segments (512 bytes): #180(480), #186(32)] [Frame: 180, payload: 0-479 (480 bytes)] [Frame: 186, payload: 480-511 (32 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 73254E57 Relay Data Length: 498 Data (498 bytes) 0000 1b d6 83 db 11 aa 9d bb 83 71 3c ba a9 ff 1b 96 .........q<..... 0010 42 36 50 ef b8 cb 8b 71 3b e4 3c 0f c3 3e 51 b6 B6P....q;.<..>Q. 0020 e5 d3 b0 b3 1a 1f d0 00 93 c6 5b 8d bf b4 15 5f ..........[...._ 0030 5c cb e3 bb 4f 1c eb 0a 74 d8 5d 0d 80 6e 06 ce \...O...t.]..n.. 0040 19 68 e6 ee 60 7c 08 e1 ea 01 6b f0 2a 8c dc 5b .h..`|....k.*..[ 0050 0d 82 6d 62 e9 62 30 39 eb 32 65 eb 32 3d c4 8f ..mb.b09.2e.2=.. 0060 95 f2 bd f7 a0 db 35 3a dc 07 82 e5 29 f8 81 a4 ......5:....)... 0070 f3 0e 1c 22 e6 1f d3 e1 c7 f4 e2 22 0e d7 c5 5f ..."......."..._ 0080 04 09 e0 a0 90 e7 f4 1e 74 8a 54 3f 54 a7 f5 54 ........t.T?T..T 0090 97 bc 8e 82 50 97 8c f1 1b 25 a5 46 1e ad 3f 15 ....P....%.F..?. 00a0 7f 15 e8 10 4a 18 c0 a7 b5 d4 e0 35 8c 60 c8 74 ....J......5.`.t 00b0 93 69 b8 a2 a0 4c ff 88 ba 83 04 97 48 09 f9 9d .i...L......H... 00c0 e4 90 5c 99 cb fb e2 9c 56 b7 71 63 61 ad bd fa ..\.....V.qca... 00d0 fa 08 5c 96 eb be a2 5e 1f 08 09 01 f5 43 a4 ef ..\....^.....C.. 00e0 d7 c6 b5 99 cc db 24 6a 03 27 50 b5 44 b7 f9 c8 ......$j.'P.D... 00f0 a8 b2 f1 77 e4 f0 b7 36 97 73 f8 9a dc 9f 80 fd ...w...6.s...... 0100 4a c2 38 07 c3 37 4b 0a 98 c4 fb ef 9e f5 a1 69 J.8..7K........i 0110 f6 03 7f 6b 05 e7 0f e7 a4 71 96 a6 93 36 7c 08 ...k.....q...6|. 0120 a0 df 60 4a 4b 44 5f 37 07 7f 25 d9 9c 78 f4 2e ..`JKD_7..%..x.. 0130 9c 8b 67 d9 2c c9 e7 30 7e af 6f 08 d9 b8 78 f4 ..g.,..0~.o...x. 0140 e6 83 f8 ec c7 97 20 d3 bd fd 27 7b 90 b1 ee 29 ...... ...'{...) 0150 31 48 4f 82 bc 2b c5 86 cd ee e6 3e 89 79 7c 96 1HO..+.....>.y|. 0160 dd 34 b8 ee d6 26 89 13 b7 ad 6e b8 6c 7c e6 88 .4...&....n.l|.. 0170 19 fb e0 b9 bf 9b 98 71 7b 58 b5 c4 f6 8f 26 7e .......q{X....&~ 0180 2c 43 9d 0a c7 58 5f 3b c2 a4 be c5 24 87 ab 93 ,C...X_;....$... 0190 28 bc 14 e7 5a 60 c5 6e a8 22 b9 eb 25 a8 59 91 (...Z`.n."..%.Y. 01a0 6d 8c 88 f3 11 0c 33 33 da 6b 40 ff 35 c3 7d 33 m.....33.k@.5.}3 01b0 db 0d cc cf 89 b5 c7 d9 51 93 53 7c e2 2b 8c 88 ........Q.S|.+.. 01c0 c2 4f 1e b6 02 31 09 04 45 89 29 c7 9e 22 be 9c .O...1..E.)..".. 01d0 a4 20 d2 71 f8 79 41 c4 22 07 4b 3a 1c 0b 9f 19 . .q.yA.".K:.... 01e0 fa 6a fb bf a0 a9 7e 3a ea bf 8a fd 09 3c b9 7c .j....~:.....<.| 01f0 cb 77 .w Data: 1BD683DB11AA9DBB83713CBAA9FF1B96423650EFB8CB8B71... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: DCC61EEF Relay Data Length: 498 Data (498 bytes) 0000 53 09 b1 f5 b6 c4 ab bd 32 fc 78 43 cb af d2 39 S.......2.xC...9 0010 18 33 38 a7 c1 89 08 42 83 19 03 bf 17 f6 bd 57 .38....B.......W 0020 79 41 6d 3e 25 f2 40 6d ca 32 ac 18 41 c2 b2 16 yAm>%.@m.2..A... 0030 b8 ff 85 18 84 e4 18 90 4b 11 ac 82 0b ef af 41 ........K......A 0040 3b c6 fd 67 fe c2 74 29 5f 09 7a e5 d9 df 52 fa ;..g..t)_.z...R. 0050 c8 05 14 47 31 16 81 ec 54 5c 05 ad 0f 7d ac 0b ...G1...T\...}.. 0060 f7 c7 3d 51 ad 11 59 7c 58 92 84 0a 64 06 bb 91 ..=Q..Y|X...d... 0070 16 31 eb 92 4f c9 dd 12 ac 80 71 b0 54 a4 bf 54 .1..O.....q.T..T 0080 ee 38 60 7a 43 d7 4f d3 16 48 69 91 55 3c 35 bc .8`zC.O..Hi.U<5. 0090 cf 12 b8 7f f6 c9 59 96 8c 59 25 e1 85 fc 42 4d ......Y..Y%...BM 00a0 01 0b 31 78 c3 83 3e 8c a4 b0 1d b9 ea 3a a9 d1 ..1x..>......:.. 00b0 79 1f 07 90 3d e3 9c 5c 0d a5 67 27 de 40 e4 a4 y...=..\..g'.@.. 00c0 37 9e f9 69 5a 99 67 cd cd 9c 0f d3 82 1c 53 fb 7..iZ.g.......S. 00d0 af fc 10 2e a3 56 82 55 ef 85 7a ef 51 c5 5c 3d .....V.U..z.Q.\= 00e0 99 56 ff eb ff e9 66 27 a1 0f fc b9 90 10 03 15 .V....f'........ 00f0 08 e6 c3 7c 36 e5 63 7b 08 55 68 1f 0a c9 f6 49 ...|6.c{.Uh....I 0100 96 e6 39 aa f5 37 db 56 75 83 02 c9 04 b9 ec 3a ..9..7.Vu......: 0110 7f 02 75 7b 68 be a1 2f d4 48 15 c3 88 13 5e 8a ..u{h../.H....^. 0120 01 3d 66 02 cc 69 2c 85 12 74 ee ad 13 42 a0 15 .=f..i,..t...B.. 0130 16 02 49 66 1e 84 ac 5d 04 9a 62 17 e1 97 0f 67 ..If...]..b....g 0140 38 88 de e4 ce 30 9a c5 0d c2 f1 49 18 43 96 36 8....0.....I.C.6 0150 eb 66 77 b8 2c 30 eb 86 cd 2e df f0 dc c0 47 2f .fw.,0........G/ 0160 69 b3 ab 30 ce 50 74 4a 27 49 86 69 21 0a 82 17 i..0.PtJ'I.i!... 0170 50 6e c2 fd 97 04 f4 ea 9e 20 b5 40 23 9e a8 02 Pn....... .@#... 0180 07 4f d4 1b ee 0f 8e 25 a4 10 48 79 27 4c 52 e8 .O.....%..Hy'LR. 0190 c6 12 01 1f 67 d6 06 30 4d 91 fd 63 ec a4 98 45 ....g..0M..c...E 01a0 15 9c e1 d0 0d 48 08 59 1d 02 8d cd 05 94 f8 70 .....H.Y.......p 01b0 65 23 8d 09 34 f0 fa 11 ca 5a a8 22 66 f0 53 96 e#..4....Z."f.S. 01c0 5a 88 28 19 c6 33 52 87 57 41 3f c9 7c ab a2 e1 Z.(..3R.WA?.|... 01d0 07 6f 88 7f 97 69 02 c8 43 da 2c 28 3f 78 f4 2f .o...i..C.,(?x./ 01e0 57 7f d4 ca 22 cc 51 6b 1d 9b 89 74 c9 52 21 a2 W...".Qk...t.R!. 01f0 29 0b ). Data: 5309B1F5B6C4ABBD32FC7843CBAFD239183338A7C1890842... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 2CE6887E Relay Data Length: 498 Data (498 bytes) 0000 13 67 d2 2d d0 60 51 0d ca 1e 58 31 49 53 32 06 .g.-.`Q...X1IS2. 0010 e9 cc 67 d9 15 3e 0e a0 f4 20 75 87 4f ce ce a1 ..g..>... u.O... 0020 80 45 14 4c f6 9a c8 a5 af 29 56 5d a2 ab 9a b2 .E.L.....)V].... 0030 ea 6e c5 4a 96 57 da 2c 2f e8 61 0a 4f 63 45 d4 .n.J.W.,/.a.OcE. 0040 d3 11 74 01 0a a9 d8 0e 04 52 87 e9 84 89 01 5a ..t......R.....Z 0050 28 86 71 80 5d 15 8e 72 3a 39 78 6d 16 b0 63 0e (.q.]..r:9xm..c. 0060 b9 24 9f 46 aa 1e ad 92 af 6a 42 17 44 14 90 0f .$.F.....jB.D... 0070 1a 58 52 87 3e 74 cf f8 37 cb 22 6a 1a 8d 60 8d .XR.>t..7."j..`. 0080 d3 c0 5f 74 78 73 29 6e 20 49 d9 b3 48 68 d3 6f .._txs)n I..Hh.o 0090 fb 25 26 44 4b 55 5a 09 4e 13 89 fa d1 04 c4 38 .%&DKUZ.N......8 00a0 c4 b2 9b 6d c7 38 0a 3f f2 88 77 09 ce b7 0c 53 ...m.8.?..w....S 00b0 f5 d3 0f bd bd cd a7 d8 ab f0 47 38 9e 5d cc a0 ..........G8.].. 00c0 c9 02 7f 04 67 7c ad 6d 1e 63 83 b6 d9 18 7c 80 ....g|.m.c....|. 00d0 1d 36 07 ee 40 eb fc 05 db bf 32 97 c6 f0 71 70 .6..@.....2...qp 00e0 12 15 ac 22 87 82 3e 0c c8 51 b8 ea 43 6c 6a 30 ..."..>..Q..Clj0 00f0 84 a8 e1 81 0a f0 27 ea 85 dc d8 91 b3 d1 69 93 ......'.......i. 0100 4b 51 60 4a aa 75 89 dd 64 34 48 e9 b8 d6 ca c0 KQ`J.u..d4H..... 0110 3a e5 7f 05 c3 3b 06 60 cf 3a f5 ec 61 13 50 81 :....;.`.:..a.P. 0120 d4 4d d6 b6 e7 29 62 19 70 fa d2 36 e9 d3 e1 6d .M...)b.p..6...m 0130 be 77 0a f8 54 6f 79 14 f6 a0 aa f2 1b c6 18 3e .w..Toy........> 0140 1c 68 3d 13 b9 99 40 19 a4 a2 d2 87 ff 03 fd 49 .h=...@........I 0150 16 d8 cb f0 4b 80 fb 3f f6 67 98 cd a6 d0 02 8a ....K..?.g...... 0160 ab 34 c6 27 29 30 e0 11 74 ef e3 74 06 75 5e 93 .4.')0..t..t.u^. 0170 2a 0e 2e 2b 65 6d 1c bd 90 0a 39 fc 5a b6 13 4b *..+em....9.Z..K 0180 a7 9c 3d 98 dc 23 0e c4 cd 7d 74 35 b7 72 ca 79 ..=..#...}t5.r.y 0190 34 3c 14 c8 02 0a c2 74 08 ec e5 e0 14 0c 05 4b 4<.....t.......K 01a0 20 8d 29 f0 4e 0e e4 84 18 6e a7 32 94 7f 99 41 .).N....n.2...A 01b0 21 f9 9b bb 3a f6 8d f7 67 5d 28 b9 2a da 48 d4 !...:...g](.*.H. 01c0 3f 73 53 21 d8 17 d6 ee 4e a0 15 25 6f 01 fa bd ?sS!....N..%o... 01d0 00 e7 d1 a4 f5 bc 93 5e 99 55 c0 58 18 ec 21 9c .......^.U.X..!. 01e0 c7 d8 c0 05 f1 0a ac b8 95 fb 9a b4 bf 62 0e f2 .............b.. 01f0 33 24 3$ Data: 1367D22DD060510DCA1E583149533206E9CC67D9153E0EA0... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 83C04D70 Relay Data Length: 498 Data (498 bytes) 0000 cb 95 e4 14 71 de 40 01 bc 21 32 12 98 e6 50 e7 ....q.@..!2...P. 0010 c2 8e 1a 86 24 57 f1 21 40 9f 5d e8 65 0f f0 d3 ....$W.!@.].e... 0020 0f a4 ea 5a a9 b4 49 fe 62 be 26 a0 d9 c2 6f d4 ...Z..I.b.&...o. 0030 c5 ba 43 c0 95 04 19 04 06 f4 15 f3 08 2b 4d 26 ..C..........+M& 0040 be b2 76 b7 23 de d3 86 35 10 11 83 04 2a 12 5e ..v.#...5....*.^ 0050 f3 7e 90 1e e8 56 63 ce 00 fb c3 61 18 53 3c 0c .~...Vc....a.S<. 0060 95 97 98 d4 60 46 5a f7 26 5e f4 cd 10 8a 1b 87 ....`FZ.&^...... 0070 89 c1 b3 a0 67 4f fd 60 fc e0 b9 21 77 77 36 e8 ....gO.`...!ww6. 0080 c9 f1 03 10 4c 94 9c 1e 82 45 0e 80 a8 bc 59 3e ....L....E....Y> 0090 da 1b d8 16 98 29 22 76 a0 74 54 37 00 4f 07 42 .....)"v.tT7.O.B 00a0 30 64 c4 b1 c6 c3 1c 56 33 b9 f7 ed 6a f2 21 c0 0d.....V3...j.!. 00b0 e8 78 81 63 20 01 2d 26 06 31 15 c3 28 93 27 6e .x.c .-&.1..(.'n 00c0 8b db 18 00 35 93 7c ad e5 18 1e d8 06 39 84 99 ....5.|......9.. 00d0 18 d5 98 e8 00 7b 24 d8 fa b0 c9 b0 7a 34 51 76 .....{$.....z4Qv 00e0 58 b2 04 16 74 0c 51 92 f1 11 18 79 8c 13 ba 04 X...t.Q....y.... 00f0 69 fc 94 e7 bf da e5 85 bb 6d 6b 3a 89 9f 43 36 i........mk:..C6 0100 cd 55 c3 6b f8 19 38 45 3a 26 d2 4b 68 a2 0f a7 .U.k..8E:&.Kh... 0110 2c 4d 42 f1 a5 64 3b c9 62 0f 5b 37 71 dc 69 01 ,MB..d;.b.[7q.i. 0120 30 80 af 90 c1 55 b1 dc b6 56 87 6b 66 ef 58 4a 0....U...V.kf.XJ 0130 1c 0e 66 28 26 9e 15 00 64 ac 8f 92 19 e1 bb 16 ..f(&...d....... 0140 5a 68 60 83 2c bd c4 fc 42 2b 94 48 84 86 c2 1b Zh`.,...B+.H.... 0150 18 3e 21 26 1d 7f a3 df e0 7f 28 4e 89 a2 b1 91 .>!&......(N.... 0160 02 aa 1f 4d 9d e5 0e 61 d7 9e 38 05 62 4a 72 b0 ...M...a..8.bJr. 0170 21 2e 71 8e 80 30 d2 31 15 15 98 77 da 5f 74 18 !.q..0.1...w._t. 0180 8e 7d 78 eb 4c b3 f4 0a 6d 80 76 40 b5 02 c1 62 .}x.L...m.v@...b 0190 16 c5 cc 85 00 2f a0 4b c5 82 2b 9b 08 28 27 16 ...../.K..+..('. 01a0 c5 6e fd 8e 78 01 34 a0 f3 58 19 43 14 85 a7 21 .n..x.4..X.C...! 01b0 d8 9d c6 a3 c0 18 7c c1 7a 7b c1 a1 6a 90 ab 70 ......|.z{..j..p 01c0 a8 e2 ad 94 65 2a 64 0a 47 08 6a ba 27 08 3d d2 ....e*d.G.j.'.=. 01d0 01 82 bf 92 3a 99 01 61 9f cf fd 44 8f 07 13 9a ....:..a...D.... 01e0 63 61 18 46 a8 d5 22 8c 8b d8 85 61 06 e6 00 03 ca.F.."....a.... 01f0 31 cb 1. Data: CB95E41471DE4001BC21321298E650E7C28E1A862457F121... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 85CC5284 Relay Data Length: 498 Data (498 bytes) 0000 42 bb 62 92 e2 e4 85 bd 18 2b 00 b5 16 e6 41 83 B.b......+....A. 0010 4f 14 87 8c 66 bc 95 e0 f2 c5 5b 18 6b 05 05 0d O...f.....[.k... 0020 f3 0a 84 7a 64 50 02 56 10 92 52 2d d8 d9 d8 f8 ...zdP.V..R-.... 0030 9e 85 17 44 1d e5 72 62 17 84 31 0c 10 17 58 ad ...D..rb..1...X. 0040 67 20 d1 da b7 4a 91 d4 49 8a 69 60 9a aa e6 b9 g ...J..I.i`.... 0050 c1 44 77 9e c6 d1 28 9e 49 b5 9b 35 81 39 2f bd .Dw...(.I..5.9/. 0060 dc a9 62 ce 21 10 08 10 8e 98 bc 9c 14 3d 04 80 ..b.!........=.. 0070 09 ed 3c 6c 29 9a 78 3a cf eb 36 24 b8 0c fb 41 ..c.......*...... 0120 5b 1c 47 06 28 94 e2 72 0c 85 54 3c 46 85 6c 7f [.G.(..r..T...m.P...B.k. 0140 5f 7b e5 67 49 ce 99 b7 a3 ed 48 ec 3b 7a a5 4e _{.gI.....H.;z.N 0150 b7 f7 9e 88 9c 98 52 90 6a f8 d8 80 43 df df dd ......R.j...C... 0160 d1 6f 2e a3 18 42 1c 49 85 eb 52 5e 2b 29 43 ec .o...B.I..R^+)C. 0170 51 7e 83 06 c4 da 22 aa 8a 8f ad 65 8a 0f f1 86 Q~...."....e.... 0180 fd 06 88 9f 93 f2 3d 42 aa a5 04 ad cf 0f 78 ca ......=B......x. 0190 86 c5 10 42 32 71 78 92 b5 d4 e6 73 b0 d5 38 4d ...B2qx....s..8M 01a0 c1 2a 35 6b 22 d9 f2 49 aa c8 f3 21 0e 76 ab bc .*5k"..I...!.v.. 01b0 e3 f7 d4 85 7a ef 55 5e 38 56 f9 29 bc 21 c0 97 ....z.U^8V.).!.. 01c0 2a 2e 03 62 12 53 3a 96 3f 0d 7c 5a 8e c7 d1 c0 *..b.S:.?.|Z.... 01d0 e7 9c a3 30 c5 69 2a 99 7b 6d 8d e6 b3 82 98 5f ...0.i*.{m....._ 01e0 d3 e6 80 50 43 9e bf e4 3f 51 62 bc 48 7d f6 da ...PC...?Qb.H}.. 01f0 5f e0 _. Data: 42BB6292E2E485BD182B00B516E641834F14878C66BC95E0... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 671BDFB0 Relay Data Length: 498 Data (498 bytes) 0000 1b c7 e7 89 1f 3d f9 5a 2e b7 d2 6c 02 bb c8 56 .....=.Z...l...V 0010 68 e6 52 aa 58 c8 39 6a 3e 26 e6 c5 e1 27 00 d1 h.R.X.9j>&...'.. 0020 2c 31 1e 28 c4 08 02 33 c0 cb 40 15 a9 c4 03 c2 ,1.(...3..@..... 0030 14 1c cf 81 26 ec d4 58 6f 1f a7 2e 55 80 a4 02 ....&..Xo...U... 0040 1e 65 6b 13 8f a4 4c 00 e9 27 16 ea 0d d0 9e e3 .ek...L..'...... 0050 be 99 5d 67 35 34 b1 b3 38 11 e0 5f 8f 73 8d d5 ..]g54..8.._.s.. 0060 1b 58 08 16 73 66 05 31 5a 4d 3c bb b6 7f cb 00 .X..sf.1ZM<..... 0070 74 eb 04 54 8a 4b 6f 79 e5 38 75 a9 79 ad e9 ba t..T.Koy.8u.y... 0080 df a6 30 06 da a3 5e 3d 7a f2 af 15 cc 88 f5 25 ..0...^=z......% 0090 36 ad ca 39 c9 7a 50 fa 47 81 23 44 c8 b7 30 2a 6..9.zP.G.#D..0* 00a0 f1 5b d5 98 7a 94 5a 21 ac 66 03 30 2a e4 de ea .[..z.Z!.f.0*... 00b0 92 64 08 3e d4 49 f2 07 7d cb 8a 24 92 d2 80 14 .d.>.I..}..$.... 00c0 7a bd 24 63 6e 16 84 84 d3 f2 14 37 c2 fe e2 3a z.$cn......7...: 00d0 04 36 58 72 28 1f 3d f9 9a c1 fc 8c 8d 73 1a 02 .6Xr(.=......s.. 00e0 a7 49 cf 84 b9 eb ed f7 f6 0d 4b 57 f5 5c 0c 13 .I........KW.\.. 00f0 e2 f8 ad ae e9 23 38 6a 7e e1 e9 5f 5a f9 4d 34 .....#8j~.._Z.M4 0100 27 49 88 4f 9c 87 21 18 ef da ac be 06 5a 3b 4e 'I.O..!......Z;N 0110 52 ea 11 5e 4c 97 4a 9b d1 c0 f8 93 8f 23 58 5e R..^L.J......#X^ 0120 b0 97 ee 6e 82 f3 1f f3 5e 0d ae 96 6f 51 95 b6 ...n....^...oQ.. 0130 be de 78 ec cf d1 07 f2 f6 99 c9 37 f3 42 f5 6a ..x........7.B.j 0140 1b 94 91 5c d6 f3 6e a8 e0 d0 8a df c9 a8 ad 32 ...\..n........2 0150 97 be 8e 10 58 90 d1 0a f4 7b 3b ed 4d fc 7f 6f ....X....{;.M..o 0160 95 5f 24 6a 63 6d 15 bf 46 db ee 0c 01 26 e2 39 ._$jcm..F....&.9 0170 86 4a 41 07 9d 7b 73 67 65 5b a7 df f5 fd ee 12 .JA..{sge[...... 0180 c8 94 69 73 29 dc 8a 65 2b 59 32 a1 c7 fb 8e 96 ..is)..e+Y2..... 0190 cc 1b a7 f4 1f 8d 75 23 80 cb ab 5a d9 a3 b4 c8 ......u#...Z.... 01a0 7d bd c8 06 c1 4b 4b df f2 4a 8f 0a 79 a5 cf a4 }....KK..J..y... 01b0 b2 2b 1a f3 a2 e1 ef 1c 7f 28 e6 0b 4a fe 51 df .+.......(..J.Q. 01c0 81 a7 83 1b 6d a3 87 83 75 b2 ba 13 37 d7 e0 9b ....m...u...7... 01d0 a5 f8 38 33 e2 b2 0b 16 0f ba ea 95 65 c7 bd fd ..83........e... 01e0 f7 f2 ec d8 59 32 ee 92 63 d7 9d 86 de ec 12 46 ....Y2..c......F 01f0 fe fc .. Data: 1BC7E7891F3DF95A2EB7D26C02BBC85668E652AA58C8396A... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 6B63B0E2 Relay Data Length: 498 Data (498 bytes) 0000 da 35 cd 7b 96 5e 43 01 21 7d aa 57 b9 a5 bc 82 .5.{.^C.!}.W.... 0010 c6 2b 86 a7 ee 45 ff 7c 96 65 e1 e2 1e ba 20 d3 .+...E.|.e.... . 0020 84 90 4d 2c 53 0a 55 eb c9 33 b6 d7 d9 db 9d ac ..M,S.U..3...... 0030 1b 07 2e ef 19 0c 27 97 35 b8 89 83 7a 1e 66 73 ......'.5...z.fs 0040 70 29 fd 17 ee 21 ae 5e 0a 7e 09 cd 33 57 e1 27 p)...!.^.~..3W.' 0050 d9 fc ee f6 13 b7 f5 e7 e0 a8 25 6f c3 33 e3 d6 ..........%o.3.. 0060 47 dd cd 12 24 55 f5 0b 1d e6 69 32 98 65 0b 22 G...$U....i2.e." 0070 e0 56 0f 63 df 53 a3 2d 0f 66 71 5d 91 5e 48 1b .V.c.S.-.fq].^H. 0080 82 72 9e f4 5e 81 8d 87 dd 84 3a 7f e6 4f c0 67 .r..^.....:..O.g 0090 42 09 fa 4d f6 bf ed e2 75 3a 87 3b cd 5c f9 d3 B..M....u:.;.\.. 00a0 53 5c 03 f2 54 34 d8 cf ce c7 e1 68 14 71 6a 08 S\..T4.....h.qj. 00b0 ed 45 6c de 78 a6 b0 0c fe 5b a8 c2 06 6c 79 af .El.x....[...ly. 00c0 62 16 ad d0 27 8a c9 e9 eb 75 82 4f 40 1c 5a 6e b...'....u.O@.Zn 00d0 9d 0b cd 8c ab 42 af e9 6d a5 4b 30 61 cc 22 eb .....B..m.K0a.". 00e0 29 ac 4c d7 a9 3f 29 ad 07 9e e5 3a a8 1f 0a 0f ).L..?)....:.... 00f0 7a 8f 5d 3c a8 7a 56 43 2c a1 3d e0 ae eb b9 7c z.]<.zVC,.=....| 0100 27 db 72 1e ca d0 55 1b 2a 10 a7 85 08 1e 60 98 '.r...U.*.....`. 0110 e5 4d ce dd 97 9e fb 24 59 d7 1a 30 d0 9b e5 e3 .M.....$Y..0.... 0120 28 0b fb e4 17 ee b4 03 b1 49 16 08 55 a0 83 aa (........I..U... 0130 e6 6d 28 38 f1 9e 8c 70 e7 95 5a 4b e1 ad a9 83 .m(8...p..ZK.... 0140 df 03 57 fa ef e7 d0 a6 de 53 2b 4c 0d 08 6e 60 ..W......S+L..n` 0150 95 72 b8 5c 4b 2e cf f6 e3 55 5b cf 9e f1 56 7e .r.\K....U[...V~ 0160 62 4e 4a 2e 8e 3d 51 55 63 4f 76 dc b5 fe 8c 85 bNJ..=QUcOv..... 0170 94 7b fe 2d dc 37 79 47 6a 54 42 11 74 98 25 52 .{.-.7yGjTB.t.%R 0180 40 11 0b 10 aa 77 9e 94 f0 85 98 f9 67 7e 26 85 @....w......g~&. 0190 40 99 4b 6b 43 68 25 0c f3 ae 90 24 aa 21 10 5c @.KkCh%....$.!.\ 01a0 0d 1e 71 99 35 fb 39 69 b8 20 fa d8 9c 5c 5a ee ..q.5.9i. ...\Z. 01b0 69 f0 96 b1 d9 ba 1c 53 99 4e e0 45 76 32 fd bb i......S.N.Ev2.. 01c0 bc d0 04 f1 39 8c 77 02 5e 02 10 d5 08 5a 58 72 ....9.w.^....ZXr 01d0 78 1a 00 6f 03 b8 f7 21 af cd 1a 8f fb 31 30 76 x..o...!.....10v 01e0 55 88 e1 45 08 5c 03 69 84 c8 76 d1 ff 0c 5d 2d U..E.\.i..v...]- 01f0 c6 61 .a Data: DA35CD7B965E4301217DAA57B9A5BC82C62B86A7EE45FF7C... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: AF984054 Relay Data Length: 498 Data (498 bytes) 0000 59 7f f2 ab d0 2f 49 8c 33 4f ce 8c 48 37 e1 bf Y..../I.3O..H7.. 0010 23 6b ff 73 54 b4 4f a3 4b 7f 11 75 fe 74 f6 6a #k.sT.O.K..u.t.j 0020 49 a4 93 ad 04 95 07 64 ee 38 1c b0 21 8c 97 84 I......d.8..!... 0030 5d 96 7e 8e 10 25 30 db 10 3f 87 c9 82 dc b5 ef ].~..%0..?...... 0040 17 fe 54 66 f0 77 bb bb 4f ba 65 f8 14 5f 5f 05 ..Tf.w..O.e..__. 0050 ba 91 9d df fe 9e f1 4f cb a6 f1 1f 8d 8b af ec .......O........ 0060 75 0b b6 35 91 19 84 80 3d cc fc 56 ca 8a c6 b5 u..5....=..V.... 0070 af b5 49 a8 e0 b4 c7 8f 68 8b fe 36 9e 1c 12 69 ..I.....h..6...i 0080 ac 8d 8e 51 88 5f ca 9d 70 83 80 50 0e 15 90 fe ...Q._..p..P.... 0090 cf 95 e8 81 ef c0 2e 43 df df ec 08 ed 06 20 dc .......C...... . 00a0 89 5d 6e 0e 5d 28 b1 cb c7 48 01 17 0b 0a 1a 23 .]n.](...H.....# 00b0 43 26 45 3a d4 5d 38 5e 82 d2 0e 7c b8 dd 6f f4 C&E:.]8^...|..o. 00c0 8f c1 e2 5d da 99 b6 25 42 95 78 b5 57 72 c1 3e ...]...%B.x.Wr.> 00d0 9d 1f 2f 65 64 5e 20 2f 09 fc c2 8a 3e 83 d1 3f ../ed^ /....>..? 00e0 87 27 4a d8 3f f3 33 eb f4 a1 6b 28 40 b9 86 e0 .'J.?.3...k(@... 00f0 1a 5e b9 68 89 1a ed 34 ca c9 db c6 e6 66 34 2f .^.h...4.....f4/ 0100 3c fd ab 46 32 1d b7 78 15 c3 c1 88 61 e2 39 be <..F2..x....a.9. 0110 03 46 ec 2d c1 08 0d c3 1d 9c e3 2b 51 24 25 1c .F.-.......+Q$%. 0120 f8 7d 5b 5a 6d 33 e6 2c e4 61 e3 cc 9c 09 3c e1 .}[Zm3.,.a....<. 0130 b9 73 c2 50 be 83 d8 fd 78 c9 ec e9 58 96 3b 6d .s.P....x...X.;m 0140 a5 5a 00 0c 8b dc 2a 1e aa ea 89 a5 75 77 f0 61 .Z....*.....uw.a 0150 00 3e 43 89 07 ee a6 df cc 1c 68 ed 1c 57 d5 6a .>C.......h..W.j 0160 fa 8a ca e3 e6 3a 75 0e 88 52 f4 d5 22 46 61 8d .....:u..R.."Fa. 0170 01 3f 3f 2a fa 50 f0 c2 74 ee 04 8d e2 24 e6 12 .??*.P..t....$.. 0180 52 fd 72 89 f7 a1 fa 8a b7 16 b1 69 a7 90 4b 4e R.r........i..KN 0190 10 48 4a dc 8a 72 fa 93 1e 79 6c 65 87 0e 1d 89 .HJ..r...yle.... 01a0 13 0b e8 61 9b 31 a2 12 0f c4 78 51 8b 11 fa 0e ...a.1....xQ.... 01b0 d8 01 07 bb 46 6a 5b 0e 34 ba 13 8e 2c 89 51 62 ....Fj[.4...,.Qb 01c0 4c 91 8e b1 26 17 44 81 10 0e 24 eb 85 b3 24 dc L...&.D...$...$. 01d0 43 29 a2 49 4c 06 e9 75 9b 7d 3a 8c e7 9f 0c 8a C).IL..u.}:..... 01e0 38 e8 4d af e1 2b 18 c3 5a fd 83 ef fb 4f e1 50 8.M..+..Z....O.P 01f0 33 bc 3. Data: 597FF2ABD02F498C334FCE8C4837E1BF236BFF7354B44FA3... Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 606D83467F9D5FE8794080BC5E8474BE791AAD1F885AF555... No. Time Source Destination Protocol Info 192 38.537589 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 192 (1380 bytes on wire, 1380 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.650376000 [Time delta from previous captured frame: 0.071512000 seconds] [Time delta from previous displayed frame: 0.094367000 seconds] [Time since reference or first frame: 38.537589000 seconds] Frame Number: 192 Frame Length: 1380 bytes Capture Length: 1380 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor:data:data:data:data:data:data:data] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x366568b8 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1362 Identification: 0xc366 (50022) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4084 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 25279, Ack: 14137, Len: 1310 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 25279 (relative sequence number) [Next sequence number: 26589 (relative sequence number)] Acknowledgement number: 14137 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35840 (scaled) Checksum: 0x97a3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178169, TSecr 3800317 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 191] [The RTT to ACK the segment was: 0.071512000 seconds] [Number of bytes in flight: 1310] TCP segment data (1310 bytes) [Reassembled TCP Segments (4101 bytes): #186(15), #188(1388), #190(1388), #192(1310)] [Frame: 186, payload: 0-14 (15 bytes)] [Frame: 188, payload: 15-1402 (1388 bytes)] [Frame: 190, payload: 1403-2790 (1388 bytes)] [Frame: 192, payload: 2791-4100 (1310 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: 0B703C57FA265D6E55A121794F86597C012DA2B7139137BF... SSL segment data (4064 bytes) SSL segment data (416 bytes) [Reassembled SSL Segments (512 bytes): #186(448), #192(64)] [Frame: 186, payload: 0-447 (448 bytes)] [Frame: 192, payload: 448-511 (64 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: F2239608 Relay Data Length: 498 Data (498 bytes) 0000 94 ee 4c c8 f8 10 a7 d9 c1 0f a3 7d fa 1f bc 02 ..L........}.... 0010 4d 54 a5 e9 89 5a 95 c1 da 16 49 55 f2 27 c5 2b MT...Z....IU.'.+ 0020 55 32 5c b2 cb 33 a5 d9 ed cb ac b5 6a 92 54 e5 U2\..3......j.T. 0030 03 93 80 d7 65 d1 ce a1 98 25 07 f6 2c a5 64 16 ....e....%..,.d. 0040 f7 8b 57 df e9 ee f8 5d 99 f1 2e 6f 23 a4 39 ed ..W....]...o#.9. 0050 e4 57 17 dd 1d b2 97 57 df 96 22 b6 77 9c 50 92 .W.....W..".w.P. 0060 5d 68 9c 9c 48 12 1d b5 cd 51 59 45 50 9a 13 0e ]h..H....QYEP... 0070 f5 d4 2e 96 b5 88 74 72 a5 e4 84 1d 08 81 61 88 ......tr......a. 0080 4a 2e 94 5c 82 2d 20 4b 3c 53 59 bf e2 9d 42 ce J..\.- K..}r..p.f. 0050 5c 55 9f 73 27 4b 77 68 5c 30 81 e4 f0 c4 ec 1e \U.s'Kwh\0...... 0060 4c f9 f5 41 14 80 65 43 5a 27 4a b3 d9 de 7c d8 L..A..eCZ'J...|. 0070 7b b8 f9 30 08 47 3e 02 1d 1e 3e 0c 93 87 5b d2 {..0.G>...>...[. 0080 37 9d 23 17 71 aa d1 54 ee 6f f6 36 51 7d 6b b7 7.#.q..T.o.6Q}k. 0090 b7 c7 59 ba 5c 2d 2b 1f 83 a3 14 61 75 94 ab ed ..Y.\-+....au... 00a0 83 21 f0 23 4a 51 d6 aa 9e 59 75 34 57 d9 b6 90 .!.#JQ...Yu4W... 00b0 1b 47 de 33 b2 b4 06 2d 7c cb 66 2d d3 c9 54 d6 .G.3...-|.f-..T. 00c0 70 27 05 0b 16 6b 8a 5b b0 2f 3c 93 70 05 e1 f3 p'...k.[./<.p... 00d0 d0 f9 00 4d da ba 76 8d 13 d6 57 06 28 de 12 7e ...M..v...W.(..~ 00e0 52 d6 68 a6 6e 13 70 8a a0 94 67 76 15 d5 08 ae R.h.n.p...gv.... 00f0 83 9f 7e d8 de 7a 2a f3 06 d0 95 25 6b 48 7d b7 ..~..z*....%kH}. 0100 56 15 96 0d d7 5a cb 8e 53 2f 29 a5 c9 d1 19 01 V....Z..S/)..... 0110 fe 5d e5 71 b9 b9 87 57 2a f4 6e c1 8e 35 61 36 .].q...W*.n..5a6 0120 58 b0 51 c9 31 2f 28 66 db 54 64 06 d4 56 f4 96 X.Q.1/(f.Td..V.. 0130 14 c8 73 5a 26 95 b9 27 38 f5 64 3b 9a f3 2f f5 ..sZ&..'8.d;../. 0140 69 53 f0 34 be fe 06 80 c8 e4 42 9a e0 98 35 a8 iS.4......B...5. 0150 8c 9c c3 08 eb ef ee dd 3f 25 b1 a2 55 a9 e6 77 ........?%..U..w 0160 72 fb a7 3a b4 20 26 d1 13 fa af bc bb 5f ff 9c r..:. &......_.. 0170 59 ea 84 1d fa ed 09 69 7a e6 e4 52 ba 14 f1 2f Y......iz..R.../ 0180 f6 c9 e9 4d ee 40 77 67 21 05 47 10 22 29 a3 da ...M.@wg!.G.").. 0190 87 46 58 a2 9c 15 a6 28 57 bf c9 96 47 d5 11 b0 .FX....(W...G... 01a0 a6 37 d0 dd 36 cf 71 1c f7 55 22 c0 bc 4f 14 ae .7..6.q..U"..O.. 01b0 8f 8c 11 f2 a4 e9 83 60 21 6e 81 bc 7a eb cb 8a .......`!n..z... 01c0 ef 74 02 41 44 69 10 65 34 df 51 1e 42 fd 9d 77 .t.ADi.e4.Q.B..w 01d0 bb 7a f7 9b 7e 95 c7 78 05 dc 7d 0e 8f ec cb f0 .z..~..x..}..... 01e0 c8 be 0c 8f 34 91 e3 6a cf ea 56 96 8f 02 27 4b ....4..j..V...'K 01f0 35 c8 5. Data: B46DE980AE8298E0650E2FE503B1F3E4C93634703B4F500D... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: C6191688 Relay Data Length: 498 Data (498 bytes) 0000 12 ae 8b 9c 3c 71 c5 d8 eb 5f fd ce 51 12 5b 48 ....S/.~I..!4..4B 0180 d3 82 f4 a9 40 e4 95 ab a9 19 3d ca 11 ff 96 aa ....@.....=..... 0190 ab 60 48 e8 e1 10 72 48 97 91 95 16 97 c2 30 10 .`H...rH......0. 01a0 54 86 13 06 eb ca 7e f2 e8 03 ac f6 53 81 9c 54 T.....~.....S..T 01b0 14 9f a8 13 2a 52 74 e4 04 ac 33 25 61 5f 60 39 ....*Rt...3%a_`9 01c0 d3 f2 a4 21 25 19 7a 23 1e bd 8b b0 3c 8a f9 a4 ...!%.z#....<... 01d0 7d 42 47 71 69 5d ef 31 8b a4 43 96 33 e8 6b a5 }BGqi].1..C.3.k. 01e0 86 a3 39 67 9d f8 81 98 65 f1 a3 55 77 21 94 12 ..9g....e..Uw!.. 01f0 ab 0e .. Data: 12AE8B9C3C71C5D8EB5FFDCE51125B48DC9E650C29625B65... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 03D81B82 Relay Data Length: 498 Data (498 bytes) 0000 ba 83 61 97 04 43 52 21 ac 3f b5 97 89 19 95 39 ..a..CR!.?.....9 0010 a5 fe 37 d3 f4 0b 72 de cb fd 48 64 44 11 82 df ..7...r...HdD... 0020 ca c3 ff 8d 48 21 a5 5f 36 68 b1 3a 5d 98 9b 21 ....H!._6h.:]..! 0030 2c ca 4f cf 71 ef d0 ee 3a 22 61 e1 f3 08 13 2a ,.O.q...:"a....* 0040 65 f8 72 72 9b 3b f2 c8 9a ba 8a 2f 0c da 14 b6 e.rr.;...../.... 0050 80 cb 27 90 a5 92 89 25 f2 ee 04 47 6b 53 ca 6b ..'....%...GkS.k 0060 ac 72 16 af 69 f2 f9 ce 49 63 5c a3 a1 6b 4c 43 .r..i...Ic\..kLC 0070 b9 ae a2 a1 0e ca 21 85 35 86 cc 49 ad 9d 1b d8 ......!.5..I.... 0080 6a d4 8c cd 0c f7 99 33 63 85 28 6f 7e 8d f1 26 j......3c.(o~..& 0090 15 36 e5 9b 2b a7 e7 3d c3 a8 71 03 9a ce 2d 69 .6..+..=..q...-i 00a0 9d 19 49 bd 29 63 88 11 f3 42 99 53 6c 22 69 ca ..I.)c...B.Sl"i. 00b0 7f a4 53 51 6a 97 46 ce 0d ad 36 58 d2 56 11 8f ..SQj.F...6X.V.. 00c0 81 c9 b6 dd dc eb 4b 19 18 19 f4 8d 66 4e 31 31 ......K.....fN11 00d0 ba c0 9c 1a ff fd b7 ff 54 31 e9 d2 bb df a8 23 ........T1.....# 00e0 90 e4 5a 35 a2 eb 2e 9d 02 f2 49 05 d8 14 93 bb ..Z5......I..... 00f0 7c 1e 64 a5 be aa a5 a9 de 4b 28 4b 1d 3b 13 b6 |.d......K(K.;.. 0100 a7 49 23 4d 0e 54 43 f9 15 c5 21 73 db b8 e2 c1 .I#M.TC...!s.... 0110 79 5e 06 10 f2 3d 20 0e 8c ad 4a d5 55 31 17 d3 y^...= ...J.U1.. 0120 71 15 c7 c1 09 01 ab 30 a0 f0 5b 93 e7 fa cb 75 q......0..[....u 0130 79 0f 5d c3 58 59 aa 71 7b ca 21 e9 ad cc c3 6d y.].XY.q{.!....m 0140 ce f9 2a 17 71 18 fb c8 2d 42 4a 36 a4 1a 77 f3 ..*.q...-BJ6..w. 0150 77 9f ab fc dd 5c 8e 7d ec ec 11 4e 4b ce c5 cc w....\.}...NK... 0160 69 68 8d bd cb 77 70 a8 95 ba 14 02 97 a3 10 0d ih...wp......... 0170 d1 d3 20 1b 96 89 f8 64 2b 54 19 b3 66 72 93 1f .. ....d+T..fr.. 0180 62 77 d1 65 89 a6 82 4c 29 ae f2 bb eb 01 d9 fb bw.e...L)....... 0190 70 ac d0 ce cd 59 7c 12 5f 46 e5 d9 1c b5 90 4f p....Y|._F.....O 01a0 30 9e 21 cb 91 ba 38 0d 78 2e 3b e3 d6 d6 90 b1 0.!...8.x.;..... 01b0 1e fa a0 35 d5 13 48 ac 1e 9b 1a 2e 1f e2 2e e8 ...5..H......... 01c0 af d2 67 f2 1d ae a7 e1 76 5f e1 1b 85 f7 af 28 ..g.....v_.....( 01d0 c7 0a 56 98 99 24 96 3e 98 57 40 50 3f c2 ad f8 ..V..$.>.W@P?... 01e0 82 0b 64 44 24 cf 3d 8e af e7 db 09 7f 4a 06 f9 ..dD$.=......J.. 01f0 94 2e .. Data: BA83619704435221AC3FB59789199539A5FE37D3F40B72DE... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 88E13D78 Relay Data Length: 498 Data (498 bytes) 0000 93 58 09 17 52 0c e1 a6 4e 32 46 29 8e af 0e 1d .X..R...N2F).... 0010 e4 b0 f2 4b 05 9e 9e 7c ed 1a 5c 9d 30 99 10 98 ...K...|..\.0... 0020 82 be b9 7d be 63 48 91 ef c3 2e ad d3 0d a7 fd ...}.cH......... 0030 cd a4 18 9a 23 c4 98 33 6f 6b 68 f1 1b fb ae 81 ....#..3okh..... 0040 a1 bd 81 18 33 67 48 a6 86 46 43 a7 d4 30 1f 53 ....3gH..FC..0.S 0050 1d b3 30 4c 00 38 97 3c 33 95 0e f9 e1 7a f6 c5 ..0L.8.<3....z.. 0060 b2 cd 4e 9b 88 38 98 e5 2a 6f 98 4f 67 08 05 5d ..N..8..*o.Og..] 0070 f4 55 55 8d 13 b2 03 8e b5 93 f6 64 0a ff 83 9f .UU........d.... 0080 c1 42 b1 94 41 6a d2 38 23 5e 91 e0 c4 6a 20 dd .B..Aj.8#^...j . 0090 12 51 69 d5 24 9f 6d 3e a7 06 90 6e 08 65 6a 0d .Qi.$.m>...n.ej. 00a0 77 61 d0 2d e8 4e e9 fa cb e5 b4 c8 bd 24 d3 2a wa.-.N.......$.* 00b0 60 29 b8 4d 85 5c c9 76 28 e0 93 1a d2 99 36 f8 `).M.\.v(.....6. 00c0 8e 87 2f 59 79 57 41 e4 91 97 6e ea da ab 0e 2e ../YyWA...n..... 00d0 99 52 a8 7c 6e 39 c9 7d 70 16 a1 46 7f 66 a5 79 .R.|n9.}p..F.f.y 00e0 38 be ab 48 45 2a a9 1e 5c a5 57 cb fa 25 ec 40 8..HE*..\.W..%.@ 00f0 dc 2c 4d 5c dd 53 c0 dc 81 c9 c9 35 e4 6d 02 7c .,M\.S.....5.m.| 0100 67 2d 47 27 80 55 75 f2 fb 9c cb 46 10 3e 09 39 g-G'.Uu....F.>.9 0110 83 8b 08 34 03 fe b2 fe c9 b2 50 1b f4 6b bc 6c ...4......P..k.l 0120 3e aa 7d 12 e4 71 12 81 d9 a4 e6 49 94 e0 b8 4e >.}..q.....I...N 0130 12 37 1c 64 a5 06 6e 7f 1a 68 e1 50 49 91 8a 1b .7.d..n..h.PI... 0140 2f 70 2b 84 92 27 3f d2 bd 5d e9 f5 ad 24 4a 87 /p+..'?..]...$J. 0150 3f 28 da 84 c0 ac 8d a5 d0 c7 a5 18 47 ae bc 6f ?(..........G..o 0160 a9 d6 6b d4 a2 24 9c f6 20 54 18 47 91 2d 3a 3f ..k..$.. T.G.-:? 0170 99 bd 10 96 a8 a7 4c 1e 02 7e 8a 38 17 e9 51 c2 ......L..~.8..Q. 0180 99 1e 8c b0 f2 b5 8c 90 5f e1 b7 40 bb 4a 56 25 ........_..@.JV% 0190 b0 9a 57 a6 80 83 bd b3 5b a8 7a 83 04 dc 78 b1 ..W.....[.z...x. 01a0 2c 0d 25 0c 4a e3 28 ef 01 a9 99 27 d8 65 b3 48 ,.%.J.(....'.e.H 01b0 f6 82 63 de 81 f9 b2 0c 33 c4 61 58 5a d8 97 42 ..c.....3.aXZ..B 01c0 ed 39 0b b3 e6 c5 8a b6 bc d3 6c c5 06 fa 24 2b .9........l...$+ 01d0 98 78 74 7e 04 25 21 2d d0 97 59 b9 4b b8 9d ca .xt~.%!-..Y.K... 01e0 ea 5c de d4 9d ca 73 c6 e3 58 ba b2 ce 85 62 f5 .\....s..X....b. 01f0 c8 4d .M Data: 93580917520CE1A64E3246298EAF0E1DE4B0F24B059E9E7C... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 620BFBBF Relay Data Length: 498 Data (498 bytes) 0000 5a 54 9d 2d 4d 4e c7 97 3f 97 a1 f8 33 82 1b 54 ZT.-MN..?...3..T 0010 3a 35 ae b0 6c a9 e4 ad 87 b7 12 da b9 2a f9 24 :5..l........*.$ 0020 d1 55 92 66 2e f8 de 46 f6 54 52 22 af f4 48 33 .U.f...F.TR"..H3 0030 48 34 2d c3 85 1d 5b fb c2 95 7d 0d 87 5c 90 4c H4-...[...}..\.L 0040 0b 3b 03 5f 5a b2 2a 2a 0b 48 cf 72 67 8a 94 33 .;._Z.**.H.rg..3 0050 c1 91 bd 29 cc 88 e3 d4 4c 42 74 94 ef 41 d4 28 ...)....LBt..A.( 0060 5e 82 96 cc 43 c4 63 42 6a 76 ea 1a b8 2c a6 90 ^...C.cBjv...,.. 0070 1f c4 ed 84 62 98 5f 43 86 8b 5a 36 17 73 97 20 ....b._C..Z6.s. 0080 f4 a8 8e 9d ab 5b ab 00 24 0b 4a 49 29 97 32 a0 .....[..$.JI).2. 0090 fa de b5 3b 49 fe 6e fa 5a a2 d3 ed a1 ab 08 d1 ...;I.n.Z....... 00a0 2e 60 8b ea 2d e4 c6 ee 74 b2 98 64 7e c8 49 05 .`..-...t..d~.I. 00b0 cb 67 68 ad e1 12 de 6b 73 55 be a4 61 7d 63 c5 .gh....ksU..a}c. 00c0 8f 27 db 3f 1e 3f f7 e1 68 f8 02 66 93 ff fa bf .'.?.?..h..f.... 00d0 69 c3 69 5d eb a9 a4 91 52 3d 45 b8 68 a8 7c 91 i.i]....R=E.h.|. 00e0 ba b9 a8 86 65 96 3e f2 2d 22 44 1c 9e 45 7c 21 ....e.>.-"D..E|! 00f0 0e 3a 7c 03 d6 00 49 da 90 cb fc c6 a1 25 2e 07 .:|...I......%.. 0100 a3 3a 4c e2 a5 1d 52 a6 a0 2b 74 8a 4e de 21 ad .:L...R..+t.N.!. 0110 1e ee d5 41 76 99 5b 74 93 c3 3e 4d d7 1e 54 cd ...Av.[t..>M..T. 0120 82 f2 fd d2 25 3a e7 62 7d 20 dc ea 9c d3 8c aa ....%:.b} ...... 0130 56 d9 aa bc 10 74 51 b9 78 04 63 b8 b2 78 92 5f V....tQ.x.c..x._ 0140 27 59 fc 8b 75 1c 2b 74 b7 54 d3 2d 44 cd 0a 5d 'Y..u.+t.T.-D..] 0150 ab b7 35 d6 cf d2 3d 4a a3 f6 94 c2 e8 c2 60 b0 ..5...=J......`. 0160 a0 5b dd 6b 63 a6 3b d4 cd 5d 59 cc 65 28 4f c3 .[.kc.;..]Y.e(O. 0170 7b 5d f4 62 fa ea 9b 36 fb 4f 9e 5c 6f f7 a4 17 {].b...6.O.\o... 0180 08 df af 73 26 e1 21 5f 00 73 f7 ae be da c6 b9 ...s&.!_.s...... 0190 0e ca d8 76 46 70 ac 51 f7 bf 37 8f 40 3b 0f 56 ...vFp.Q..7.@;.V 01a0 b8 25 77 1c 5d 75 11 8d e1 ac da 52 fb 29 c1 72 .%w.]u.....R.).r 01b0 bc 50 18 42 eb 61 f8 d2 30 60 ad d2 9d 34 52 09 .P.B.a..0`...4R. 01c0 c3 1c cb a8 4d fc a9 54 6e 5b 1d 05 85 66 22 5d ....M..Tn[...f"] 01d0 69 cb 93 79 3e a5 c0 05 17 45 4e d4 80 02 f8 7c i..y>....EN....| 01e0 60 0a c0 51 6d 6d c2 e0 39 34 ee 02 4f 10 af 53 `..Qmm..94..O..S 01f0 88 5e .^ Data: 5A549D2D4D4EC7973F97A1F833821B543A35AEB06CA9E4AD... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 478A14BB Relay Data Length: 498 Data (498 bytes) 0000 ef 60 9b 52 2b 68 5e da 10 76 33 13 50 68 e3 18 .`.R+h^..v3.Ph.. 0010 23 91 88 b3 80 5c f9 11 a4 62 20 27 f8 45 ba 48 #....\...b '.E.H 0020 82 f2 63 d1 e5 86 da c3 19 98 2e 77 f7 1a 0b 3b ..c........w...; 0030 50 76 ae a9 8b b4 56 da bb 2d 17 4c 89 ee b5 67 Pv....V..-.L...g 0040 f5 ab 77 9f fa 2f 91 fe ae ff 5c 5d 3d 26 93 5f ..w../....\]=&._ 0050 be c5 0d 66 48 b9 d5 e0 f2 c2 59 f2 15 ea e3 63 ...fH.....Y....c 0060 41 1f 8b d2 c7 42 7f ec ad 2e a7 4d d7 11 8f c8 A....B.....M.... 0070 3b 5c fa ac fd be 51 c1 ad 7a c1 97 50 95 1d 4e ;\....Q..z..P..N 0080 95 0f 90 2d 84 a8 a3 2b ca 6d 0f 17 1d 92 4b 03 ...-...+.m....K. 0090 a4 c2 8c 90 d7 6c 1d d0 64 10 4d 2d 2f fc 13 52 .....l..d.M-/..R 00a0 91 3d 95 f7 08 51 52 32 f2 d7 25 b5 2d 52 21 86 .=...QR2..%.-R!. 00b0 b8 9a e5 d2 59 17 79 9f 99 e3 4c b7 84 fb 77 1d ....Y.y...L...w. 00c0 5f 2d 5a 6e 20 7f e3 10 98 c2 29 23 c5 a7 ce 79 _-Zn .....)#...y 00d0 c7 ed ef 9e 13 b4 bb d9 fb 71 eb c9 f0 c7 ad fd .........q...... 00e0 1f f0 b3 83 9f 9d ad 7d fc d9 c6 1f b3 bc 28 79 .......}......(y 00f0 34 5c 7f b4 0d e2 6b 7e 12 1c 35 7f a5 d5 d2 4c 4\....k~..5....L 0100 18 50 7a 35 e9 2d 45 08 86 4c 29 8c 4e 60 ee 0a .Pz5.-E..L).N`.. 0110 ff 1a ea 4c 59 2e 99 41 6a fb 3e 2b fe 2e 4d da ...LY..Aj.>+..M. 0120 90 6e 47 11 70 98 32 8c 47 bf 71 1f 66 2c b6 1c .nG.p.2.G.q.f,.. 0130 19 27 9d 72 0f 17 b7 c9 ef 1a 47 d6 ec 24 42 ee .'.r......G..$B. 0140 97 c8 ee 0a 90 9b 3b b3 e5 95 ce c0 64 93 9f 22 ......;.....d.." 0150 e3 b8 c4 a7 06 0a 00 46 f2 ca 6f e2 2d 56 4e 33 .......F..o.-VN3 0160 d8 46 fa 0a b2 3f 32 c6 59 9b bb f9 e6 40 55 80 .F...?2.Y....@U. 0170 24 cf 15 88 cf a4 0f d4 73 f9 4c 35 d4 88 95 15 $.......s.L5.... 0180 b7 d6 71 58 62 22 75 1f de 4a d5 86 e9 04 29 02 ..qXb"u..J....). 0190 39 b9 2f 39 f6 2c 15 d2 5f 85 b8 30 0e 97 9e 38 9./9.,.._..0...8 01a0 95 eb 49 78 55 25 4a 3a 68 5a 24 d3 9c 6c bd cc ..IxU%J:hZ$..l.. 01b0 38 54 0c 20 ea 5c ba f1 9e 52 79 43 a3 bc 51 04 8T. .\...RyC..Q. 01c0 77 48 bc 4f 48 96 79 0d 27 cc 75 51 7a 84 e5 c0 wH.OH.y.'.uQz... 01d0 b9 11 84 7d a7 e8 66 65 3e 14 f3 ec 0a ce 58 24 ...}..fe>.....X$ 01e0 ac 6d 76 b6 77 b7 91 ac 66 88 64 49 7c 8d 2a 5d .mv.w...f.dI|.*] 01f0 c9 48 .H Data: EF609B522B685EDA107633135068E318239188B3805CF911... No. Time Source Destination Protocol Info 194 38.613643 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 194 (752 bytes on wire, 752 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.726430000 [Time delta from previous captured frame: 0.076023000 seconds] [Time delta from previous displayed frame: 0.076054000 seconds] [Time since reference or first frame: 38.613643000 seconds] Frame Number: 194 Frame Length: 752 bytes Capture Length: 752 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x33ab6133 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 734 Identification: 0xc367 (50023) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x42f7 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 26589, Ack: 14137, Len: 682 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 26589 (relative sequence number) [Next sequence number: 27271 (relative sequence number)] Acknowledgement number: 14137 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 35840 (scaled) Checksum: 0x2461 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178188, TSecr 3800340 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 193] [The RTT to ACK the segment was: 0.076023000 seconds] [Number of bytes in flight: 682] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 7F387AFE0DFD8CAB8346C2BC2DE5526793690D4982AEE45E... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 640 Encrypted Application Data: EBD0B274CCC4E6EA417801859A219DABD4615B9F7E123827... SSL segment data (608 bytes) [Reassembled SSL Segments (512 bytes): #192(416), #194(96)] [Frame: 192, payload: 0-415 (416 bytes)] [Frame: 194, payload: 416-511 (96 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19221 Digest: 36E85201 Relay Data Length: 16 Data (16 bytes) 0000 8a cf 62 02 1b d7 ff 07 27 b3 75 fd 52 89 00 00 ..b.....'.u.R... Data: 8ACF62021BD7FF0727B375FD52890000 Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 19221 Digest: 0D70C8EC Relay Data Length: 1 Relay End Reason: (Anonymized TCP connection was closed) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 196 38.703637 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 196 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:24.816424000 [Time delta from previous captured frame: 0.089956000 seconds] [Time delta from previous displayed frame: 0.089994000 seconds] [Time since reference or first frame: 38.703637000 seconds] Frame Number: 196 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x54ff (21759) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3df [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 14137, Ack: 27271, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 14137 (relative sequence number) [Next sequence number: 14723 (relative sequence number)] Acknowledgement number: 27271 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3800381, TSecr 936178188 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4AA115F5DB7E8579D208BC0138A5A88BB9E990464CCEF18F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 4D99A0C39924B3793F69061C26E9A533F1F0D3DF9E4DE739... Tor Protocol CircID: 45647 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 19222 Digest: 78A38A1A Relay Data Length: 16 Resolve Address: 91.198.174.2:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 198 40.410637 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 198 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:26.523424000 [Time delta from previous captured frame: 1.649575000 seconds] [Time delta from previous displayed frame: 1.707000000 seconds] [Time since reference or first frame: 40.410637000 seconds] Frame Number: 198 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x14904bac [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc369 (50025) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4355 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 27271, Ack: 14723, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 27271 (relative sequence number) [Next sequence number: 27857 (relative sequence number)] Acknowledgement number: 14723 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 36992 (scaled) Checksum: 0x75af [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178644, TSecr 3800381 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: E2E57D50123FB70F4C6210E0B3BD1002EE57A32EC007F791... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 066411D20E2459F2673D8E1856292FC2FD5752ECBEC534BC... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_CONNECTED (0x04) Recognized: 0000 Stream ID: 19222 Digest: 23E6E382 Relay Data Length: 8 Relay Connected IP: 91.198.174.2 (91.198.174.2) Relay Connected TTL: 1800 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 200 40.411874 192.168.1.34 91.208.34.1 HTTP GET /wiki/Special:Search?search=tor&go=Go HTTP/1.1 Frame 200 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:26.524661000 [Time delta from previous captured frame: 0.001210000 seconds] [Time delta from previous displayed frame: 0.001237000 seconds] [Time since reference or first frame: 40.411874000 seconds] Frame Number: 200 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5501 (21761) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3dd [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 14723, Ack: 27857, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 14723 (relative sequence number) [Next sequence number: 15309 (relative sequence number)] Acknowledgement number: 27857 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3800809, TSecr 936178644 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 8B126CA7B0F07CCA2CA7F81E43E5444AE5C0CCC66494444F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 814E0564C4C574D8E489A8533B86F4726A03CF8D507D3295... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19222 Digest: 10116AEE Relay Data Length: 278 Hypertext Transfer Protocol GET /wiki/Special:Search?search=tor&go=Go HTTP/1.1\r\n Request Method: GET Request URI: /wiki/Special:Search?search=tor&go=Go Request Version: HTTP/1.1 Accept: text/html, image/jpeg, image/png, text/*, image/*, */*\r\n Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n Accept-Charset: utf-8, utf-8;q=0.5, *;q=0.5\r\n Accept-Language: en\r\n Host: en.wikipedia.org\r\n Connection: close\r\n \r\n No. Time Source Destination Protocol Info 202 41.440435 91.208.34.1 192.168.1.34 HTTP HTTP/1.0 302 Moved Temporarily Frame 202 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:27.553222000 [Time delta from previous captured frame: 0.968020000 seconds] [Time delta from previous displayed frame: 1.028561000 seconds] [Time since reference or first frame: 41.440435000 seconds] Frame Number: 202 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xe1e0e87f [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc36b (50027) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4353 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 27857, Ack: 15309, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 27857 (relative sequence number) [Next sequence number: 28443 (relative sequence number)] Acknowledgement number: 15309 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 38144 (scaled) Checksum: 0x7d3b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178902, TSecr 3800809 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: D1A2B858837AA9CFC075C6EF216F5D393B32DD7D3131FBF9... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 5DBAB3A85DF354F0CAC0706C4B42FDB5C56B9CF3C928D781... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19222 Digest: 6B5D598B Relay Data Length: 498 Hypertext Transfer Protocol HTTP/1.0 302 Moved Temporarily\r\n Request Version: HTTP/1.0 Response Code: 302 Date: Sun, 04 Jan 2009 15:08:26 GMT\r\n Server: Apache\r\n X-Powered-By: PHP/5.2.4-2ubuntu5wm1\r\n Cache-Control: private, s-maxage=0, max-age=0, must-revalidate\r\n Vary: Accept-Encoding,Cookie\r\n [truncated] X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=enwikiToken;string-contains=enwikiLoggedOut;string-contains=enwiki_session;string-contains=centralauth_Token;string-contains=centralauth_Session;string-c Expires: Thu, 01 Jan 197 No. Time Source Destination Protocol Info 205 41.502123 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data) Frame 205 (292 bytes on wire, 292 bytes captured) Arrival Time: Jan 4, 2009 15:08:27.614910000 [Time delta from previous captured frame: 0.051033000 seconds] [Time delta from previous displayed frame: 0.061688000 seconds] [Time since reference or first frame: 41.502123000 seconds] Frame Number: 205 Frame Length: 292 bytes Capture Length: 292 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:data] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x796dc121 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 274 Identification: 0xc36d (50029) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x44bd [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 29831, Ack: 15309, Len: 222 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 29831 (relative sequence number) [Next sequence number: 30053 (relative sequence number)] Acknowledgement number: 15309 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 38144 (scaled) Checksum: 0xc67b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936178916, TSecr 3801068 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 204] [The RTT to ACK the segment was: 0.051033000 seconds] [Number of bytes in flight: 222] TCP segment data (222 bytes) [Reassembled TCP Segments (1573 bytes): #203(1351), #205(222)] [Frame: 203, payload: 0-1350 (1351 bytes)] [Frame: 205, payload: 1351-1572 (222 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1568 Encrypted Application Data: AEC5DC82BA9AACD94EF8D914AD98E82ED62483DF6E257E7C... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19222 Digest: 0633F118 Relay Data Length: 498 Data (498 bytes) 0000 30 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 0d 0a 0 00:00:00 GMT.. 0010 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 3a 2f Location: http:/ 0020 2f 65 6e 2e 77 69 6b 69 70 65 64 69 61 2e 6f 72 /en.wikipedia.or 0030 67 2f 77 69 6b 69 2f 54 6f 72 0d 0a 43 6f 6e 74 g/wiki/Tor..Cont 0040 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a ent-Encoding: gz 0050 69 70 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 ip..Content-Leng 0060 74 68 3a 20 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d th: 20..Content- 0070 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b Type: text/html; 0080 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 0d 0a charset=utf-8.. 0090 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 20 66 72 X-Cache: MISS fr 00a0 6f 6d 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 om sq20.wikimedi 00b0 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d 4c a.org..X-Cache-L 00c0 6f 6f 6b 75 70 3a 20 4d 49 53 53 20 66 72 6f 6d ookup: MISS from 00d0 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 61 2e sq20.wikimedia. 00e0 6f 72 67 3a 33 31 32 38 0d 0a 58 2d 43 61 63 68 org:3128..X-Cach 00f0 65 3a 20 4d 49 53 53 20 66 72 6f 6d 20 6b 6e 73 e: MISS from kns 0100 71 32 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 q2.knams.wikimed 0110 69 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d ia.org..X-Cache- 0120 4c 6f 6f 6b 75 70 3a 20 4d 49 53 53 20 66 72 6f Lookup: MISS fro 0130 6d 20 6b 6e 73 71 32 2e 6b 6e 61 6d 73 2e 77 69 m knsq2.knams.wi 0140 6b 69 6d 65 64 69 61 2e 6f 72 67 3a 33 31 32 38 kimedia.org:3128 0150 0d 0a 58 2d 43 61 63 68 65 3a 20 4d 49 53 53 20 ..X-Cache: MISS 0160 66 72 6f 6d 20 6b 6e 73 71 32 37 2e 6b 6e 61 6d from knsq27.knam 0170 73 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 67 0d s.wikimedia.org. 0180 0a 58 2d 43 61 63 68 65 2d 4c 6f 6f 6b 75 70 3a .X-Cache-Lookup: 0190 20 4d 49 53 53 20 66 72 6f 6d 20 6b 6e 73 71 32 MISS from knsq2 01a0 37 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 7.knams.wikimedi 01b0 61 2e 6f 72 67 3a 38 30 0d 0a 56 69 61 3a 20 31 a.org:80..Via: 1 01c0 2e 30 20 73 71 32 30 2e 77 69 6b 69 6d 65 64 69 .0 sq20.wikimedi 01d0 61 2e 6f 72 67 3a 33 31 32 38 20 28 73 71 75 69 a.org:3128 (squi 01e0 64 2f 32 2e 36 2e 53 54 41 42 4c 45 32 31 29 2c d/2.6.STABLE21), 01f0 20 31 1 Data: 302030303A30303A303020474D540D0A4C6F636174696F6E... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19222 Digest: 36BA6F38 Relay Data Length: 153 Data (153 bytes) 0000 2e 30 20 6b 6e 73 71 32 2e 6b 6e 61 6d 73 2e 77 .0 knsq2.knams.w 0010 69 6b 69 6d 65 64 69 61 2e 6f 72 67 3a 33 31 32 ikimedia.org:312 0020 38 20 28 73 71 75 69 64 2f 32 2e 36 2e 53 54 41 8 (squid/2.6.STA 0030 42 4c 45 32 31 29 2c 20 31 2e 30 20 6b 6e 73 71 BLE21), 1.0 knsq 0040 32 37 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 27.knams.wikimed 0050 69 61 2e 6f 72 67 3a 38 30 20 28 73 71 75 69 64 ia.org:80 (squid 0060 2f 32 2e 36 2e 53 54 41 42 4c 45 32 31 29 0d 0a /2.6.STABLE21).. 0070 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 Connection: clos 0080 65 0d 0a 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 e............... 0090 00 00 00 00 00 00 00 00 00 ......... Data: 2E30206B6E7371322E6B6E616D732E77696B696D65646961... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 19222 Digest: 4B098389 Relay Data Length: 1 Relay End Reason: (Anonymized TCP connection was closed) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 206 41.517461 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data) Frame 206 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:27.630248000 [Time delta from previous captured frame: 0.015338000 seconds] [Time delta from previous displayed frame: 0.015338000 seconds] [Time since reference or first frame: 41.517461000 seconds] Frame Number: 206 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5503 (21763) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3db [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 15309, Ack: 30053, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 15309 (relative sequence number) [Next sequence number: 15895 (relative sequence number)] Acknowledgement number: 30053 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801085, TSecr 936178916 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 205] [The RTT to ACK the segment was: 0.015338000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 1C777085035ECF25B685DE6A4D831E8D01F4AAF5A96A4FF1... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 202D493EA6C1A2665F5A6622F33C3E45819FED1674C8F3BD... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_BEGIN (0x01) Recognized: 0000 Stream ID: 19223 Digest: E85B46A2 Relay Data Length: 16 Resolve Address: 91.198.174.2:80 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 208 42.743430 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 208 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:28.856217000 [Time delta from previous captured frame: 1.138876000 seconds] [Time delta from previous displayed frame: 1.225969000 seconds] [Time since reference or first frame: 42.743430000 seconds] Frame Number: 208 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xf9afc25f [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc36f (50031) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x434f [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 30053, Ack: 15895, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 30053 (relative sequence number) [Next sequence number: 30639 (relative sequence number)] Acknowledgement number: 15895 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 39296 (scaled) Checksum: 0x44e7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179222, TSecr 3801085 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 73C61B0D675466DEFFC64B038B5374D503930A5A0B8FDB71... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 50F50C16C875BAD592F46BC22B227ED6862FD076CC2BBEF2... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_CONNECTED (0x04) Recognized: 0000 Stream ID: 19223 Digest: 656DEE5B Relay Data Length: 8 Relay Connected IP: 91.198.174.2 (91.198.174.2) Relay Connected TTL: 1800 Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 209 42.743870 192.168.1.34 91.208.34.1 HTTP GET /wiki/Tor HTTP/1.1 Frame 209 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:28.856657000 [Time delta from previous captured frame: 0.000440000 seconds] [Time delta from previous displayed frame: 0.000440000 seconds] [Time since reference or first frame: 42.743870000 seconds] Frame Number: 209 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5504 (21764) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3da [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 15895, Ack: 30639, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 15895 (relative sequence number) [Next sequence number: 16481 (relative sequence number)] Acknowledgement number: 30639 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801392, TSecr 936179222 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 208] [The RTT to ACK the segment was: 0.000440000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: ABBF5241EFC8653652F56A28EF47BEC7EF687DA890F0D37F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 339EC73BDAAD0E4DDB46B7E40B72A42BDDE661E401FA9C1C... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 7830DF20 Relay Data Length: 250 Hypertext Transfer Protocol GET /wiki/Tor HTTP/1.1\r\n Request Method: GET Request URI: /wiki/Tor Request Version: HTTP/1.1 Accept: text/html, image/jpeg, image/png, text/*, image/*, */*\r\n Accept-Encoding: x-gzip, x-deflate, gzip, deflate\r\n Accept-Charset: utf-8, utf-8;q=0.5, *;q=0.5\r\n Accept-Language: en\r\n Host: en.wikipedia.org\r\n Connection: close\r\n \r\n No. Time Source Destination Protocol Info 212 43.161685 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data), Tor Cell: (Stop using a circuit) Frame 212 (1164 bytes on wire, 1164 bytes captured) Arrival Time: Jan 4, 2009 15:08:29.274472000 [Time delta from previous captured frame: 0.000115000 seconds] [Time delta from previous displayed frame: 0.417815000 seconds] [Time since reference or first frame: 43.161685000 seconds] Frame Number: 212 Frame Length: 1164 bytes Capture Length: 1164 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1150 Identification: 0x5505 (21765) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa1d9 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 16481, Ack: 30639, Len: 1098 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 16481 (relative sequence number) [Next sequence number: 17579 (relative sequence number)] Acknowledgement number: 30639 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x440c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801496, TSecr 936179242 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 210] [The RTT to ACK the segment was: 0.360249000 seconds] [Number of bytes in flight: 1098] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: B89FF1822DFDFC620E65971B8C52BB5C3408C914C83A31A2... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1056 Encrypted Application Data: 68CCE2AB4CFC296E9F991BF186EF8DFB8B8C4746329C501E... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 19219 Digest: D2E1A10B Relay Data Length: 1 Relay End Reason: (catch-all for unlisted reasons) (0x01) Padding: 000000000000000000000000000000000000000000000000... CircID: 45646 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (No reason given.) (0x00) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 225 44.111072 192.168.1.34 213.114.108.189 Tor Tor Cell: (Create a circuit) Frame 225 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.223859000 [Time delta from previous captured frame: 0.002555000 seconds] [Time delta from previous displayed frame: 0.949387000 seconds] [Time since reference or first frame: 44.111072000 seconds] Frame Number: 225 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 213.114.108.189 (213.114.108.189) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5d61 (23905) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd71e [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 213.114.108.189 (213.114.108.189) Transmission Control Protocol, Src Port: 51430 (51430), Dst Port: 9001 (9001), Seq: 1339, Ack: 1487, Len: 586 Source port: 51430 (51430) Destination port: 9001 (9001) [Stream index: 5] Sequence number: 1339 (relative sequence number) [Next sequence number: 1925 (relative sequence number)] Acknowledgement number: 1487 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8832 (scaled) Checksum: 0x066b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801733, TSecr 927686250 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 224] [The RTT to ACK the segment was: 0.002555000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F0F70FC859011BC1469C3FD694CADF760E406F0401E80146... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 568E13615C7AFA7CD6ECAEE88AC4135DF086555572938115... Tor Protocol CircID: 16666 Command: (Create a circuit) (0x01) Payload: Create Payload: C313B6169988337D6FCEC91918116485035D18858CA06FAB... No. Time Source Destination Protocol Info 226 44.127581 89.253.105.39 192.168.1.34 Tor Tor Cell: (Stop using a circuit), Tor Cell: (Stop using a circuit) Frame 226 (1168 bytes on wire, 1168 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.240368000 [Time delta from previous captured frame: 0.016509000 seconds] [Time delta from previous displayed frame: 0.016509000 seconds] [Time since reference or first frame: 44.127581000 seconds] Frame Number: 226 Frame Length: 1168 bytes Capture Length: 1168 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xe480b44f [correct] Internet Protocol, Src: 89.253.105.39 (89.253.105.39), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1150 Identification: 0x9a0f (39439) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: TCP (0x06) Header checksum: 0x227c [correct] [Good: True] [Bad : False] Source: 89.253.105.39 (89.253.105.39) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 34813 (34813), Seq: 3147, Ack: 3499, Len: 1098 Source port: 9001 (9001) Destination port: 34813 (34813) [Stream index: 2] Sequence number: 3147 (relative sequence number) [Next sequence number: 4245 (relative sequence number)] Acknowledgement number: 3499 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 15104 (scaled) Checksum: 0x34dc [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 4248443142, TSecr 3799959 [SEQ/ACK analysis] [Number of bytes in flight: 1098] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: F11AFA8CF00576D91DB2BCD23B8F0D82BBDDC436BFA517AE... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1056 Encrypted Application Data: D293D0D082F7CFD1A772CDCB11B8BDCC285D624A0F706C96... Tor Protocol CircID: 2069 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (Out of memory, sockets, or circuit IDs.) (0x05) Padding: 000000000000000000000000000000000000000000000000... CircID: 2070 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (Out of memory, sockets, or circuit IDs.) (0x05) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 229 44.202387 192.168.1.34 213.114.108.189 Tor Tor Cell: (Create a circuit) Frame 229 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.315174000 [Time delta from previous captured frame: 0.000025000 seconds] [Time delta from previous displayed frame: 0.074806000 seconds] [Time since reference or first frame: 44.202387000 seconds] Frame Number: 229 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 213.114.108.189 (213.114.108.189) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5d62 (23906) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd71d [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 213.114.108.189 (213.114.108.189) Transmission Control Protocol, Src Port: 51430 (51430), Dst Port: 9001 (9001), Seq: 1925, Ack: 1487, Len: 586 Source port: 51430 (51430) Destination port: 9001 (9001) [Stream index: 5] Sequence number: 1925 (relative sequence number) [Next sequence number: 2511 (relative sequence number)] Acknowledgement number: 1487 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 8832 (scaled) Checksum: 0x066b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801756, TSecr 927686274 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 228] [The RTT to ACK the segment was: 0.000025000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 3ECCB641722E4AB66D4D90A4F437DC1A377D306FC2F3C03F... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: F570BA990533B7EEA12A24A8027C19FB0E3287204AA00F95... Tor Protocol CircID: 16667 Command: (Create a circuit) (0x01) Payload: Create Payload: 05A1657547ACEF5DE2027B93E0E6B7DD4D103A5424B107B8... No. Time Source Destination Protocol Info 231 44.546901 91.208.34.1 192.168.1.34 HTTP HTTP/1.0 200 OK Frame 231 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.659688000 [Time delta from previous captured frame: 0.248188000 seconds] [Time delta from previous displayed frame: 0.344514000 seconds] [Time since reference or first frame: 44.546901000 seconds] Frame Number: 231 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:http] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xb854f489 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc372 (50034) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x434c [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 30639, Ack: 17579, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 30639 (relative sequence number) [Next sequence number: 31225 (relative sequence number)] Acknowledgement number: 17579 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 42752 (scaled) Checksum: 0x8c64 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179678, TSecr 3801496 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 7CAE54F0011C229A9F62A4B636F36C4045F75570354C72CC... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 132A1BD8AACC33FFD5E7C420EBBCE915D6D1C971E78D4FCF... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: E7B204AF Relay Data Length: 498 Hypertext Transfer Protocol HTTP/1.0 200 OK\r\n Request Version: HTTP/1.0 Response Code: 200 Date: Sat, 03 Jan 2009 13:25:16 GMT\r\n Server: Apache\r\n X-Powered-By: PHP/5.2.4-2ubuntu5wm1\r\n Cache-Control: private, s-maxage=0, max-age=0, must-revalidate\r\n Content-Language: en\r\n Vary: Accept-Encoding,Cookie\r\n [truncated] X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=enwikiToken;string-contains=enwikiLoggedOut;string-contains=enwiki_session;string-contains=centralauth_Token;string-contains=centralauth_Session;string-c Last-Modified: Sa No. Time Source Destination Protocol Info 236 44.609614 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data), Tor Cell: (End-to-end data) Frame 236 (1458 bytes on wire, 1458 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.722401000 [Time delta from previous captured frame: 0.014394000 seconds] [Time delta from previous displayed frame: 0.062713000 seconds] [Time since reference or first frame: 44.609614000 seconds] Frame Number: 236 Frame Length: 1458 bytes Capture Length: 1458 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:data:data:data:data:data:data:ssl] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x6f2f00c1 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1440 Identification: 0xc375 (50037) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4027 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 34001, Ack: 17579, Len: 1388 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 34001 (relative sequence number) [Next sequence number: 35389 (relative sequence number)] Acknowledgement number: 17579 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 42752 (scaled) Checksum: 0x12da [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179692, TSecr 3801845 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 235] [The RTT to ACK the segment was: 0.014394000 seconds] [Number of bytes in flight: 1388] TCP segment data (1362 bytes) TCP segment data (26 bytes) [Reassembled TCP Segments (4101 bytes): #232(1351), #234(1388), #236(1362)] [Frame: 232, payload: 0-1350 (1351 bytes)] [Frame: 234, payload: 1351-2738 (1388 bytes)] [Frame: 236, payload: 2739-4100 (1362 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: 5D183DDEB6A1890B17B42DEC4DC7F8BADBE0E26282F61220... SSL segment data (480 bytes) Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: E50B744F Relay Data Length: 498 Data (498 bytes) 0000 74 2c 20 32 30 20 44 65 63 20 32 30 30 38 20 31 t, 20 Dec 2008 1 0010 31 3a 33 39 3a 34 32 20 47 4d 54 0d 0a 43 6f 6e 1:39:42 GMT..Con 0020 74 65 6e 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 tent-Encoding: g 0030 7a 69 70 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e zip..Content-Len 0040 67 74 68 3a 20 31 30 35 38 36 0d 0a 43 6f 6e 74 gth: 10586..Cont 0050 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 ent-Type: text/h 0060 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 tml; charset=utf 0070 2d 38 0d 0a 58 2d 43 61 63 68 65 3a 20 48 49 54 -8..X-Cache: HIT 0080 20 66 72 6f 6d 20 73 71 32 33 2e 77 69 6b 69 6d from sq23.wikim 0090 65 64 69 61 2e 6f 72 67 0d 0a 58 2d 43 61 63 68 edia.org..X-Cach 00a0 65 2d 4c 6f 6f 6b 75 70 3a 20 48 49 54 20 66 72 e-Lookup: HIT fr 00b0 6f 6d 20 73 71 32 33 2e 77 69 6b 69 6d 65 64 69 om sq23.wikimedi 00c0 61 2e 6f 72 67 3a 33 31 32 38 0d 0a 41 67 65 3a a.org:3128..Age: 00d0 20 39 32 35 39 33 0d 0a 58 2d 43 61 63 68 65 3a 92593..X-Cache: 00e0 20 48 49 54 20 66 72 6f 6d 20 6b 6e 73 71 31 2e HIT from knsq1. 00f0 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e knams.wikimedia. 0100 6f 72 67 0d 0a 58 2d 43 61 63 68 65 2d 4c 6f 6f org..X-Cache-Loo 0110 6b 75 70 3a 20 48 49 54 20 66 72 6f 6d 20 6b 6e kup: HIT from kn 0120 73 71 31 2e 6b 6e 61 6d 73 2e 77 69 6b 69 6d 65 sq1.knams.wikime 0130 64 69 61 2e 6f 72 67 3a 33 31 32 38 0d 0a 58 2d dia.org:3128..X- 0140 43 61 63 68 65 3a 20 4d 49 53 53 20 66 72 6f 6d Cache: MISS from 0150 20 6b 6e 73 71 32 35 2e 6b 6e 61 6d 73 2e 77 69 knsq25.knams.wi 0160 6b 69 6d 65 64 69 61 2e 6f 72 67 0d 0a 58 2d 43 kimedia.org..X-C 0170 61 63 68 65 2d 4c 6f 6f 6b 75 70 3a 20 4d 49 53 ache-Lookup: MIS 0180 53 20 66 72 6f 6d 20 6b 6e 73 71 32 35 2e 6b 6e S from knsq25.kn 0190 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 ams.wikimedia.or 01a0 67 3a 38 30 0d 0a 56 69 61 3a 20 31 2e 30 20 73 g:80..Via: 1.0 s 01b0 71 32 33 2e 77 69 6b 69 6d 65 64 69 61 2e 6f 72 q23.wikimedia.or 01c0 67 3a 33 31 32 38 20 28 73 71 75 69 64 2f 32 2e g:3128 (squid/2. 01d0 36 2e 53 54 41 42 4c 45 32 31 29 2c 20 31 2e 30 6.STABLE21), 1.0 01e0 20 6b 6e 73 71 31 2e 6b 6e 61 6d 73 2e 77 69 6b knsq1.knams.wik 01f0 69 6d im Data: 742C2032302044656320323030382031313A33393A343220... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: B0FFB7AB Relay Data Length: 452 Data (452 bytes) 0000 65 64 69 61 2e 6f 72 67 3a 33 31 32 38 20 28 73 edia.org:3128 (s 0010 71 75 69 64 2f 32 2e 36 2e 53 54 41 42 4c 45 32 quid/2.6.STABLE2 0020 31 29 2c 20 31 2e 30 20 6b 6e 73 71 32 35 2e 6b 1), 1.0 knsq25.k 0030 6e 61 6d 73 2e 77 69 6b 69 6d 65 64 69 61 2e 6f nams.wikimedia.o 0040 72 67 3a 38 30 20 28 73 71 75 69 64 2f 32 2e 36 rg:80 (squid/2.6 0050 2e 53 54 41 42 4c 45 32 31 29 0d 0a 43 6f 6e 6e .STABLE21)..Conn 0060 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d ection: close... 0070 0a 1f 8b 08 00 00 00 00 00 00 03 cd 7d e9 76 db ............}.v. 0080 48 92 ee ef f6 53 a4 59 b7 4a 56 8f 48 8a da 6c H....S.Y.JV.H..l 0090 c9 12 e6 c8 f2 da 65 d9 1a cb 2e df 39 9e ba 3c ......e.....9..< 00a0 20 01 8a b0 40 80 0d 80 a2 58 3d 7d 4e bf c3 cc ...@....X=}N... 00b0 8b dc fb 0a f3 26 f3 24 f7 8b c8 15 0b a9 a5 dc .....&.$........ 00c0 9e ae ee 63 11 c8 44 66 64 66 64 64 ec 79 f8 f0 ...c..Dfdfdd.y.. 00d0 f9 fb 93 8f ff 7a f6 42 8c 8b 49 2c ce 3e 3d 7b .....z.B..I,.>={ 00e0 fb e6 44 b4 da dd ee e7 ed 93 6e f7 f9 c7 e7 e2 ..D.......n..... 00f0 7f bf fe 78 fa 56 f4 3a 9b e2 63 e6 27 79 54 44 ...x.V.:..c.'yTD 0100 69 e2 c7 dd ee 8b 77 2d d1 1a 17 c5 f4 a0 db 9d i.....w-........ 0110 cf e7 9d f9 76 27 cd 2e ba 1f 3f 74 af a9 ad 1e ....v'....?t.... 0120 7d ac 7e b6 0b e7 cb 4e 50 04 2d ef c1 21 77 78 }.~....NP.-..!wx 0130 3d 89 93 fc a8 a1 99 de fe fe be fc ba 45 95 0e =............E.. 0140 62 3f b9 38 6a 85 49 4b d8 5f 41 94 1d b5 e2 22 b?.8j.IK._A...." 0150 43 6b 7f 38 1c 87 7e 80 bf 7f 38 9c 84 85 8f d1 Ck.8..~...8..... 0160 14 d3 76 f8 e7 59 74 75 d4 3a 49 93 22 4c 8a f6 ..v..Ytu.:I."L.. 0170 c7 c5 34 6c 89 a1 7c 3a 6a 15 e1 75 d1 a5 0e 9e ..4l..|:j..u.... 0180 8a e1 d8 cf f2 b0 38 9a 15 a3 f6 93 96 e8 ae 6e ......8........n 0190 e7 bc 58 c4 61 63 6b c3 3c 2f 7d 9d f8 93 f0 a8 ..X.ack.. 01a0 ff 49 9d 96 5f cb e1 d1 fb ab 28 9c d7 67 fe 4d .I.._.....(..g.M 01b0 40 65 db bd ed c7 db 4e e1 9b 5c cd 19 0a 8b 6c @e.....N..\....l 01c0 e6 4c d7 a7 3c cc 14 dc c9 2c 8e 2d 64 54 f0 0a .L..<....,.-dT.. 01d0 02 ef 94 a6 b1 5e f4 16 f2 c0 0c 63 a6 de c0 ae .....^.....c.... 01e0 da ef 94 1e 61 69 f9 b3 2c f4 2f 5f 66 34 ad f5 ....ai..,./_f4.. 01f0 b9 3a .: Data: 46222EC49B1762B7B3BBB9B9F9ABE790F6FB2C86998C372F... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: A3F6A799 Relay Data Length: 452 Data (452 bytes) 0000 99 65 1f c2 ab 28 c7 10 e5 40 b6 76 f7 7b 3b 4f .e...(...@.v.{;O 0010 7a 8f 37 5d 2c 08 33 aa 40 c5 56 2d 60 01 78 91 z.7],.3.@.V-`.x. 0020 f8 83 38 3c 3e 7b 53 1b ab 2c f9 0c 99 bf b1 f8 ..8<>{S..,...... 0030 1c 18 cf 1a 08 d6 e0 8c 20 fa 7f a4 fa 68 e6 4b ........ ....h.K 0040 ab b5 81 d5 ff d5 76 f2 3c ba 88 8a 5b d4 3b fd ......v.<...[.;. 0050 7c 3e bb 80 e0 54 7c 0c 27 d3 18 ba 80 15 e8 07 |>...T|.'....... 0060 a4 f7 a7 11 0b f5 4a 8c b7 72 e7 bf 5d 6f ed 49 ......J..r..]o.I 0070 29 f5 e8 2f f2 ef c7 10 aa 89 bf d2 7b d2 9f 30 )../........{..0 0080 8a 1e fd c5 fc cc ff ea 4c d8 f3 67 f4 5e ae 14 ........L..g.^.. 0090 6b 1d dc 3d 41 6d 19 14 a5 25 f9 b2 e9 8c d3 c0 k..=Am...%...... 00a0 7f 1a e6 39 96 9b 2b b4 e6 11 28 43 2e 07 86 95 ...9..+...(C.... 00b0 c8 69 76 92 b4 f4 c6 69 e3 03 6a 65 11 e3 2d ab .iv....i..je..-. 00c0 39 d0 42 73 e9 69 7a c5 b3 cd a5 dd 3f fe fa ab 9.Bs.iz.....?... 00d0 f7 c7 ae a5 90 55 1a 57 23 71 77 a4 c6 34 13 83 .....U.W#qw..4.. 00e0 a8 28 91 63 f0 fd 42 bf 17 5f 73 01 5e bb 44 a2 .(.c..B.._s.^.D. 00f0 a9 fc 35 54 68 42 52 31 ae f0 ad e1 f2 bf fa d7 ..5ThBR1........ 0100 cb 8e 88 6f 79 1a 4d e6 6a 05 1b 3b 5b 7d f0 55 ...oy.M.j..;[}.U 0110 4e 13 3a 4b e6 17 ef 52 d0 fe f0 68 6d ed a9 fb N.:K...R...hm... 0120 fc 36 05 15 a5 97 0f aa 2b 5a 39 b3 ee b1 9e a4 .6......+Z9..... 0130 99 c8 fc 38 e1 8e f9 ac 61 e1 bd 1b 26 dd 52 d1 ...8....a...&.R. 0140 ef 98 ce 06 9e af 91 d5 20 be e2 ab e1 bd e9 60 ........ ......` 0150 3d 32 a7 2a ce 6a e0 0d 74 c2 61 1d a7 0e bb 52 =2.*.j..t.a....R 0160 25 7b 38 48 83 85 18 c6 7e 0e 45 2f b3 73 34 1c %{8H....~.E/.s4. 0170 48 a0 99 48 f2 f6 26 fd 93 cf 06 5f c3 61 c1 1a H..H..&...._.a.. 0180 c2 36 a9 31 a8 97 b6 ed 05 ea dd 20 ba 12 51 00 .6.1....... ..Q. 0190 65 6a 9c 0e fc f8 73 06 7d 5a c8 8a 5f 5b 34 4c ej....s.}Z.._[4L 01a0 e3 d9 24 69 2b 55 29 2b 85 f5 57 ce bb 3f 1c fa ..$i+U)+..W..?.. 01b0 42 ea 65 8b 14 ba 2e 6a 93 7e 60 37 f8 a5 d6 68 B.e....j.~`7...h 01c0 50 72 dd 51 Pr.Q Data: 99651FC2AB28C710E540B676F77B3B4F7A8F375D2C0833AA... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: ED7155CE Relay Data Length: 498 Data (498 bytes) 0000 e6 62 e7 5a 85 01 59 f3 20 4f 3f d2 48 22 1e 1e .b.Z..Y. O?.H".. 0010 89 b5 b5 75 11 a4 c3 d9 04 8b d8 99 13 51 8e 13 ...u.........Q.. 0020 53 61 fd a9 d9 77 87 5d c0 e7 61 04 e3 9e 9e 9f Sa...w.]..a..... 0030 51 94 e5 05 ed c3 08 ea 41 d2 e8 60 16 7b 25 b8 Q.......A..`.{%. 0040 68 36 d5 49 c4 c3 c7 d7 db 3c 0a 02 f8 7c 36 68 h6.I.....<...|6h 0050 79 2f 33 e8 9c 6e 56 03 8d b7 e5 e7 95 39 e2 26 y/3..nV......9.& 0060 24 64 54 2c ff 33 95 be ce 26 53 68 3d db 89 7f $dT,.3...&Sh=... 0070 d5 f2 fe 84 07 51 a4 07 02 53 2a 35 80 3f a8 35 .....Q...S*5.?.5 0080 20 ad b1 87 3a d1 05 eb 84 69 6e 37 9c 5a 92 ce ...:....in7.Z.. 0090 bf 49 a6 b3 a2 e5 c9 07 aa a2 e7 83 b5 14 22 2f .I............"/ 00a0 fc ac d0 8a 6f 45 8e 24 20 0a 97 02 9c 61 50 49 ....oE.$ ....aPI 00b0 63 9a 48 bb 8c ca c4 9f 09 fa 39 48 a1 42 f5 c5 c.H.......9H.B.. 00c0 45 98 c6 e9 05 f1 3a 82 ce 3c 06 a5 23 c4 4b 20 E.....:..<..#.K 00d0 18 a9 c6 88 11 5a 4c a2 df 30 d5 02 f4 39 8b 7d .....ZL..0...9.} 00e0 a0 69 3a 01 50 e0 65 92 b0 80 ea fd 72 43 e4 d0 .i:.P.e.....rC.. 00f0 9f 99 f1 49 ae 0f cb d2 7f a4 be 2e 16 7d 55 15 ...I.........}U. 0100 1a 52 a5 a4 24 0c b6 e5 ba a9 75 5e cf a6 02 1a .R..$.....u^.... 0110 7b 87 c1 4a 01 57 26 20 e2 e6 cb 3b 0e a2 dc 9f {..J.W& ...;.... 0120 0c 22 f0 28 34 9e 4a af d5 42 d9 65 e5 2d f7 a7 .".(4.J..B.e.-.. 0130 96 d8 9d d0 62 0c 3e 0e 5c 14 eb 74 b1 71 9d b9 ....b.>.\..t.q.. 0140 e6 a2 28 81 21 03 a2 01 b1 d0 47 38 2a 83 62 7c ..(.!.....G8*.b| 0150 b0 bd bb 35 bd 7e 0a 8c d1 28 20 a7 e8 65 14 87 ...5.~...( ..e.. 0160 07 af fd f9 e5 8f 5b 8f f3 3e 80 e8 7c 9d 42 df ......[..>..|.B. 0170 ad 56 8e d9 7f 33 5d 54 6d 2d 17 64 d9 10 60 7e .V...3]Tm-.d..`~ 0180 1c 2b 06 9a 8d 26 17 02 e6 86 a3 d6 2d 44 92 12 .+...&......-D.. 0190 99 64 88 bb 8f bb 8f 9f 74 ab 70 74 b7 77 37 a7 .d......t.pt.w7. 01a0 d7 ed 3a 78 3c a4 a3 16 8a a1 55 0e 69 1a 8e 5a ..:x<.....U.i..Z 01b0 5b 7b db 2d 31 80 15 26 84 b1 09 ef d5 10 e4 84 [{.-1..&........ 01c0 c8 71 40 64 21 e2 51 9b af a1 cf 2a f7 ca 54 e2 .q@d!.Q....*..T. 01d0 1b 58 5c 16 77 9d 32 58 ad 60 72 b1 9a f0 17 49 .X\.w.2X.`r....I 01e0 ec 67 e8 5d 4e d1 dd c4 35 86 3b 87 ee 92 21 69 .g.]N...5.;...!i 01f0 0f e3 .. Data: E662E75A850159F3204F3FD248221E1E89B5B57511A4C3D9... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: FCC1474D Relay Data Length: 498 Data (498 bytes) 0000 68 2a ed 11 6a 02 7a bb 76 fc bd 5e 4b 2f 80 1c h*..j.z.v..^K/.. 0010 a7 42 9c ca aa 55 d6 5f 2e 62 9f 4c 51 66 9d 4b .B...U._.b.LQf.K 0020 0b eb 3c 38 8d 6a a4 94 e4 e7 70 ea 1d 8b c3 81 ..<8.j....p..... 0030 07 c6 f5 b0 3b f0 78 6b 57 f7 e2 87 74 78 d9 7f ....;.xkW...tx.. 0040 24 77 fa c2 6e 06 7a 2d ec 6b 2f c3 33 f5 23 40 $w..n.z-.k/.3.#@ 0050 19 86 59 3a 65 82 10 06 62 b0 a8 36 f8 39 84 80 ..Y:e...b..6.9.. 0060 15 42 53 8c e9 d0 46 07 fb ca 9b 9b df 92 a8 cd .BS...F......... 0070 f2 99 1f c7 0b b4 37 4b 02 42 5f ec b7 04 14 8d ......7K.B_..... 0080 29 4c 3e 9b 4c c0 16 a6 a3 3a dc af a3 d8 ae 25 )L>.L....:.....% 0090 3f 78 63 fc 2b 49 c1 9b 84 3f af cc e9 39 60 1f ?xc.+I...?...9`. 00a0 f7 3f 83 e7 ec bf 48 2e 60 06 85 52 57 41 c8 45 .?....H.`..RWA.E 00b0 82 8a 84 2e f2 9c 77 00 40 bd 96 40 cf 31 c0 90 ......w.@..@.1.. 00c0 bb 00 52 4d 00 32 78 7e 32 e7 05 1b 02 e0 d2 34 ..RM.2x~2......4 00d0 c7 79 0a 98 c9 f8 48 d4 28 a0 e9 e2 fa 04 63 4e .y....H.(.....cN 00e0 bf 26 79 18 5f 81 69 fe ef bf fd 07 8e 6d a2 bd .&y._.i......m.. 00f0 33 e0 23 26 42 d6 ba 18 8b 69 0a 6d 7b 4e 83 af 3.#&B....i.m{N.. 0100 8c e3 39 aa 4f 5c c4 30 2f 3c fd 8b 97 0a 12 7c ..9.O\.0/<.....| 0110 f5 cb 10 66 4e 33 e8 e7 fc e4 f1 1f fe 00 33 52 ...fN3........3R 0120 fd e2 ae 78 d8 d0 e9 49 9a 25 73 ac b1 e9 d7 bc ...x...I.%s..... 0130 f0 f4 2f 45 50 a7 40 d9 82 05 2b c9 55 0c 2d b5 ../EP.@...+.U.-. 0140 a0 df 84 0d 7e b6 30 06 e9 9c 08 43 91 d1 3f c4 ....~.0....C..?. 0150 26 e9 73 18 df f1 aa b2 8d 7c 0b 7d b0 bd 3a 07 &.s......|.}..:. 0160 23 b0 85 37 6a 67 cc 62 fc 8e 23 43 8d 52 1c 7d #..7jg.b..#C.R.} 0170 57 61 dc ee 39 64 e5 07 12 7e 88 79 99 fa 89 53 Wa..9d...~.y...S 0180 31 61 61 bd e5 f5 c0 87 a0 c4 13 d5 0a c4 df b4 1aa............. 0190 3c fa 58 d5 90 1b 34 8e 6e d1 25 88 78 de 4f 93 <.X...4.n.%.x.O. 01a0 be 5d d2 65 dd 6f ad ee 9e 1a a2 ed 64 31 82 81 .].e.o......d1.. 01b0 bd 03 28 ef 69 1b f7 41 3b 30 cf cb 80 d8 5e 0d ..(.i..A;0....^. 01c0 04 37 01 0e 27 c3 ec 9b ee 1f 1c 2e 9b fc 2d 77 .7..'.........-w 01d0 f2 95 01 be ff 26 87 61 6d 05 04 9d 1b d6 41 1b .....&.am.....A. 01e0 f2 b9 9d 5b 2d 48 09 8c 77 30 28 8f fb c7 13 50 ...[-H..w0(....P 01f0 b4 a1 .. Data: 682AED116A027ABB76FCBD5E4B2F801CA7429CCAAA55D65F... Secure Socket Layer No. Time Source Destination Protocol Info 242 44.660828 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 242 (1458 bytes on wire, 1458 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.773615000 [Time delta from previous captured frame: 0.045851000 seconds] [Time delta from previous displayed frame: 0.051214000 seconds] [Time since reference or first frame: 44.660828000 seconds] Frame Number: 242 Frame Length: 1458 bytes Capture Length: 1458 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor:data:data:data:data:data:data:data:ssl] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x275e1175 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1440 Identification: 0xc378 (50040) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4024 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 38165, Ack: 17579, Len: 1388 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 38165 (relative sequence number) [Next sequence number: 39553 (relative sequence number)] Acknowledgement number: 17579 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 42752 (scaled) Checksum: 0xc0fa [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179702, TSecr 3801855 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 241] [The RTT to ACK the segment was: 0.045851000 seconds] [Number of bytes in flight: 1388] TCP segment data (1336 bytes) TCP segment data (15 bytes) [Reassembled TCP Segments (4101 bytes): #238(1377), #240(1388), #242(1336)] [Frame: 238, payload: 0-1376 (1377 bytes)] [Frame: 240, payload: 1377-2764 (1388 bytes)] [Frame: 242, payload: 2765-4100 (1336 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: 90018034984418AA7AA0D35A8114FBCF613D89EA86310D53... SSL segment data (4064 bytes) SSL segment data (448 bytes) [Reassembled SSL Segments (512 bytes): #236(480), #242(32)] [Frame: 236, payload: 0-479 (480 bytes)] [Frame: 242, payload: 480-511 (32 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 3A03FBFC Relay Data Length: 498 Data (498 bytes) 0000 bf 0a 8c 1b d6 83 db 11 aa 9d bb 83 71 3c ba a9 ............q<.. 0010 ff 1b 96 42 36 50 ef b8 cb 8b 71 3b e4 3c 0f c3 ...B6P....q;.<.. 0020 3e 51 b6 e5 d3 b0 b3 1a 1f d0 00 93 c6 5b 8d bf >Q...........[.. 0030 b4 15 5f 5c cb e3 bb 4f 1c eb 0a 74 d8 5d 0d 80 .._\...O...t.].. 0040 6e 06 ce 19 68 e6 ee 60 7c 08 e1 ea 01 6b f0 2a n...h..`|....k.* 0050 8c dc 5b 0d 82 6d 62 e9 62 30 39 eb 32 65 eb 32 ..[..mb.b09.2e.2 0060 3d c4 8f 95 f2 bd f7 a0 db 35 3a dc 07 82 e5 29 =........5:....) 0070 f8 81 a4 f3 0e 1c 22 e6 1f d3 e1 c7 f4 e2 22 0e ......".......". 0080 d7 c5 5f 04 09 e0 a0 90 e7 f4 1e 74 8a 54 3f 54 .._........t.T?T 0090 a7 f5 54 97 bc 8e 82 50 97 8c f1 1b 25 a5 46 1e ..T....P....%.F. 00a0 ad 3f 15 7f 15 e8 10 4a 18 c0 a7 b5 d4 e0 35 8c .?.....J......5. 00b0 60 c8 74 93 69 b8 a2 a0 4c ff 88 ba 83 04 97 48 `.t.i...L......H 00c0 09 f9 9d e4 90 5c 99 cb fb e2 9c 56 b7 71 63 61 .....\.....V.qca 00d0 ad bd fa fa 08 5c 96 eb be a2 5e 1f 08 09 01 f5 .....\....^..... 00e0 43 a4 ef d7 c6 b5 99 cc db 24 6a 03 27 50 b5 44 C........$j.'P.D 00f0 b7 f9 c8 a8 b2 f1 77 e4 f0 b7 36 97 73 f8 9a dc ......w...6.s... 0100 9f 80 fd 4a c2 38 07 c3 37 4b 0a 98 c4 fb ef 9e ...J.8..7K...... 0110 f5 a1 69 f6 03 7f 6b 05 e7 0f e7 a4 71 96 a6 93 ..i...k.....q... 0120 36 7c 08 a0 df 60 4a 4b 44 5f 37 07 7f 25 d9 9c 6|...`JKD_7..%.. 0130 78 f4 2e 9c 8b 67 d9 2c c9 e7 30 7e af 6f 08 d9 x....g.,..0~.o.. 0140 b8 78 f4 e6 83 f8 ec c7 97 20 d3 bd fd 27 7b 90 .x....... ...'{. 0150 b1 ee 29 31 48 4f 82 bc 2b c5 86 cd ee e6 3e 89 ..)1HO..+.....>. 0160 79 7c 96 dd 34 b8 ee d6 26 89 13 b7 ad 6e b8 6c y|..4...&....n.l 0170 7c e6 88 19 fb e0 b9 bf 9b 98 71 7b 58 b5 c4 f6 |.........q{X... 0180 8f 26 7e 2c 43 9d 0a c7 58 5f 3b c2 a4 be c5 24 .&~,C...X_;....$ 0190 87 ab 93 28 bc 14 e7 5a 60 c5 6e a8 22 b9 eb 25 ...(...Z`.n."..% 01a0 a8 59 91 6d 8c 88 f3 11 0c 33 33 da 6b 40 ff 35 .Y.m.....33.k@.5 01b0 c3 7d 33 db 0d cc cf 89 b5 c7 d9 51 93 53 7c e2 .}3........Q.S|. 01c0 2b 8c 88 c2 4f 1e b6 02 31 09 04 45 89 29 c7 9e +...O...1..E.).. 01d0 22 be 9c a4 20 d2 71 f8 79 41 c4 22 07 4b 3a 1c "... .q.yA.".K:. 01e0 0b 9f 19 fa 6a fb bf a0 a9 7e 3a ea bf 8a fd 09 ....j....~:..... 01f0 3c b9 <. Data: BF0A8C1BD683DB11AA9DBB83713CBAA9FF1B96423650EFB8... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 11AD84C5 Relay Data Length: 498 Data (498 bytes) 0000 7c cb 77 53 09 b1 f5 b6 c4 ab bd 32 fc 78 43 cb |.wS.......2.xC. 0010 af d2 39 18 33 38 a7 c1 89 08 42 83 19 03 bf 17 ..9.38....B..... 0020 f6 bd 57 79 41 6d 3e 25 f2 40 6d ca 32 ac 18 41 ..WyAm>%.@m.2..A 0030 c2 b2 16 b8 ff 85 18 84 e4 18 90 4b 11 ac 82 0b ...........K.... 0040 ef af 41 3b c6 fd 67 fe c2 74 29 5f 09 7a e5 d9 ..A;..g..t)_.z.. 0050 df 52 fa c8 05 14 47 31 16 81 ec 54 5c 05 ad 0f .R....G1...T\... 0060 7d ac 0b f7 c7 3d 51 ad 11 59 7c 58 92 84 0a 64 }....=Q..Y|X...d 0070 06 bb 91 16 31 eb 92 4f c9 dd 12 ac 80 71 b0 54 ....1..O.....q.T 0080 a4 bf 54 ee 38 60 7a 43 d7 4f d3 16 48 69 91 55 ..T.8`zC.O..Hi.U 0090 3c 35 bc cf 12 b8 7f f6 c9 59 96 8c 59 25 e1 85 <5.......Y..Y%.. 00a0 fc 42 4d 01 0b 31 78 c3 83 3e 8c a4 b0 1d b9 ea .BM..1x..>...... 00b0 3a a9 d1 79 1f 07 90 3d e3 9c 5c 0d a5 67 27 de :..y...=..\..g'. 00c0 40 e4 a4 37 9e f9 69 5a 99 67 cd cd 9c 0f d3 82 @..7..iZ.g...... 00d0 1c 53 fb af fc 10 2e a3 56 82 55 ef 85 7a ef 51 .S......V.U..z.Q 00e0 c5 5c 3d 99 56 ff eb ff e9 66 27 a1 0f fc b9 90 .\=.V....f'..... 00f0 10 03 15 08 e6 c3 7c 36 e5 63 7b 08 55 68 1f 0a ......|6.c{.Uh.. 0100 c9 f6 49 96 e6 39 aa f5 37 db 56 75 83 02 c9 04 ..I..9..7.Vu.... 0110 b9 ec 3a 7f 02 75 7b 68 be a1 2f d4 48 15 c3 88 ..:..u{h../.H... 0120 13 5e 8a 01 3d 66 02 cc 69 2c 85 12 74 ee ad 13 .^..=f..i,..t... 0130 42 a0 15 16 02 49 66 1e 84 ac 5d 04 9a 62 17 e1 B....If...]..b.. 0140 97 0f 67 38 88 de e4 ce 30 9a c5 0d c2 f1 49 18 ..g8....0.....I. 0150 43 96 36 eb 66 77 b8 2c 30 eb 86 cd 2e df f0 dc C.6.fw.,0....... 0160 c0 47 2f 69 b3 ab 30 ce 50 74 4a 27 49 86 69 21 .G/i..0.PtJ'I.i! 0170 0a 82 17 50 6e c2 fd 97 04 f4 ea 9e 20 b5 40 23 ...Pn....... .@# 0180 9e a8 02 07 4f d4 1b ee 0f 8e 25 a4 10 48 79 27 ....O.....%..Hy' 0190 4c 52 e8 c6 12 01 1f 67 d6 06 30 4d 91 fd 63 ec LR.....g..0M..c. 01a0 a4 98 45 15 9c e1 d0 0d 48 08 59 1d 02 8d cd 05 ..E.....H.Y..... 01b0 94 f8 70 65 23 8d 09 34 f0 fa 11 ca 5a a8 22 66 ..pe#..4....Z."f 01c0 f0 53 96 5a 88 28 19 c6 33 52 87 57 41 3f c9 7c .S.Z.(..3R.WA?.| 01d0 ab a2 e1 07 6f 88 7f 97 69 02 c8 43 da 2c 28 3f ....o...i..C.,(? 01e0 78 f4 2f 57 7f d4 ca 22 cc 51 6b 1d 9b 89 74 c9 x./W...".Qk...t. 01f0 52 21 R! Data: 7CCB775309B1F5B6C4ABBD32FC7843CBAFD239183338A7C1... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 3545F531 Relay Data Length: 498 Data (498 bytes) 0000 a2 29 0b 13 67 d2 2d d0 60 51 0d ca 1e 58 31 49 .)..g.-.`Q...X1I 0010 53 32 06 e9 cc 67 d9 15 3e 0e a0 f4 20 75 87 4f S2...g..>... u.O 0020 ce ce a1 80 45 14 4c f6 9a c8 a5 af 29 56 5d a2 ....E.L.....)V]. 0030 ab 9a b2 ea 6e c5 4a 96 57 da 2c 2f e8 61 0a 4f ....n.J.W.,/.a.O 0040 63 45 d4 d3 11 74 01 0a a9 d8 0e 04 52 87 e9 84 cE...t......R... 0050 89 01 5a 28 86 71 80 5d 15 8e 72 3a 39 78 6d 16 ..Z(.q.]..r:9xm. 0060 b0 63 0e b9 24 9f 46 aa 1e ad 92 af 6a 42 17 44 .c..$.F.....jB.D 0070 14 90 0f 1a 58 52 87 3e 74 cf f8 37 cb 22 6a 1a ....XR.>t..7."j. 0080 8d 60 8d d3 c0 5f 74 78 73 29 6e 20 49 d9 b3 48 .`..._txs)n I..H 0090 68 d3 6f fb 25 26 44 4b 55 5a 09 4e 13 89 fa d1 h.o.%&DKUZ.N.... 00a0 04 c4 38 c4 b2 9b 6d c7 38 0a 3f f2 88 77 09 ce ..8...m.8.?..w.. 00b0 b7 0c 53 f5 d3 0f bd bd cd a7 d8 ab f0 47 38 9e ..S..........G8. 00c0 5d cc a0 c9 02 7f 04 67 7c ad 6d 1e 63 83 b6 d9 ]......g|.m.c... 00d0 18 7c 80 1d 36 07 ee 40 eb fc 05 db bf 32 97 c6 .|..6..@.....2.. 00e0 f0 71 70 12 15 ac 22 87 82 3e 0c c8 51 b8 ea 43 .qp..."..>..Q..C 00f0 6c 6a 30 84 a8 e1 81 0a f0 27 ea 85 dc d8 91 b3 lj0......'...... 0100 d1 69 93 4b 51 60 4a aa 75 89 dd 64 34 48 e9 b8 .i.KQ`J.u..d4H.. 0110 d6 ca c0 3a e5 7f 05 c3 3b 06 60 cf 3a f5 ec 61 ...:....;.`.:..a 0120 13 50 81 d4 4d d6 b6 e7 29 62 19 70 fa d2 36 e9 .P..M...)b.p..6. 0130 d3 e1 6d be 77 0a f8 54 6f 79 14 f6 a0 aa f2 1b ..m.w..Toy...... 0140 c6 18 3e 1c 68 3d 13 b9 99 40 19 a4 a2 d2 87 ff ..>.h=...@...... 0150 03 fd 49 16 d8 cb f0 4b 80 fb 3f f6 67 98 cd a6 ..I....K..?.g... 0160 d0 02 8a ab 34 c6 27 29 30 e0 11 74 ef e3 74 06 ....4.')0..t..t. 0170 75 5e 93 2a 0e 2e 2b 65 6d 1c bd 90 0a 39 fc 5a u^.*..+em....9.Z 0180 b6 13 4b a7 9c 3d 98 dc 23 0e c4 cd 7d 74 35 b7 ..K..=..#...}t5. 0190 72 ca 79 34 3c 14 c8 02 0a c2 74 08 ec e5 e0 14 r.y4<.....t..... 01a0 0c 05 4b 20 8d 29 f0 4e 0e e4 84 18 6e a7 32 94 ..K .).N....n.2. 01b0 7f 99 41 21 f9 9b bb 3a f6 8d f7 67 5d 28 b9 2a ..A!...:...g](.* 01c0 da 48 d4 3f 73 53 21 d8 17 d6 ee 4e a0 15 25 6f .H.?sS!....N..%o 01d0 01 fa bd 00 e7 d1 a4 f5 bc 93 5e 99 55 c0 58 18 ..........^.U.X. 01e0 ec 21 9c c7 d8 c0 05 f1 0a ac b8 95 fb 9a b4 bf .!.............. 01f0 62 0e b. Data: A2290B1367D22DD060510DCA1E583149533206E9CC67D915... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: DAA49E60 Relay Data Length: 498 Data (498 bytes) 0000 f2 33 24 cb 95 e4 14 71 de 40 01 bc 21 32 12 98 .3$....q.@..!2.. 0010 e6 50 e7 c2 8e 1a 86 24 57 f1 21 40 9f 5d e8 65 .P.....$W.!@.].e 0020 0f f0 d3 0f a4 ea 5a a9 b4 49 fe 62 be 26 a0 d9 ......Z..I.b.&.. 0030 c2 6f d4 c5 ba 43 c0 95 04 19 04 06 f4 15 f3 08 .o...C.......... 0040 2b 4d 26 be b2 76 b7 23 de d3 86 35 10 11 83 04 +M&..v.#...5.... 0050 2a 12 5e f3 7e 90 1e e8 56 63 ce 00 fb c3 61 18 *.^.~...Vc....a. 0060 53 3c 0c 95 97 98 d4 60 46 5a f7 26 5e f4 cd 10 S<.....`FZ.&^... 0070 8a 1b 87 89 c1 b3 a0 67 4f fd 60 fc e0 b9 21 77 .......gO.`...!w 0080 77 36 e8 c9 f1 03 10 4c 94 9c 1e 82 45 0e 80 a8 w6.....L....E... 0090 bc 59 3e da 1b d8 16 98 29 22 76 a0 74 54 37 00 .Y>.....)"v.tT7. 00a0 4f 07 42 30 64 c4 b1 c6 c3 1c 56 33 b9 f7 ed 6a O.B0d.....V3...j 00b0 f2 21 c0 e8 78 81 63 20 01 2d 26 06 31 15 c3 28 .!..x.c .-&.1..( 00c0 93 27 6e 8b db 18 00 35 93 7c ad e5 18 1e d8 06 .'n....5.|...... 00d0 39 84 99 18 d5 98 e8 00 7b 24 d8 fa b0 c9 b0 7a 9.......{$.....z 00e0 34 51 76 58 b2 04 16 74 0c 51 92 f1 11 18 79 8c 4QvX...t.Q....y. 00f0 13 ba 04 69 fc 94 e7 bf da e5 85 bb 6d 6b 3a 89 ...i........mk:. 0100 9f 43 36 cd 55 c3 6b f8 19 38 45 3a 26 d2 4b 68 .C6.U.k..8E:&.Kh 0110 a2 0f a7 2c 4d 42 f1 a5 64 3b c9 62 0f 5b 37 71 ...,MB..d;.b.[7q 0120 dc 69 01 30 80 af 90 c1 55 b1 dc b6 56 87 6b 66 .i.0....U...V.kf 0130 ef 58 4a 1c 0e 66 28 26 9e 15 00 64 ac 8f 92 19 .XJ..f(&...d.... 0140 e1 bb 16 5a 68 60 83 2c bd c4 fc 42 2b 94 48 84 ...Zh`.,...B+.H. 0150 86 c2 1b 18 3e 21 26 1d 7f a3 df e0 7f 28 4e 89 ....>!&......(N. 0160 a2 b1 91 02 aa 1f 4d 9d e5 0e 61 d7 9e 38 05 62 ......M...a..8.b 0170 4a 72 b0 21 2e 71 8e 80 30 d2 31 15 15 98 77 da Jr.!.q..0.1...w. 0180 5f 74 18 8e 7d 78 eb 4c b3 f4 0a 6d 80 76 40 b5 _t..}x.L...m.v@. 0190 02 c1 62 16 c5 cc 85 00 2f a0 4b c5 82 2b 9b 08 ..b...../.K..+.. 01a0 28 27 16 c5 6e fd 8e 78 01 34 a0 f3 58 19 43 14 ('..n..x.4..X.C. 01b0 85 a7 21 d8 9d c6 a3 c0 18 7c c1 7a 7b c1 a1 6a ..!......|.z{..j 01c0 90 ab 70 a8 e2 ad 94 65 2a 64 0a 47 08 6a ba 27 ..p....e*d.G.j.' 01d0 08 3d d2 01 82 bf 92 3a 99 01 61 9f cf fd 44 8f .=.....:..a...D. 01e0 07 13 9a 63 61 18 46 a8 d5 22 8c 8b d8 85 61 06 ...ca.F.."....a. 01f0 e6 00 .. Data: F23324CB95E41471DE4001BC21321298E650E7C28E1A8624... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 18D05359 Relay Data Length: 498 Data (498 bytes) 0000 03 31 cb 42 bb 62 92 e2 e4 85 bd 18 2b 00 b5 16 .1.B.b......+... 0010 e6 41 83 4f 14 87 8c 66 bc 95 e0 f2 c5 5b 18 6b .A.O...f.....[.k 0020 05 05 0d f3 0a 84 7a 64 50 02 56 10 92 52 2d d8 ......zdP.V..R-. 0030 d9 d8 f8 9e 85 17 44 1d e5 72 62 17 84 31 0c 10 ......D..rb..1.. 0040 17 58 ad 67 20 d1 da b7 4a 91 d4 49 8a 69 60 9a .X.g ...J..I.i`. 0050 aa e6 b9 c1 44 77 9e c6 d1 28 9e 49 b5 9b 35 81 ....Dw...(.I..5. 0060 39 2f bd dc a9 62 ce 21 10 08 10 8e 98 bc 9c 14 9/...b.!........ 0070 3d 04 80 09 ed 3c 6c 29 9a 78 3a cf eb 36 24 b8 =....c.......*... 0120 02 c4 11 5b 1c 47 06 28 94 e2 72 0c 85 54 3c 46 ...[.G.(..r..T...m.P...B 0140 e4 6b a1 5f 7b e5 67 49 ce 99 b7 a3 ed 48 ec 3b .k._{.gI.....H.; 0150 7a a5 4e b7 f7 9e 88 9c 98 52 90 6a f8 d8 80 43 z.N......R.j...C 0160 df df dd d1 6f 2e a3 18 42 1c 49 85 eb 52 5e 2b ....o...B.I..R^+ 0170 29 43 ec 51 7e 83 06 c4 da 22 aa 8a 8f ad 65 8a )C.Q~...."....e. 0180 0f f1 86 fd 06 88 9f 93 f2 3d 42 aa a5 04 ad cf .........=B..... 0190 0f 78 ca 86 c5 10 42 32 71 78 92 b5 d4 e6 73 b0 .x....B2qx....s. 01a0 d5 38 4d c1 2a 35 6b 22 d9 f2 49 aa c8 f3 21 0e .8M.*5k"..I...!. 01b0 76 ab bc e3 f7 d4 85 7a ef 55 5e 38 56 f9 29 bc v......z.U^8V.). 01c0 21 c0 97 2a 2e 03 62 12 53 3a 96 3f 0d 7c 5a 8e !..*..b.S:.?.|Z. 01d0 c7 d1 c0 e7 9c a3 30 c5 69 2a 99 7b 6d 8d e6 b3 ......0.i*.{m... 01e0 82 98 5f d3 e6 80 50 43 9e bf e4 3f 51 62 bc 48 .._...PC...?Qb.H 01f0 7d f6 }. Data: 0331CB42BB6292E2E485BD182B00B516E641834F14878C66... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 6708B910 Relay Data Length: 498 Data (498 bytes) 0000 da 5f e0 1b c7 e7 89 1f 3d f9 5a 2e b7 d2 6c 02 ._......=.Z...l. 0010 bb c8 56 68 e6 52 aa 58 c8 39 6a 3e 26 e6 c5 e1 ..Vh.R.X.9j>&... 0020 27 00 d1 2c 31 1e 28 c4 08 02 33 c0 cb 40 15 a9 '..,1.(...3..@.. 0030 c4 03 c2 14 1c cf 81 26 ec d4 58 6f 1f a7 2e 55 .......&..Xo...U 0040 80 a4 02 1e 65 6b 13 8f a4 4c 00 e9 27 16 ea 0d ....ek...L..'... 0050 d0 9e e3 be 99 5d 67 35 34 b1 b3 38 11 e0 5f 8f .....]g54..8.._. 0060 73 8d d5 1b 58 08 16 73 66 05 31 5a 4d 3c bb b6 s...X..sf.1ZM<.. 0070 7f cb 00 74 eb 04 54 8a 4b 6f 79 e5 38 75 a9 79 ...t..T.Koy.8u.y 0080 ad e9 ba df a6 30 06 da a3 5e 3d 7a f2 af 15 cc .....0...^=z.... 0090 88 f5 25 36 ad ca 39 c9 7a 50 fa 47 81 23 44 c8 ..%6..9.zP.G.#D. 00a0 b7 30 2a f1 5b d5 98 7a 94 5a 21 ac 66 03 30 2a .0*.[..z.Z!.f.0* 00b0 e4 de ea 92 64 08 3e d4 49 f2 07 7d cb 8a 24 92 ....d.>.I..}..$. 00c0 d2 80 14 7a bd 24 63 6e 16 84 84 d3 f2 14 37 c2 ...z.$cn......7. 00d0 fe e2 3a 04 36 58 72 28 1f 3d f9 9a c1 fc 8c 8d ..:.6Xr(.=...... 00e0 73 1a 02 a7 49 cf 84 b9 eb ed f7 f6 0d 4b 57 f5 s...I........KW. 00f0 5c 0c 13 e2 f8 ad ae e9 23 38 6a 7e e1 e9 5f 5a \.......#8j~.._Z 0100 f9 4d 34 27 49 88 4f 9c 87 21 18 ef da ac be 06 .M4'I.O..!...... 0110 5a 3b 4e 52 ea 11 5e 4c 97 4a 9b d1 c0 f8 93 8f Z;NR..^L.J...... 0120 23 58 5e b0 97 ee 6e 82 f3 1f f3 5e 0d ae 96 6f #X^...n....^...o 0130 51 95 b6 be de 78 ec cf d1 07 f2 f6 99 c9 37 f3 Q....x........7. 0140 42 f5 6a 1b 94 91 5c d6 f3 6e a8 e0 d0 8a df c9 B.j...\..n...... 0150 a8 ad 32 97 be 8e 10 58 90 d1 0a f4 7b 3b ed 4d ..2....X....{;.M 0160 fc 7f 6f 95 5f 24 6a 63 6d 15 bf 46 db ee 0c 01 ..o._$jcm..F.... 0170 26 e2 39 86 4a 41 07 9d 7b 73 67 65 5b a7 df f5 &.9.JA..{sge[... 0180 fd ee 12 c8 94 69 73 29 dc 8a 65 2b 59 32 a1 c7 .....is)..e+Y2.. 0190 fb 8e 96 cc 1b a7 f4 1f 8d 75 23 80 cb ab 5a d9 .........u#...Z. 01a0 a3 b4 c8 7d bd c8 06 c1 4b 4b df f2 4a 8f 0a 79 ...}....KK..J..y 01b0 a5 cf a4 b2 2b 1a f3 a2 e1 ef 1c 7f 28 e6 0b 4a ....+.......(..J 01c0 fe 51 df 81 a7 83 1b 6d a3 87 83 75 b2 ba 13 37 .Q.....m...u...7 01d0 d7 e0 9b a5 f8 38 33 e2 b2 0b 16 0f ba ea 95 65 .....83........e 01e0 c7 bd fd f7 f2 ec d8 59 32 ee 92 63 d7 9d 86 de .......Y2..c.... 01f0 ec 12 .. Data: DA5FE01BC7E7891F3DF95A2EB7D26C02BBC85668E652AA58... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 7C390A2B Relay Data Length: 498 Data (498 bytes) 0000 46 fe fc da 35 cd 7b 96 5e 43 01 21 7d aa 57 b9 F...5.{.^C.!}.W. 0010 a5 bc 82 c6 2b 86 a7 ee 45 ff 7c 96 65 e1 e2 1e ....+...E.|.e... 0020 ba 20 d3 84 90 4d 2c 53 0a 55 eb c9 33 b6 d7 d9 . ...M,S.U..3... 0030 db 9d ac 1b 07 2e ef 19 0c 27 97 35 b8 89 83 7a .........'.5...z 0040 1e 66 73 70 29 fd 17 ee 21 ae 5e 0a 7e 09 cd 33 .fsp)...!.^.~..3 0050 57 e1 27 d9 fc ee f6 13 b7 f5 e7 e0 a8 25 6f c3 W.'..........%o. 0060 33 e3 d6 47 dd cd 12 24 55 f5 0b 1d e6 69 32 98 3..G...$U....i2. 0070 65 0b 22 e0 56 0f 63 df 53 a3 2d 0f 66 71 5d 91 e.".V.c.S.-.fq]. 0080 5e 48 1b 82 72 9e f4 5e 81 8d 87 dd 84 3a 7f e6 ^H..r..^.....:.. 0090 4f c0 67 42 09 fa 4d f6 bf ed e2 75 3a 87 3b cd O.gB..M....u:.;. 00a0 5c f9 d3 53 5c 03 f2 54 34 d8 cf ce c7 e1 68 14 \..S\..T4.....h. 00b0 71 6a 08 ed 45 6c de 78 a6 b0 0c fe 5b a8 c2 06 qj..El.x....[... 00c0 6c 79 af 62 16 ad d0 27 8a c9 e9 eb 75 82 4f 40 ly.b...'....u.O@ 00d0 1c 5a 6e 9d 0b cd 8c ab 42 af e9 6d a5 4b 30 61 .Zn.....B..m.K0a 00e0 cc 22 eb 29 ac 4c d7 a9 3f 29 ad 07 9e e5 3a a8 .".).L..?)....:. 00f0 1f 0a 0f 7a 8f 5d 3c a8 7a 56 43 2c a1 3d e0 ae ...z.]<.zVC,.=.. 0100 eb b9 7c 27 db 72 1e ca d0 55 1b 2a 10 a7 85 08 ..|'.r...U.*.... 0110 1e 60 98 e5 4d ce dd 97 9e fb 24 59 d7 1a 30 d0 .`..M.....$Y..0. 0120 9b e5 e3 28 0b fb e4 17 ee b4 03 b1 49 16 08 55 ...(........I..U 0130 a0 83 aa e6 6d 28 38 f1 9e 8c 70 e7 95 5a 4b e1 ....m(8...p..ZK. 0140 ad a9 83 df 03 57 fa ef e7 d0 a6 de 53 2b 4c 0d .....W......S+L. 0150 08 6e 60 95 72 b8 5c 4b 2e cf f6 e3 55 5b cf 9e .n`.r.\K....U[.. 0160 f1 56 7e 62 4e 4a 2e 8e 3d 51 55 63 4f 76 dc b5 .V~bNJ..=QUcOv.. 0170 fe 8c 85 94 7b fe 2d dc 37 79 47 6a 54 42 11 74 ....{.-.7yGjTB.t 0180 98 25 52 40 11 0b 10 aa 77 9e 94 f0 85 98 f9 67 .%R@....w......g 0190 7e 26 85 40 99 4b 6b 43 68 25 0c f3 ae 90 24 aa ~&.@.KkCh%....$. 01a0 21 10 5c 0d 1e 71 99 35 fb 39 69 b8 20 fa d8 9c !.\..q.5.9i. ... 01b0 5c 5a ee 69 f0 96 b1 d9 ba 1c 53 99 4e e0 45 76 \Z.i......S.N.Ev 01c0 32 fd bb bc d0 04 f1 39 8c 77 02 5e 02 10 d5 08 2......9.w.^.... 01d0 5a 58 72 78 1a 00 6f 03 b8 f7 21 af cd 1a 8f fb ZXrx..o...!..... 01e0 31 30 76 55 88 e1 45 08 5c 03 69 84 c8 76 d1 ff 10vU..E.\.i..v.. 01f0 0c 5d .] Data: 46FEFCDA35CD7B965E4301217DAA57B9A5BC82C62B86A7EE... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 013AE880 Relay Data Length: 498 Data (498 bytes) 0000 2d c6 61 59 7f f2 ab d0 2f 49 8c 33 4f ce 8c 48 -.aY..../I.3O..H 0010 37 e1 bf 23 6b ff 73 54 b4 4f a3 4b 7f 11 75 fe 7..#k.sT.O.K..u. 0020 74 f6 6a 49 a4 93 ad 04 95 07 64 ee 38 1c b0 21 t.jI......d.8..! 0030 8c 97 84 5d 96 7e 8e 10 25 30 db 10 3f 87 c9 82 ...].~..%0..?... 0040 dc b5 ef 17 fe 54 66 f0 77 bb bb 4f ba 65 f8 14 .....Tf.w..O.e.. 0050 5f 5f 05 ba 91 9d df fe 9e f1 4f cb a6 f1 1f 8d __........O..... 0060 8b af ec 75 0b b6 35 91 19 84 80 3d cc fc 56 ca ...u..5....=..V. 0070 8a c6 b5 af b5 49 a8 e0 b4 c7 8f 68 8b fe 36 9e .....I.....h..6. 0080 1c 12 69 ac 8d 8e 51 88 5f ca 9d 70 83 80 50 0e ..i...Q._..p..P. 0090 15 90 fe cf 95 e8 81 ef c0 2e 43 df df ec 08 ed ..........C..... 00a0 06 20 dc 89 5d 6e 0e 5d 28 b1 cb c7 48 01 17 0b . ..]n.](...H... 00b0 0a 1a 23 43 26 45 3a d4 5d 38 5e 82 d2 0e 7c b8 ..#C&E:.]8^...|. 00c0 dd 6f f4 8f c1 e2 5d da 99 b6 25 42 95 78 b5 57 .o....]...%B.x.W 00d0 72 c1 3e 9d 1f 2f 65 64 5e 20 2f 09 fc c2 8a 3e r.>../ed^ /....> 00e0 83 d1 3f 87 27 4a d8 3f f3 33 eb f4 a1 6b 28 40 ..?.'J.?.3...k(@ 00f0 b9 86 e0 1a 5e b9 68 89 1a ed 34 ca c9 db c6 e6 ....^.h...4..... 0100 66 34 2f 3c fd ab 46 32 1d b7 78 15 c3 c1 88 61 f4/<..F2..x....a 0110 e2 39 be 03 46 ec 2d c1 08 0d c3 1d 9c e3 2b 51 .9..F.-.......+Q 0120 24 25 1c f8 7d 5b 5a 6d 33 e6 2c e4 61 e3 cc 9c $%..}[Zm3.,.a... 0130 09 3c e1 b9 73 c2 50 be 83 d8 fd 78 c9 ec e9 58 .<..s.P....x...X 0140 96 3b 6d a5 5a 00 0c 8b dc 2a 1e aa ea 89 a5 75 .;m.Z....*.....u 0150 77 f0 61 00 3e 43 89 07 ee a6 df cc 1c 68 ed 1c w.a.>C.......h.. 0160 57 d5 6a fa 8a ca e3 e6 3a 75 0e 88 52 f4 d5 22 W.j.....:u..R.." 0170 46 61 8d 01 3f 3f 2a fa 50 f0 c2 74 ee 04 8d e2 Fa..??*.P..t.... 0180 24 e6 12 52 fd 72 89 f7 a1 fa 8a b7 16 b1 69 a7 $..R.r........i. 0190 90 4b 4e 10 48 4a dc 8a 72 fa 93 1e 79 6c 65 87 .KN.HJ..r...yle. 01a0 0e 1d 89 13 0b e8 61 9b 31 a2 12 0f c4 78 51 8b ......a.1....xQ. 01b0 11 fa 0e d8 01 07 bb 46 6a 5b 0e 34 ba 13 8e 2c .......Fj[.4..., 01c0 89 51 62 4c 91 8e b1 26 17 44 81 10 0e 24 eb 85 .QbL...&.D...$.. 01d0 b3 24 dc 43 29 a2 49 4c 06 e9 75 9b 7d 3a 8c e7 .$.C).IL..u.}:.. 01e0 9f 0c 8a 38 e8 4d af e1 2b 18 c3 5a fd 83 ef fb ...8.M..+..Z.... 01f0 4f e1 O. Data: 2DC661597FF2ABD02F498C334FCE8C4837E1BF236BFF7354... Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 4AD282266B863D84253CC3426DC625436A05E6ADC076C8A5... No. Time Source Destination Protocol Info 248 44.689350 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 248 (1458 bytes on wire, 1458 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.802137000 [Time delta from previous captured frame: 0.002439000 seconds] [Time delta from previous displayed frame: 0.028522000 seconds] [Time since reference or first frame: 44.689350000 seconds] Frame Number: 248 Frame Length: 1458 bytes Capture Length: 1458 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor:data:data:data:data:data:data:data:ssl] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xdfa639c8 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1440 Identification: 0xc37b (50043) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4021 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 42329, Ack: 17579, Len: 1388 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 42329 (relative sequence number) [Next sequence number: 43717 (relative sequence number)] Acknowledgement number: 17579 (relative ack number) Header length: 32 bytes Flags: 0x10 (ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 0... = Push: Not set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 42752 (scaled) Checksum: 0x5716 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179706, TSecr 3801858 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 247] [The RTT to ACK the segment was: 0.002439000 seconds] [Number of bytes in flight: 1388] TCP segment data (1310 bytes) TCP segment data (41 bytes) [Reassembled TCP Segments (4101 bytes): #242(15), #244(1388), #246(1388), #248(1310)] [Frame: 242, payload: 0-14 (15 bytes)] [Frame: 244, payload: 15-1402 (1388 bytes)] [Frame: 246, payload: 1403-2790 (1388 bytes)] [Frame: 248, payload: 2791-4100 (1310 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 4096 Encrypted Application Data: 93B88555B7783A2F2E6FD4D2CFC3ED4E5BC6F708549C3411... SSL segment data (4064 bytes) SSL segment data (416 bytes) [Reassembled SSL Segments (512 bytes): #242(448), #248(64)] [Frame: 242, payload: 0-447 (448 bytes)] [Frame: 248, payload: 448-511 (64 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 5861E5A6 Relay Data Length: 498 Data (498 bytes) 0000 50 33 bc 94 ee 4c c8 f8 10 a7 d9 c1 0f a3 7d fa P3...L........}. 0010 1f bc 02 4d 54 a5 e9 89 5a 95 c1 da 16 49 55 f2 ...MT...Z....IU. 0020 27 c5 2b 55 32 5c b2 cb 33 a5 d9 ed cb ac b5 6a '.+U2\..3......j 0030 92 54 e5 03 93 80 d7 65 d1 ce a1 98 25 07 f6 2c .T.....e....%.., 0040 a5 64 16 f7 8b 57 df e9 ee f8 5d 99 f1 2e 6f 23 .d...W....]...o# 0050 a4 39 ed e4 57 17 dd 1d b2 97 57 df 96 22 b6 77 .9..W.....W..".w 0060 9c 50 92 5d 68 9c 9c 48 12 1d b5 cd 51 59 45 50 .P.]h..H....QYEP 0070 9a 13 0e f5 d4 2e 96 b5 88 74 72 a5 e4 84 1d 08 .........tr..... 0080 81 61 88 4a 2e 94 5c 82 2d 20 4b 3c 53 59 bf e2 .a.J..\.- K..}r..p 0050 10 66 87 5c 55 9f 73 27 4b 77 68 5c 30 81 e4 f0 .f.\U.s'Kwh\0... 0060 c4 ec 1e 4c f9 f5 41 14 80 65 43 5a 27 4a b3 d9 ...L..A..eCZ'J.. 0070 de 7c d8 7b b8 f9 30 08 47 3e 02 1d 1e 3e 0c 93 .|.{..0.G>...>.. 0080 87 5b d2 37 9d 23 17 71 aa d1 54 ee 6f f6 36 51 .[.7.#.q..T.o.6Q 0090 7d 6b b7 b7 c7 59 ba 5c 2d 2b 1f 83 a3 14 61 75 }k...Y.\-+....au 00a0 94 ab ed 83 21 f0 23 4a 51 d6 aa 9e 59 75 34 57 ....!.#JQ...Yu4W 00b0 d9 b6 90 1b 47 de 33 b2 b4 06 2d 7c cb 66 2d d3 ....G.3...-|.f-. 00c0 c9 54 d6 70 27 05 0b 16 6b 8a 5b b0 2f 3c 93 70 .T.p'...k.[./<.p 00d0 05 e1 f3 d0 f9 00 4d da ba 76 8d 13 d6 57 06 28 ......M..v...W.( 00e0 de 12 7e 52 d6 68 a6 6e 13 70 8a a0 94 67 76 15 ..~R.h.n.p...gv. 00f0 d5 08 ae 83 9f 7e d8 de 7a 2a f3 06 d0 95 25 6b .....~..z*....%k 0100 48 7d b7 56 15 96 0d d7 5a cb 8e 53 2f 29 a5 c9 H}.V....Z..S/).. 0110 d1 19 01 fe 5d e5 71 b9 b9 87 57 2a f4 6e c1 8e ....].q...W*.n.. 0120 35 61 36 58 b0 51 c9 31 2f 28 66 db 54 64 06 d4 5a6X.Q.1/(f.Td.. 0130 56 f4 96 14 c8 73 5a 26 95 b9 27 38 f5 64 3b 9a V....sZ&..'8.d;. 0140 f3 2f f5 69 53 f0 34 be fe 06 80 c8 e4 42 9a e0 ./.iS.4......B.. 0150 98 35 a8 8c 9c c3 08 eb ef ee dd 3f 25 b1 a2 55 .5.........?%..U 0160 a9 e6 77 72 fb a7 3a b4 20 26 d1 13 fa af bc bb ..wr..:. &...... 0170 5f ff 9c 59 ea 84 1d fa ed 09 69 7a e6 e4 52 ba _..Y......iz..R. 0180 14 f1 2f f6 c9 e9 4d ee 40 77 67 21 05 47 10 22 ../...M.@wg!.G." 0190 29 a3 da 87 46 58 a2 9c 15 a6 28 57 bf c9 96 47 )...FX....(W...G 01a0 d5 11 b0 a6 37 d0 dd 36 cf 71 1c f7 55 22 c0 bc ....7..6.q..U".. 01b0 4f 14 ae 8f 8c 11 f2 a4 e9 83 60 21 6e 81 bc 7a O.........`!n..z 01c0 eb cb 8a ef 74 02 41 44 69 10 65 34 df 51 1e 42 ....t.ADi.e4.Q.B 01d0 fd 9d 77 bb 7a f7 9b 7e 95 c7 78 05 dc 7d 0e 8f ..w.z..~..x..}.. 01e0 ec cb f0 c8 be 0c 8f 34 91 e3 6a cf ea 56 96 8f .......4..j..V.. 01f0 02 27 .' Data: E00C9EB46DE980AE8298E0650E2FE503B1F3E4C93634703B... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 861B75DF Relay Data Length: 498 Data (498 bytes) 0000 4b 35 c8 12 ae 8b 9c 3c 71 c5 d8 eb 5f fd ce 51 K5.....S/.~I..!4. 0180 ac 34 42 d3 82 f4 a9 40 e4 95 ab a9 19 3d ca 11 .4B....@.....=.. 0190 ff 96 aa ab 60 48 e8 e1 10 72 48 97 91 95 16 97 ....`H...rH..... 01a0 c2 30 10 54 86 13 06 eb ca 7e f2 e8 03 ac f6 53 .0.T.....~.....S 01b0 81 9c 54 14 9f a8 13 2a 52 74 e4 04 ac 33 25 61 ..T....*Rt...3%a 01c0 5f 60 39 d3 f2 a4 21 25 19 7a 23 1e bd 8b b0 3c _`9...!%.z#....< 01d0 8a f9 a4 7d 42 47 71 69 5d ef 31 8b a4 43 96 33 ...}BGqi].1..C.3 01e0 e8 6b a5 86 a3 39 67 9d f8 81 98 65 f1 a3 55 77 .k...9g....e..Uw 01f0 21 94 !. Data: 4B35C812AE8B9C3C71C5D8EB5FFDCE51125B48DC9E650C29... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: D3CCA050 Relay Data Length: 452 Data (452 bytes) 0000 12 ab 0e ba 83 61 97 04 43 52 21 ac 3f b5 97 89 .....a..CR!.?... 0010 19 95 39 a5 fe 37 d3 f4 0b 72 de cb fd 48 64 44 ..9..7...r...HdD 0020 11 82 df ca c3 ff 8d 48 21 a5 5f 36 68 b1 3a 5d .......H!._6h.:] 0030 98 9b 21 2c ca 4f cf 71 ef d0 ee 3a 22 61 e1 f3 ..!,.O.q...:"a.. 0040 08 13 2a 65 f8 72 72 9b 3b f2 c8 9a ba 8a 2f 0c ..*e.rr.;...../. 0050 da 14 b6 80 cb 27 90 a5 92 89 25 f2 ee 04 47 6b .....'....%...Gk 0060 53 ca 6b ac 72 16 af 69 f2 f9 ce 49 63 5c a3 a1 S.k.r..i...Ic\.. 0070 6b 4c 43 b9 ae a2 a1 0e ca 21 85 35 86 cc 49 ad kLC......!.5..I. 0080 9d 1b d8 6a d4 8c cd 0c f7 99 33 63 85 28 6f 7e ...j......3c.(o~ 0090 8d f1 26 15 36 e5 9b 2b a7 e7 3d c3 a8 71 03 9a ..&.6..+..=..q.. 00a0 ce 2d 69 9d 19 49 bd 29 63 88 11 f3 42 99 53 6c .-i..I.)c...B.Sl 00b0 22 69 ca 7f a4 53 51 6a 97 46 ce 0d ad 36 58 d2 "i...SQj.F...6X. 00c0 56 11 8f 81 c9 b6 dd dc eb 4b 19 18 19 f4 8d 66 V........K.....f 00d0 4e 31 31 ba c0 9c 1a ff fd b7 ff 54 31 e9 d2 bb N11........T1... 00e0 df a8 23 90 e4 5a 35 a2 eb 2e 9d 02 f2 49 05 d8 ..#..Z5......I.. 00f0 14 93 bb 7c 1e 64 a5 be aa a5 a9 de 4b 28 4b 1d ...|.d......K(K. 0100 3b 13 b6 a7 49 23 4d 0e 54 43 f9 15 c5 21 73 db ;...I#M.TC...!s. 0110 b8 e2 c1 79 5e 06 10 f2 3d 20 0e 8c ad 4a d5 55 ...y^...= ...J.U 0120 31 17 d3 71 15 c7 c1 09 01 ab 30 a0 f0 5b 93 e7 1..q......0..[.. 0130 fa cb 75 79 0f 5d c3 58 59 aa 71 7b ca 21 e9 ad ..uy.].XY.q{.!.. 0140 cc c3 6d ce f9 2a 17 71 18 fb c8 2d 42 4a 36 a4 ..m..*.q...-BJ6. 0150 1a 77 f3 77 9f ab fc dd 5c 8e 7d ec ec 11 4e 4b .w.w....\.}...NK 0160 ce c5 cc 69 68 8d bd cb 77 70 a8 95 ba 14 02 97 ...ih...wp...... 0170 a3 10 0d d1 d3 20 1b 96 89 f8 64 2b 54 19 b3 66 ..... ....d+T..f 0180 72 93 1f 62 77 d1 65 89 a6 82 4c 29 ae f2 bb eb r..bw.e...L).... 0190 01 d9 fb 70 ac d0 ce cd 59 7c 12 5f 46 e5 d9 1c ...p....Y|._F... 01a0 b5 90 4f 30 9e 21 cb 91 ba 38 0d 78 2e 3b e3 d6 ..O0.!...8.x.;.. 01b0 d6 90 b1 1e fa a0 35 d5 13 48 ac 1e 9b 1a 2e 1f ......5..H...... 01c0 e2 2e e8 af .... Data: 12AB0EBA83619704435221AC3FB59789199539A5FE37D3F4... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: AE9BF05A Relay Data Length: 498 Data (498 bytes) 0000 d2 67 f2 1d ae a7 e1 76 5f e1 1b 85 f7 af 28 c7 .g.....v_.....(. 0010 0a 56 98 99 24 96 3e 98 57 40 50 3f c2 ad f8 82 .V..$.>.W@P?.... 0020 0b 64 44 24 cf 3d 8e af e7 db 09 7f 4a 06 f9 94 .dD$.=......J... 0030 2e 93 58 09 17 52 0c e1 a6 4e 32 46 29 8e af 0e ..X..R...N2F)... 0040 1d e4 b0 f2 4b 05 9e 9e 7c ed 1a 5c 9d 30 99 10 ....K...|..\.0.. 0050 98 82 be b9 7d be 63 48 91 ef c3 2e ad d3 0d a7 ....}.cH........ 0060 fd cd a4 18 9a 23 c4 98 33 6f 6b 68 f1 1b fb ae .....#..3okh.... 0070 81 a1 bd 81 18 33 67 48 a6 86 46 43 a7 d4 30 1f .....3gH..FC..0. 0080 53 1d b3 30 4c 00 38 97 3c 33 95 0e f9 e1 7a f6 S..0L.8.<3....z. 0090 c5 b2 cd 4e 9b 88 38 98 e5 2a 6f 98 4f 67 08 05 ...N..8..*o.Og.. 00a0 5d f4 55 55 8d 13 b2 03 8e b5 93 f6 64 0a ff 83 ].UU........d... 00b0 9f c1 42 b1 94 41 6a d2 38 23 5e 91 e0 c4 6a 20 ..B..Aj.8#^...j 00c0 dd 12 51 69 d5 24 9f 6d 3e a7 06 90 6e 08 65 6a ..Qi.$.m>...n.ej 00d0 0d 77 61 d0 2d e8 4e e9 fa cb e5 b4 c8 bd 24 d3 .wa.-.N.......$. 00e0 2a 60 29 b8 4d 85 5c c9 76 28 e0 93 1a d2 99 36 *`).M.\.v(.....6 00f0 f8 8e 87 2f 59 79 57 41 e4 91 97 6e ea da ab 0e .../YyWA...n.... 0100 2e 99 52 a8 7c 6e 39 c9 7d 70 16 a1 46 7f 66 a5 ..R.|n9.}p..F.f. 0110 79 38 be ab 48 45 2a a9 1e 5c a5 57 cb fa 25 ec y8..HE*..\.W..%. 0120 40 dc 2c 4d 5c dd 53 c0 dc 81 c9 c9 35 e4 6d 02 @.,M\.S.....5.m. 0130 7c 67 2d 47 27 80 55 75 f2 fb 9c cb 46 10 3e 09 |g-G'.Uu....F.>. 0140 39 83 8b 08 34 03 fe b2 fe c9 b2 50 1b f4 6b bc 9...4......P..k. 0150 6c 3e aa 7d 12 e4 71 12 81 d9 a4 e6 49 94 e0 b8 l>.}..q.....I... 0160 4e 12 37 1c 64 a5 06 6e 7f 1a 68 e1 50 49 91 8a N.7.d..n..h.PI.. 0170 1b 2f 70 2b 84 92 27 3f d2 bd 5d e9 f5 ad 24 4a ./p+..'?..]...$J 0180 87 3f 28 da 84 c0 ac 8d a5 d0 c7 a5 18 47 ae bc .?(..........G.. 0190 6f a9 d6 6b d4 a2 24 9c f6 20 54 18 47 91 2d 3a o..k..$.. T.G.-: 01a0 3f 99 bd 10 96 a8 a7 4c 1e 02 7e 8a 38 17 e9 51 ?......L..~.8..Q 01b0 c2 99 1e 8c b0 f2 b5 8c 90 5f e1 b7 40 bb 4a 56 ........._..@.JV 01c0 25 b0 9a 57 a6 80 83 bd b3 5b a8 7a 83 04 dc 78 %..W.....[.z...x 01d0 b1 2c 0d 25 0c 4a e3 28 ef 01 a9 99 27 d8 65 b3 .,.%.J.(....'.e. 01e0 48 f6 82 63 de 81 f9 b2 0c 33 c4 61 58 5a d8 97 H..c.....3.aXZ.. 01f0 42 ed B. Data: D267F21DAEA7E1765FE11B85F7AF28C70A56989924963E98... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: BDAC94B6 Relay Data Length: 498 Data (498 bytes) 0000 39 0b b3 e6 c5 8a b6 bc d3 6c c5 06 fa 24 2b 98 9........l...$+. 0010 78 74 7e 04 25 21 2d d0 97 59 b9 4b b8 9d ca ea xt~.%!-..Y.K.... 0020 5c de d4 9d ca 73 c6 e3 58 ba b2 ce 85 62 f5 c8 \....s..X....b.. 0030 4d 5a 54 9d 2d 4d 4e c7 97 3f 97 a1 f8 33 82 1b MZT.-MN..?...3.. 0040 54 3a 35 ae b0 6c a9 e4 ad 87 b7 12 da b9 2a f9 T:5..l........*. 0050 24 d1 55 92 66 2e f8 de 46 f6 54 52 22 af f4 48 $.U.f...F.TR"..H 0060 33 48 34 2d c3 85 1d 5b fb c2 95 7d 0d 87 5c 90 3H4-...[...}..\. 0070 4c 0b 3b 03 5f 5a b2 2a 2a 0b 48 cf 72 67 8a 94 L.;._Z.**.H.rg.. 0080 33 c1 91 bd 29 cc 88 e3 d4 4c 42 74 94 ef 41 d4 3...)....LBt..A. 0090 28 5e 82 96 cc 43 c4 63 42 6a 76 ea 1a b8 2c a6 (^...C.cBjv...,. 00a0 90 1f c4 ed 84 62 98 5f 43 86 8b 5a 36 17 73 97 .....b._C..Z6.s. 00b0 20 f4 a8 8e 9d ab 5b ab 00 24 0b 4a 49 29 97 32 .....[..$.JI).2 00c0 a0 fa de b5 3b 49 fe 6e fa 5a a2 d3 ed a1 ab 08 ....;I.n.Z...... 00d0 d1 2e 60 8b ea 2d e4 c6 ee 74 b2 98 64 7e c8 49 ..`..-...t..d~.I 00e0 05 cb 67 68 ad e1 12 de 6b 73 55 be a4 61 7d 63 ..gh....ksU..a}c 00f0 c5 8f 27 db 3f 1e 3f f7 e1 68 f8 02 66 93 ff fa ..'.?.?..h..f... 0100 bf 69 c3 69 5d eb a9 a4 91 52 3d 45 b8 68 a8 7c .i.i]....R=E.h.| 0110 91 ba b9 a8 86 65 96 3e f2 2d 22 44 1c 9e 45 7c .....e.>.-"D..E| 0120 21 0e 3a 7c 03 d6 00 49 da 90 cb fc c6 a1 25 2e !.:|...I......%. 0130 07 a3 3a 4c e2 a5 1d 52 a6 a0 2b 74 8a 4e de 21 ..:L...R..+t.N.! 0140 ad 1e ee d5 41 76 99 5b 74 93 c3 3e 4d d7 1e 54 ....Av.[t..>M..T 0150 cd 82 f2 fd d2 25 3a e7 62 7d 20 dc ea 9c d3 8c .....%:.b} ..... 0160 aa 56 d9 aa bc 10 74 51 b9 78 04 63 b8 b2 78 92 .V....tQ.x.c..x. 0170 5f 27 59 fc 8b 75 1c 2b 74 b7 54 d3 2d 44 cd 0a _'Y..u.+t.T.-D.. 0180 5d ab b7 35 d6 cf d2 3d 4a a3 f6 94 c2 e8 c2 60 ]..5...=J......` 0190 b0 a0 5b dd 6b 63 a6 3b d4 cd 5d 59 cc 65 28 4f ..[.kc.;..]Y.e(O 01a0 c3 7b 5d f4 62 fa ea 9b 36 fb 4f 9e 5c 6f f7 a4 .{].b...6.O.\o.. 01b0 17 08 df af 73 26 e1 21 5f 00 73 f7 ae be da c6 ....s&.!_.s..... 01c0 b9 0e ca d8 76 46 70 ac 51 f7 bf 37 8f 40 3b 0f ....vFp.Q..7.@;. 01d0 56 b8 25 77 1c 5d 75 11 8d e1 ac da 52 fb 29 c1 V.%w.]u.....R.). 01e0 72 bc 50 18 42 eb 61 f8 d2 30 60 ad d2 9d 34 52 r.P.B.a..0`...4R 01f0 09 c3 .. Data: 390BB3E6C58AB6BCD36CC506FA242B9878747E0425212DD0... CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 2D70BC2A Relay Data Length: 498 Data (498 bytes) 0000 1c cb a8 4d fc a9 54 6e 5b 1d 05 85 66 22 5d 69 ...M..Tn[...f"]i 0010 cb 93 79 3e a5 c0 05 17 45 4e d4 80 02 f8 7c 60 ..y>....EN....|` 0020 0a c0 51 6d 6d c2 e0 39 34 ee 02 4f 10 af 53 88 ..Qmm..94..O..S. 0030 5e ef 60 9b 52 2b 68 5e da 10 76 33 13 50 68 e3 ^.`.R+h^..v3.Ph. 0040 18 23 91 88 b3 80 5c f9 11 a4 62 20 27 f8 45 ba .#....\...b '.E. 0050 48 82 f2 63 d1 e5 86 da c3 19 98 2e 77 f7 1a 0b H..c........w... 0060 3b 50 76 ae a9 8b b4 56 da bb 2d 17 4c 89 ee b5 ;Pv....V..-.L... 0070 67 f5 ab 77 9f fa 2f 91 fe ae ff 5c 5d 3d 26 93 g..w../....\]=&. 0080 5f be c5 0d 66 48 b9 d5 e0 f2 c2 59 f2 15 ea e3 _...fH.....Y.... 0090 63 41 1f 8b d2 c7 42 7f ec ad 2e a7 4d d7 11 8f cA....B.....M... 00a0 c8 3b 5c fa ac fd be 51 c1 ad 7a c1 97 50 95 1d .;\....Q..z..P.. 00b0 4e 95 0f 90 2d 84 a8 a3 2b ca 6d 0f 17 1d 92 4b N...-...+.m....K 00c0 03 a4 c2 8c 90 d7 6c 1d d0 64 10 4d 2d 2f fc 13 ......l..d.M-/.. 00d0 52 91 3d 95 f7 08 51 52 32 f2 d7 25 b5 2d 52 21 R.=...QR2..%.-R! 00e0 86 b8 9a e5 d2 59 17 79 9f 99 e3 4c b7 84 fb 77 .....Y.y...L...w 00f0 1d 5f 2d 5a 6e 20 7f e3 10 98 c2 29 23 c5 a7 ce ._-Zn .....)#... 0100 79 c7 ed ef 9e 13 b4 bb d9 fb 71 eb c9 f0 c7 ad y.........q..... 0110 fd 1f f0 b3 83 9f 9d ad 7d fc d9 c6 1f b3 bc 28 ........}......( 0120 79 34 5c 7f b4 0d e2 6b 7e 12 1c 35 7f a5 d5 d2 y4\....k~..5.... 0130 4c 18 50 7a 35 e9 2d 45 08 86 4c 29 8c 4e 60 ee L.Pz5.-E..L).N`. 0140 0a ff 1a ea 4c 59 2e 99 41 6a fb 3e 2b fe 2e 4d ....LY..Aj.>+..M 0150 da 90 6e 47 11 70 98 32 8c 47 bf 71 1f 66 2c b6 ..nG.p.2.G.q.f,. 0160 1c 19 27 9d 72 0f 17 b7 c9 ef 1a 47 d6 ec 24 42 ..'.r......G..$B 0170 ee 97 c8 ee 0a 90 9b 3b b3 e5 95 ce c0 64 93 9f .......;.....d.. 0180 22 e3 b8 c4 a7 06 0a 00 46 f2 ca 6f e2 2d 56 4e ".......F..o.-VN 0190 33 d8 46 fa 0a b2 3f 32 c6 59 9b bb f9 e6 40 55 3.F...?2.Y....@U 01a0 80 24 cf 15 88 cf a4 0f d4 73 f9 4c 35 d4 88 95 .$.......s.L5... 01b0 15 b7 d6 71 58 62 22 75 1f de 4a d5 86 e9 04 29 ...qXb"u..J....) 01c0 02 39 b9 2f 39 f6 2c 15 d2 5f 85 b8 30 0e 97 9e .9./9.,.._..0... 01d0 38 95 eb 49 78 55 25 4a 3a 68 5a 24 d3 9c 6c bd 8..IxU%J:hZ$..l. 01e0 cc 38 54 0c 20 ea 5c ba f1 9e 52 79 43 a3 bc 51 .8T. .\...RyC..Q 01f0 04 77 .w Data: 1CCBA84DFCA9546E5B1D058566225D69CB93793EA5C00517... Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: EC4AF721FE26C82037D8B812751D2DDD333B9A02FA2F4984... No. Time Source Destination Protocol Info 250 44.694045 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 250 (674 bytes on wire, 674 bytes captured) Arrival Time: Jan 4, 2009 15:08:30.806832000 [Time delta from previous captured frame: 0.004657000 seconds] [Time delta from previous displayed frame: 0.004695000 seconds] [Time since reference or first frame: 44.694045000 seconds] Frame Number: 250 Frame Length: 674 bytes Capture Length: 674 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor:data:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xe8d0f8c4 [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 656 Identification: 0xc37c (50044) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4330 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 43717, Ack: 17579, Len: 604 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 43717 (relative sequence number) [Next sequence number: 44321 (relative sequence number)] Acknowledgement number: 17579 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 42752 (scaled) Checksum: 0x0a6b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936179707, TSecr 3801859 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 249] [The RTT to ACK the segment was: 0.004657000 seconds] [Number of bytes in flight: 604] TCP segment data (604 bytes) [Reassembled TCP Segments (645 bytes): #248(41), #250(604)] [Frame: 248, payload: 0-40 (41 bytes)] [Frame: 250, payload: 41-644 (604 bytes)] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 640 Encrypted Application Data: 2860C1472CB431B24F82E2F92126E8345A50403DF078572E... SSL segment data (608 bytes) [Reassembled SSL Segments (512 bytes): #248(416), #250(96)] [Frame: 248, payload: 0-415 (416 bytes)] [Frame: 250, payload: 416-511 (96 bytes)] Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_DATA (0x02) Recognized: 0000 Stream ID: 19223 Digest: 6BEA72CA Relay Data Length: 65 Data (65 bytes) 0000 48 bc 4f 48 96 79 0d 27 cc 75 51 7a 84 e5 c0 b9 H.OH.y.'.uQz.... 0010 11 84 7d a7 e8 66 65 3e 14 f3 ec 0a ce 58 24 ac ..}..fe>.....X$. 0020 6d 76 b6 77 b7 91 ac 66 88 64 49 7c 8d 2a 5d c9 mv.w...f.dI|.*]. 0030 48 8a cf 62 02 1b d7 ff 07 27 b3 75 fd 52 89 00 H..b.....'.u.R.. 0040 00 . Data: 48BC4F4896790D27CC75517A84E5C0B911847DA7E866653E... Tor Protocol CircID: 45647 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_END (0x03) Recognized: 0000 Stream ID: 19223 Digest: 7E588943 Relay Data Length: 1 Relay End Reason: (Anonymized TCP connection was closed) (0x06) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 252 45.173990 192.168.1.34 89.253.105.39 Tor Tor Cell: (Create a circuit) Frame 252 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:31.286777000 [Time delta from previous captured frame: 0.479932000 seconds] [Time delta from previous displayed frame: 0.479945000 seconds] [Time since reference or first frame: 45.173990000 seconds] Frame Number: 252 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xfa93 (64147) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb8f7 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 3499, Ack: 4245, Len: 586 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 3499 (relative sequence number) [Next sequence number: 4085 (relative sequence number)] Acknowledgement number: 4245 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 16128 (scaled) Checksum: 0x875f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3801999, TSecr 4248443142 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: A3183CE249FE408BA9408DCCAD87FCCF7B98573ABB612EDC... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 8FF475912437D47836EAA8342483EB5435D44BBAA0F2545F... Tor Protocol CircID: 2071 Command: (Create a circuit) (0x01) Payload: Create Payload: 64CE6890AD01FE6372D8920933833EAAF38C14938049FDD0... No. Time Source Destination Protocol Info 256 48.420522 213.114.108.189 192.168.1.34 Tor Tor Cell: (Acknowledge create) Frame 256 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:34.533309000 [Time delta from previous captured frame: 2.963681000 seconds] [Time delta from previous displayed frame: 3.246532000 seconds] [Time since reference or first frame: 48.420522000 seconds] Frame Number: 256 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xe0f8a504 [correct] Internet Protocol, Src: 213.114.108.189 (213.114.108.189), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xfcb7 (64695) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 49 Protocol: TCP (0x06) Header checksum: 0x46c8 [correct] [Good: True] [Bad : False] Source: 213.114.108.189 (213.114.108.189) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 51430 (51430), Seq: 1487, Ack: 2511, Len: 586 Source port: 9001 (9001) Destination port: 51430 (51430) [Stream index: 5] Sequence number: 1487 (relative sequence number) [Next sequence number: 2073 (relative sequence number)] Acknowledgement number: 2511 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 12328 (scaled) Checksum: 0xf1d0 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 927687328, TSecr 3801756 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 1722DAF88030392A08C173949C0470107F908F355D4429AD... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 4AE0B201508DF2F0D45DA015AED8CBCDA2D5F7E04C4B5B5B... Tor Protocol CircID: 16666 Command: (Acknowledge create) (0x02) Payload: Diffie Hellman data: E2D50FA7924D075185094CE317CB77E6F4087AE45359A65B... Derivative key data: 7E0612D80639A67095DA79167B569B3EF7B833BF Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 257 48.424783 192.168.1.34 213.114.108.189 Tor Tor Cell: (End-to-end data) Frame 257 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:34.537570000 [Time delta from previous captured frame: 0.004261000 seconds] [Time delta from previous displayed frame: 0.004261000 seconds] [Time since reference or first frame: 48.424783000 seconds] Frame Number: 257 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 213.114.108.189 (213.114.108.189) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5d63 (23907) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd71c [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 213.114.108.189 (213.114.108.189) Transmission Control Protocol, Src Port: 51430 (51430), Dst Port: 9001 (9001), Seq: 2511, Ack: 2073, Len: 586 Source port: 51430 (51430) Destination port: 9001 (9001) [Stream index: 5] Sequence number: 2511 (relative sequence number) [Next sequence number: 3097 (relative sequence number)] Acknowledgement number: 2073 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 11520 (scaled) Checksum: 0x066b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3802812, TSecr 927687328 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 256] [The RTT to ACK the segment was: 0.004261000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 694C959F6A90DD8C48B3B6760F16B5A635DBE263A7D18DDA... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: BD427937ADB8FF9AFBB0DD13403101AEB7AF5AAE98C49668... Tor Protocol CircID: 16666 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: DFA6BC7D Relay Data Length: 212 Relay Data: D4E016272329C039749D9257FDEADC490F132776ABBD0014... No. Time Source Destination Protocol Info 259 51.304242 89.253.105.39 192.168.1.34 Tor Tor Cell: (Stop using a circuit) Frame 259 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:37.417029000 [Time delta from previous captured frame: 2.789024000 seconds] [Time delta from previous displayed frame: 2.879459000 seconds] [Time since reference or first frame: 51.304242000 seconds] Frame Number: 259 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x6db41c75 [correct] Internet Protocol, Src: 89.253.105.39 (89.253.105.39), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x9a11 (39441) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: TCP (0x06) Header checksum: 0x247a [correct] [Good: True] [Bad : False] Source: 89.253.105.39 (89.253.105.39) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 34813 (34813), Seq: 4245, Ack: 4085, Len: 586 Source port: 9001 (9001) Destination port: 34813 (34813) [Stream index: 2] Sequence number: 4245 (relative sequence number) [Next sequence number: 4831 (relative sequence number)] Acknowledgement number: 4085 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 17792 (scaled) Checksum: 0xd817 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 4248444937, TSecr 3801999 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 314F3B6E8F110BBD54DC715022F3627482FE2281D2D2418A... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 4DCEB3E371759CC88DEE397B3B31468F51734E3BF1F5421B... Tor Protocol CircID: 2071 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (Out of memory, sockets, or circuit IDs.) (0x05) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 261 52.198010 192.168.1.34 89.253.105.39 Tor Tor Cell: (Create a circuit) Frame 261 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:38.310797000 [Time delta from previous captured frame: 0.893725000 seconds] [Time delta from previous displayed frame: 0.893768000 seconds] [Time since reference or first frame: 52.198010000 seconds] Frame Number: 261 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xfa95 (64149) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb8f5 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 4085, Ack: 4831, Len: 586 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 4085 (relative sequence number) [Next sequence number: 4671 (relative sequence number)] Acknowledgement number: 4831 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 18944 (scaled) Checksum: 0x875f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3803755, TSecr 4248444937 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 48A6A8B56EC340AC6A9D4E1C78E0F0BEB83E07B91161946A... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 5694F268450F509BC793A7C4626753E717910D2F476AF9DB... Tor Protocol CircID: 2072 Command: (Create a circuit) (0x01) Payload: Create Payload: 1A43AC4AFD41189D4932728204597474D87865C5DCAC96ED... No. Time Source Destination Protocol Info 263 57.471281 89.253.105.39 192.168.1.34 Tor Tor Cell: (Stop using a circuit) Frame 263 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:43.584068000 [Time delta from previous captured frame: 5.189169000 seconds] [Time delta from previous displayed frame: 5.273271000 seconds] [Time since reference or first frame: 57.471281000 seconds] Frame Number: 263 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x1b751cce [correct] Internet Protocol, Src: 89.253.105.39 (89.253.105.39), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x9a13 (39443) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: TCP (0x06) Header checksum: 0x2478 [correct] [Good: True] [Bad : False] Source: 89.253.105.39 (89.253.105.39) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 34813 (34813), Seq: 4831, Ack: 4671, Len: 586 Source port: 9001 (9001) Destination port: 34813 (34813) [Stream index: 2] Sequence number: 4831 (relative sequence number) [Next sequence number: 5417 (relative sequence number)] Acknowledgement number: 4671 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 18944 (scaled) Checksum: 0x1cf7 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 4248446478, TSecr 3803755 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 5F2E6DFB08D1E58864640016E56F08470CE436760165C9A4... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: E8C3721830A7DD941C760A03460B905CD2E351D3A9F1E545... Tor Protocol CircID: 2072 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (Out of memory, sockets, or circuit IDs.) (0x05) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 265 58.226148 192.168.1.34 89.253.105.39 Tor Tor Cell: (Create a circuit) Frame 265 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:44.338935000 [Time delta from previous captured frame: 0.754830000 seconds] [Time delta from previous displayed frame: 0.754867000 seconds] [Time since reference or first frame: 58.226148000 seconds] Frame Number: 265 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 89.253.105.39 (89.253.105.39) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xfa97 (64151) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xb8f3 [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 89.253.105.39 (89.253.105.39) Transmission Control Protocol, Src Port: 34813 (34813), Dst Port: 9001 (9001), Seq: 4671, Ack: 5417, Len: 586 Source port: 34813 (34813) Destination port: 9001 (9001) [Stream index: 2] Sequence number: 4671 (relative sequence number) [Next sequence number: 5257 (relative sequence number)] Acknowledgement number: 5417 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 20096 (scaled) Checksum: 0x875f [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3805262, TSecr 4248446478 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 16E1899B59DA0136E69AD3D724EED704FF256A8155F1D6C0... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: BF147250D941D12BA207248357238D9DB9041849054C056D... Tor Protocol CircID: 2073 Command: (Create a circuit) (0x01) Payload: Create Payload: 3A9A3F5A2F2719D1D17DE575B3A5B7F652C36BC743EE8C4D... No. Time Source Destination Protocol Info 267 59.218676 213.114.108.189 192.168.1.34 Tor Tor Cell: (Acknowledge create), Tor Cell: (End-to-end data) Frame 267 (1168 bytes on wire, 1168 bytes captured) Arrival Time: Jan 4, 2009 15:08:45.331463000 [Time delta from previous captured frame: 0.908353000 seconds] [Time delta from previous displayed frame: 0.992528000 seconds] [Time since reference or first frame: 59.218676000 seconds] Frame Number: 267 Frame Length: 1168 bytes Capture Length: 1168 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x1dc06ca7 [correct] Internet Protocol, Src: 213.114.108.189 (213.114.108.189), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1150 Identification: 0xfcb9 (64697) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 49 Protocol: TCP (0x06) Header checksum: 0x44c6 [correct] [Good: True] [Bad : False] Source: 213.114.108.189 (213.114.108.189) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 51430 (51430), Seq: 2073, Ack: 3097, Len: 1098 Source port: 9001 (9001) Destination port: 51430 (51430) [Stream index: 5] Sequence number: 2073 (relative sequence number) [Next sequence number: 3171 (relative sequence number)] Acknowledgement number: 3097 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 13500 (scaled) Checksum: 0x11ba [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 927690027, TSecr 3802812 [SEQ/ACK analysis] [Number of bytes in flight: 1098] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 0CF51DF99C04E8B04C06D98948272684E4C5296ECE010164... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 1056 Encrypted Application Data: 2F962D5B66E4C43010B3FC69EDF41BA7E555A856218C110D... Tor Protocol CircID: 16667 Command: (Acknowledge create) (0x02) Payload: Diffie Hellman data: 9171CE8A2108355ED7559AED0E980D3D3278373A2184DFE6... Derivative key data: 4CC351CD30371AA035AA9972A9F00C5D8C922DDE Padding: 000000000000000000000000000000000000000000000000... CircID: 16666 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTENDED (0x07) Recognized: 0000 Stream ID: 0 Digest: 01FF833C Relay Data Length: 148 Relay Data: 57277BE37E32DB37CFC18C899C244F619585CA52B3F15B08... No. Time Source Destination Protocol Info 268 59.226934 192.168.1.34 213.114.108.189 Tor Tor Cell: (End-to-end data) Frame 268 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:45.339721000 [Time delta from previous captured frame: 0.008258000 seconds] [Time delta from previous displayed frame: 0.008258000 seconds] [Time since reference or first frame: 59.226934000 seconds] Frame Number: 268 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 213.114.108.189 (213.114.108.189) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5d64 (23908) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd71b [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 213.114.108.189 (213.114.108.189) Transmission Control Protocol, Src Port: 51430 (51430), Dst Port: 9001 (9001), Seq: 3097, Ack: 3171, Len: 586 Source port: 51430 (51430) Destination port: 9001 (9001) [Stream index: 5] Sequence number: 3097 (relative sequence number) [Next sequence number: 3683 (relative sequence number)] Acknowledgement number: 3171 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14336 (scaled) Checksum: 0x066b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3805512, TSecr 927690027 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 267] [The RTT to ACK the segment was: 0.008258000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 1B1D06CE334E6A9289CB0398CD0C4369B15D8FAE8E66EE41... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: E6FBE9F55E5FB0C61179780FE70C92E5292F0D7001F0F0E4... Tor Protocol CircID: 16667 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 8FB98E38 Relay Data Length: 212 Relay Data: 18CD1B3501BBA30D706D2FF4C1CA94A1734A9A348A951A6F... No. Time Source Destination Protocol Info 270 59.316511 192.168.1.34 213.114.108.189 Tor Tor Cell: (End-to-end data) Frame 270 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:45.429298000 [Time delta from previous captured frame: 0.000024000 seconds] [Time delta from previous displayed frame: 0.089577000 seconds] [Time since reference or first frame: 59.316511000 seconds] Frame Number: 270 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 213.114.108.189 (213.114.108.189) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5d65 (23909) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xd71a [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 213.114.108.189 (213.114.108.189) Transmission Control Protocol, Src Port: 51430 (51430), Dst Port: 9001 (9001), Seq: 3683, Ack: 3171, Len: 586 Source port: 51430 (51430) Destination port: 9001 (9001) [Stream index: 5] Sequence number: 3683 (relative sequence number) [Next sequence number: 4269 (relative sequence number)] Acknowledgement number: 3171 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 14336 (scaled) Checksum: 0x066b [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3805535, TSecr 927690052 [SEQ/ACK analysis] [This is an ACK to the segment in frame: 269] [The RTT to ACK the segment was: 0.000024000 seconds] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: C6F78A3FD66F6A9808791955D0ACED4D4EAD73AA3E1D9936... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: F72C0C2B76F55DACED2107229F16C8317B924EAAF180D511... Tor Protocol CircID: 16666 Command: (End-to-end data) (0x03) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: F005092C Relay Data Length: 212 Relay Data: D914708401BB37F15A37A54094A3E5CB78339D106BB74F97... No. Time Source Destination Protocol Info 272 64.379941 89.253.105.39 192.168.1.34 Tor Tor Cell: (Stop using a circuit) Frame 272 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:50.492728000 [Time delta from previous captured frame: 4.973746000 seconds] [Time delta from previous displayed frame: 5.063430000 seconds] [Time since reference or first frame: 64.379941000 seconds] Frame Number: 272 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0xc1e1c47c [correct] Internet Protocol, Src: 89.253.105.39 (89.253.105.39), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x9a15 (39445) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 53 Protocol: TCP (0x06) Header checksum: 0x2476 [correct] [Good: True] [Bad : False] Source: 89.253.105.39 (89.253.105.39) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: 9001 (9001), Dst Port: 34813 (34813), Seq: 5417, Ack: 5257, Len: 586 Source port: 9001 (9001) Destination port: 34813 (34813) [Stream index: 2] Sequence number: 5417 (relative sequence number) [Next sequence number: 6003 (relative sequence number)] Acknowledgement number: 5257 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 20096 (scaled) Checksum: 0x56c9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 4248448206, TSecr 3805262 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: CE40BAA11CC310E233ABC6659040A8B65CB1482A042FC0EB... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 4AFE7950952F46B3C43994B0D4717553C02FB8F9FCE1198B... Tor Protocol CircID: 2073 Command: (Stop using a circuit) (0x04) Payload: Destroy Reason: (Out of memory, sockets, or circuit IDs.) (0x05) Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 274 65.250032 192.168.1.34 91.208.34.1 Tor Tor Cell: (Create a circuit) Frame 274 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:51.362819000 [Time delta from previous captured frame: 0.870048000 seconds] [Time delta from previous displayed frame: 0.870091000 seconds] [Time since reference or first frame: 65.250032000 seconds] Frame Number: 274 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5510 (21776) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3ce [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 17579, Ack: 44321, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 17579 (relative sequence number) [Next sequence number: 18165 (relative sequence number)] Acknowledgement number: 44321 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3807018, TSecr 936179707 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 862EE34E8DDD87B5BC594553178CDF6A9C056B8EC07EBD96... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: D8240630C9BB03F55F4A11B20A38A3A6C85E467730AE826F... Tor Protocol CircID: 45648 Command: (Create a circuit) (0x01) Payload: Create Payload: B06F49CF4D4E88C35C22244131FC3D958195EDFCD8DADE4C... No. Time Source Destination Protocol Info 276 65.563080 91.208.34.1 192.168.1.34 Tor Tor Cell: (Acknowledge create) Frame 276 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:51.675867000 [Time delta from previous captured frame: 0.256289000 seconds] [Time delta from previous displayed frame: 0.313048000 seconds] [Time since reference or first frame: 65.563080000 seconds] Frame Number: 276 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x30d1d35a [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc37e (50046) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x4340 [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 44321, Ack: 18165, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 44321 (relative sequence number) [Next sequence number: 44907 (relative sequence number)] Acknowledgement number: 18165 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 44928 (scaled) Checksum: 0xa599 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 936184924, TSecr 3807018 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: D24BA26E5B9715CD01C37887D8C8E3277CB31BDE73C87948... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: DE8AB6828295391975454222E0FEE4A6E1CDFDAB3D162F54... Tor Protocol CircID: 45648 Command: (Acknowledge create) (0x02) Payload: Diffie Hellman data: BFC67E00296DA23FC644D0DD1DA6EA33FE2C2ADF85760A52... Derivative key data: 3DEC956946E212A034F5ED0E875F83F5F5AA287E Padding: 000000000000000000000000000000000000000000000000... No. Time Source Destination Protocol Info 278 65.567349 192.168.1.34 91.208.34.1 Tor Tor Cell: (End-to-end data (Relay Early).) Frame 278 (652 bytes on wire, 652 bytes captured) Arrival Time: Jan 4, 2009 15:08:51.680136000 [Time delta from previous captured frame: 0.004232000 seconds] [Time delta from previous displayed frame: 0.004269000 seconds] [Time since reference or first frame: 65.567349000 seconds] Frame Number: 278 Frame Length: 652 bytes Capture Length: 652 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa), Dst: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Destination: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.1.34 (192.168.1.34), Dst: 91.208.34.1 (91.208.34.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0x5512 (21778) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0xa3cc [correct] [Good: True] [Bad : False] Source: 192.168.1.34 (192.168.1.34) Destination: 91.208.34.1 (91.208.34.1) Transmission Control Protocol, Src Port: 49324 (49324), Dst Port: https (443), Seq: 18165, Ack: 44907, Len: 586 Source port: 49324 (49324) Destination port: https (443) [Stream index: 1] Sequence number: 18165 (relative sequence number) [Next sequence number: 18751 (relative sequence number)] Acknowledgement number: 44907 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR): Not set .0.. .... = ECN-Echo: Not set ..0. .... = Urgent: Not set ...1 .... = Acknowledgement: Set .... 1... = Push: Set .... .0.. = Reset: Not set .... ..0. = Syn: Not set .... ...0 = Fin: Not set Window size: 64128 (scaled) Checksum: 0x420c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Options: (12 bytes) NOP NOP Timestamps: TSval 3807098, TSecr 936184924 [SEQ/ACK analysis] [Number of bytes in flight: 586] Secure Socket Layer TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 32 Encrypted Application Data: 95827F3C362C4EA935EA5F81952FAF885038E376E1974E95... TLSv1 Record Layer: Application Data Protocol: tor Content Type: Application Data (23) Version: TLS 1.0 (0x0301) Length: 544 Encrypted Application Data: 717960B509D249AABA4D4ED5C85783986FC78679EE83D697... Tor Protocol CircID: 45648 Command: (End-to-end data (Relay Early).) (0x09) Payload: Relay Command: RELAY_EXTEND (0x06) Recognized: 0000 Stream ID: 0 Digest: 7E0DF21F Relay Data Length: 212 Relay Data: 58C626B023290FA43171B1B06B8DC348A431043D204976EE... No. Time Source Destination Protocol Info 280 66.618922 91.208.34.1 192.168.1.34 Tor Tor Cell: (End-to-end data) Frame 280 (656 bytes on wire, 656 bytes captured) Arrival Time: Jan 4, 2009 15:08:52.731709000 [Time delta from previous captured frame: 0.990270000 seconds] [Time delta from previous displayed frame: 1.051573000 seconds] [Time since reference or first frame: 66.618922000 seconds] Frame Number: 280 Frame Length: 656 bytes Capture Length: 656 bytes [Frame is marked: False] [Protocols in frame: eth:ip:tcp:ssl:tor] Ethernet II, Src: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04), Dst: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Destination: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) Address: 00:1e:c9:53:36:aa (00:1e:c9:53:36:aa) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) Address: 00:a0:c5:9b:09:04 (00:a0:c5:9b:09:04) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Frame check sequence: 0x3792966e [correct] Internet Protocol, Src: 91.208.34.1 (91.208.34.1), Dst: 192.168.1.34 (192.168.1.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x20 (DSCP 0x08: Class Selector 1; ECN: 0x00) 0010 00.. = Differentiated Services Codepoint: Class Selector 1 (0x08) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 638 Identification: 0xc380 (50048) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 50 Protocol: TCP (0x06) Header checksum: 0x433e [correct] [Good: True] [Bad : False] Source: 91.208.34.1 (91.208.34.1) Destination: 192.168.1.34 (192.168.1.34) Transmission Control Protocol, Src Port: https (443), Dst Port: 49324 (49324), Seq: 44907, Ack: 18751, Len: 586 Source port: https (443) Destination port: 49324 (49324) [Stream index: 1] Sequence number: 44907 (relative sequence number) [Next sequence number: 45493 (relative sequence number)] Acknowledgement number: 18751 (relative ack number) Header length: 32 bytes Flags: 0x18 (PSH, ACK) 0... .... = Congestion Window Reduced (CWR