Re: IAS as RADIUS

not sure exaclty what the deal is, but i noticed auto enroll ment erros in
the local winxp event vewier, i forced a gpupdate locally and it worked!!!
im so happy1!!!!!!!! thank all of you so much for your help!


"the" <shirtrippa@xxxxxxxxxxx> wrote in message
news:OcBg8If1GHA.1288@xxxxxxxxxxxxxxxxxxxxxxx
hey guys,

just cant seem to get this licked. It seems i got everything talk to each
other, i just cant seem to get it to authenticate. I went thruough this
***
http://technet2.microsoft.com/WindowsServer/en/library/8f5c89d5-fdaf-430c-
9ef4-318f8c15baf11033.mspx?mfr=true to make as certain as i'm able that my
authentication is set up, but it seems my ability is sub par. My current
lab configuration is a single win 2k3 enterprise server at 10.1.1.2, a
cisco 2950 12 port switch at 10.1.1.1 and a windows xp machine at 10.1.1.3
My authentication for the server is set up for Peap- mschap2 same as the
client, PEAP useing EAP-mschap2. I;ve tried md5 challenge and this method
to no availe, i always get rejected. i'm not familiar with certificate
based authentication, and am doing as much readin as i can on it, but for
giggles here is my system error log, the debug readout from the switch,
and a packet capture from the client machine. if anyone has any ideas
that 'd be great. i feel like im right there on the verge of getting this
to work. This lab is in an AD environment, and is set to up users from AD,
its also a CA and DC running IAS. the lab has no inet access. the user
is forrest_greene@xxxxxxxxxxx and is a member of wiredusers and
administrators, the user and computer both are allowed dial in access, and
the computer is also a member of WiredUsers. the only access policy i
have in IAS is to be in the wiredusers group, and have an ethernet
connection. the only connection request policy is to have an ehternet
connection. anything im unaware of would be greatly appreciated. thanks
again guys. the following is event veiwer, follwoed by corrosponding
cisco "debug radius" followed by corrosponding packet capture from the
winxp machine.

Event Type: Information

Event Source: IAS

Event Category: None

Event ID: 5050

Date: 9/11/2006

Time: 3:09:42 PM

User: N/A

Computer: MOTO-AD

Description:

A LDAP connection with domain controller MOTO-AD.motosat.int for domain
MOTOSAT is established.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

---------

Event Type: Information

Event Source: IAS

Event Category: None

Event ID: 20190

Date: 9/11/2006

Time: 3:09:42 PM

User: N/A

Computer: MOTO-AD

Description:

Because no certificate has been configured for clients dialing in with
EAP-TLS, a default certificate is being sent to user
motosat\forrest_greene. Please go to the user's Remote Access Policy and
configure the Extensible Authentication Protocol (EAP).



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-----------

Event Type: Information

Event Source: IAS

Event Category: None

Event ID: 20190

Date: 9/11/2006

Time: 3:09:42 PM

User: N/A

Computer: MOTO-AD

Description:

Because no certificate has been configured for clients dialing in with
EAP-TLS, a default certificate is being sent to user
motosat\forrest_greene. Please go to the user's Remote Access Policy and
configure the Extensible Authentication Protocol (EAP).



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

-------------

Event Type: Warning

Event Source: IAS

Event Category: None

Event ID: 2

Date: 9/11/2006

Time: 3:10:20 PM

User: N/A

Computer: MOTO-AD

Description:

User MOTOSAT\forrest_greene was denied access.

Fully-Qualified-User-Name = motosat.int/employees/Forrest Greene

NAS-IP-Address = 10.1.1.1

NAS-Identifier = <not present>

Called-Station-Identifier = 00-15-62-9D-CA-41

Calling-Station-Identifier = 00-03-6D-00-67-CA

Client-Friendly-Name = radius test

Client-IP-Address = 10.1.1.1

NAS-Port-Type = Ethernet

NAS-Port = 50001

Proxy-Policy-Name = test

Authentication-Provider = Windows

Authentication-Server = <undetermined>

Policy-Name = test2

Authentication-Type = PEAP

EAP-Type = <undetermined>

Reason-Code = 262

Reason = The supplied message is incomplete. The signature was not
verified.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 18 03 09 80 ...?

____________________________________________

cisco capture as follows:



otocol debugging is on
Switch#
06:38:55: RADIUS: ustruct sharecount=1
06:38:55: RADIUS: EAP-login: length of radius packet = 159 code = 1
06:38:55: RADIUS: Initial Transmit FastEthernet0/1 id 57 10.1.1.2:1812,
Access-Request, len 159
06:38:55: Attribute 4 6 0A010101
06:38:55: Attribute 5 6 0000C351
06:38:55: Attribute 61 6 0000000F
06:38:55: Attribute 1 24 4D4F544F
06:38:55: Attribute 30 19 30302D31
06:38:55: Attribute 31 19 30302D30
06:38:55: Attribute 6 6 00000002
06:38:55: Attribute 12 6 000005DC
06:38:55: Attribute 79 29 0200001B
06:38:55: Attribute 80 18 3BB4CCE0
06:38:55: RADIUS: Received from id 57 10.1.1.2:1812, Access-Challenge, len
77
06:38:55: Attribute 27 6 0000001E
06:38:55: Attribute 79 8 01010006
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 80 18 9277991A
06:38:55: RADIUS: EAP-login: length of eap packet = 6
06:38:55: RADIUS: EAP-login: got challenge from radius
06:38:55: RADIUS: ustruct sharecount=1
06:38:55: RADIUS: EAP-login: length of radius packet = 237 code = 1
06:38:55: RADIUS: Initial Transmit FastEthernet0/1 id 58 10.1.1.2:1812,
Access-Request, len 237
06:38:55: Attribute 4 6 0A010101
06:38:55: Attribute 5 6 0000C351
06:38:55: Attribute 61 6 0000000F
06:38:55: Attribute 1 24 4D4F544F
06:38:55: Attribute 30 19 30302D31
06:38:55: Attribute 31 19 30302D30
06:38:55: Attribute 6 6 00000002
06:38:55: Attribute 12 6 000005DC
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 79 82 02010050
06:38:55: Attribute 80 18 7F965216
06:38:55: RADIUS: Received from id 58 10.1.1.2:1812, Access-Challenge, len
1577
06:38:55: Attribute 27 6 0000001E
06:38:55: Attribute 79 255 010205D8
06:38:55: Attribute 79 255 2D41442E
06:38:55: Attribute 79 255 03020730
06:38:55: Attribute 79 255 7361742C
06:38:55: Attribute 79 255 433D696E
06:38:55: Attribute 79 233 82010100
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 80 18 101AADBB
06:38:55: RADIUS: EAP-login: length of eap packet = 1496
06:38:55: RADIUS: EAP-login: got challenge from radius
06:38:55: RADIUS: ustruct sharecount=1
06:38:55: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:38:55: RADIUS: Initial Transmit FastEthernet0/1 id 59 10.1.1.2:1812,
Access-Request, len 163
06:38:55: Attribute 4 6 0A010101
06:38:55: Attribute 5 6 0000C351
06:38:55: Attribute 61 6 0000000F
06:38:55: Attribute 1 24 4D4F544F
06:38:55: Attribute 30 19 30302D31
06:38:55: Attribute 31 19 30302D30
06:38:55: Attribute 6 6 00000002
06:38:55: Attribute 12 6 000005DC
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 79 8 02020006
06:38:55: Attribute 80 18 8FB98B08
06:38:55: RADIUS: Received from id 59 10.1.1.2:1812, Access-Challenge, len
1577
06:38:55: Attribute 27 6 0000001E
06:38:55: Attribute 79 255 010305D8
06:38:55: Attribute 79 255 55040613
06:38:55: Attribute 79 255 0355040A
06:38:55: Attribute 79 255 66696361
06:38:55: Attribute 79 255 03550406
06:38:55: Attribute 79 233 61737320
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 80 18 3F925939
06:38:55: RADIUS: EAP-login: length of eap packet = 1496
06:38:55: RADIUS: EAP-login: got challenge from radius
06:38:55: RADIUS: ustruct sharecount=1
06:38:55: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:38:55: RADIUS: Initial Transmit FastEthernet0/1 id 60 10.1.1.2:1812,
Access-Request, len 163
06:38:55: Attribute 4 6 0A010101
06:38:55: Attribute 5 6 0000C351
06:38:55: Attribute 61 6 0000000F
06:38:55: Attribute 1 24 4D4F544F
06:38:55: Attribute 30 19 30302D31
06:38:55: Attribute 31 19 30302D30
06:38:55: Attribute 6 6 00000002
06:38:55: Attribute 12 6 000005DC
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 79 8 02030006
06:38:55: Attribute 80 18 46F3A4E1
06:38:55: RADIUS: Received from id 60 10.1.1.2:1812, Access-Challenge, len
1577
06:38:55: Attribute 27 6 0000001E
06:38:55: Attribute 79 255 010405D8
06:38:55: Attribute 79 255 27302506
06:38:55: Attribute 79 255 62657254
06:38:55: Attribute 79 255 7574686F
06:38:55: Attribute 79 255 6C696320
06:38:55: Attribute 79 233 0B300906
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 80 18 C0DD9730
06:38:55: RADIUS: EAP-login: length of eap packet = 1496
06:38:55: RADIUS: EAP-login: got challenge from radius
06:38:55: RADIUS: ustruct sharecount=1
06:38:55: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:38:55: RADIUS: Initial Transmit FastEthernet0/1 id 61 10.1.1.2:1812,
Access-Request, len 163
06:38:55: Attribute 4 6 0A010101
06:38:55: Attribute 5 6 0000C351
06:38:55: Attribute 61 6 0000000F
06:38:55: Attribute 1 24 4D4F544F
06:38:55: Attribute 30 19 30302D31
06:38:55: Attribute 31 19 30302D30
06:38:55: Attribute 6 6 00000002
06:38:55: Attribute 12 6 000005DC
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 79 8 02040006
06:38:55: Attribute 80 18 AEB33779
06:38:55: RADIUS: Received from id 61 10.1.1.2:1812, Access-Challenge, len
286
06:38:55: Attribute 27 6 0000001E
06:38:55: Attribute 79 217 010500D7
06:38:55: Attribute 24 25 0C7B02AA
06:38:55: Attribute 80 18 65079E42
06:38:55: RADIUS: EAP-login: length of eap packet = 215
06:38:55: RADIUS: EAP-login: got challenge from radius
06:38:57: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 62 10.1.1.2:1812,
Access-Request, len 163
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7B02AA
06:39:33: Attribute 79 8 02050006
06:39:33: Attribute 80 18 11C024A3
06:39:33: RADIUS: Received from id 62 10.1.1.2:1812, Access-Reject, len 44
06:39:33: Attribute 79 6 04060004
06:39:33: Attribute 80 18 3098D63E
06:39:33: RADIUS: EAP-login: length of eap packet = 4
06:39:33: RADIUS: EAP-login: got reject from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 159 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 63 10.1.1.2:1812,
Access-Request, len 159
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 79 29 0206001B
06:39:33: Attribute 80 18 2CFED399
06:39:33: RADIUS: Received from id 63 10.1.1.2:1812, Access-Challenge, len
77
06:39:33: Attribute 27 6 0000001E
06:39:33: Attribute 79 8 01070006
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 80 18 3BC7969A
06:39:33: RADIUS: EAP-login: length of eap packet = 6
06:39:33: RADIUS: EAP-login: got challenge from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 237 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 64 10.1.1.2:1812,
Access-Request, len 237
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 79 82 02070050
06:39:33: Attribute 80 18 0517879B
06:39:33: RADIUS: Received from id 64 10.1.1.2:1812, Access-Challenge, len
1577
06:39:33: Attribute 27 6 0000001E
06:39:33: Attribute 79 255 010805D8
06:39:33: Attribute 79 255 2D41442E
06:39:33: Attribute 79 255 03020730
06:39:33: Attribute 79 255 7361742C
06:39:33: Attribute 79 255 433D696E
06:39:33: Attribute 79 233 82010100
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 80 18 6C62010D
06:39:33: RADIUS: EAP-login: length of eap packet = 1496
06:39:33: RADIUS: EAP-login: got challenge from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 65 10.1.1.2:1812,
Access-Request, len 163
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 79 8 02080006
06:39:33: Attribute 80 18 8E5F5B1D
06:39:33: RADIUS: Received from id 65 10.1.1.2:1812, Access-Challenge, len
1577
06:39:33: Attribute 27 6 0000001E
06:39:33: Attribute 79 255 010905D8
06:39:33: Attribute 79 255 55040613
06:39:33: Attribute 79 255 0355040A
06:39:33: Attribute 79 255 66696361
06:39:33: Attribute 79 255 03550406
06:39:33: Attribute 79 233 61737320
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 80 18 E55B00D2
06:39:33: RADIUS: EAP-login: length of eap packet = 1496
06:39:33: RADIUS: EAP-login: got challenge from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 66 10.1.1.2:1812,
Access-Request, len 163
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 79 8 02090006
06:39:33: Attribute 80 18 15D32075
06:39:33: RADIUS: Received from id 66 10.1.1.2:1812, Access-Challenge, len
1577
06:39:33: Attribute 27 6 0000001E
06:39:33: Attribute 79 255 010A05D8
06:39:33: Attribute 79 255 27302506
06:39:33: Attribute 79 255 62657254
06:39:33: Attribute 79 255 7574686F
06:39:33: Attribute 79 255 6C696320
06:39:33: Attribute 79 233 0B300906
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 80 18 01E4BCC9
06:39:33: RADIUS: EAP-login: length of eap packet = 1496
06:39:33: RADIUS: EAP-login: got challenge from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 67 10.1.1.2:1812,
Access-Request, len 163
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 79 8 020A0006
06:39:33: Attribute 80 18 DD9793A0
06:39:33: RADIUS: Received from id 67 10.1.1.2:1812, Access-Challenge, len
286
06:39:33: Attribute 27 6 0000001E
06:39:33: Attribute 79 217 010B00D7
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 80 18 60DBBA04
06:39:33: RADIUS: EAP-login: length of eap packet = 215
06:39:33: RADIUS: EAP-login: got challenge from radius
06:39:33: RADIUS: ustruct sharecount=1
06:39:33: RADIUS: EAP-login: length of radius packet = 163 code = 1
06:39:33: RADIUS: Initial Transmit FastEthernet0/1 id 68 10.1.1.2:1812,
Access-Request, len 163
06:39:33: Attribute 4 6 0A010101
06:39:33: Attribute 5 6 0000C351
06:39:33: Attribute 61 6 0000000F
06:39:33: Attribute 1 24 4D4F544F
06:39:33: Attribute 30 19 30302D31
06:39:33: Attribute 31 19 30302D30
06:39:33: Attribute 6 6 00000002
06:39:33: Attribute 12 6 000005DC
06:39:33: Attribute 24 25 0C7D02AB
06:39:33: Attribute 79 8 020B0006
06:39:33: Attribute 80 18 8B4C429D
06:39:33: RADIUS: Received from id 68 10.1.1.2:1812, Access-Reject, len 44
06:39:33: Attribute 79 6 040C0004
06:39:33: Attribute 80 18 FB33306B
06:39:33: RADIUS: EAP-login: length of eap packet = 4
06:39:33: RADIUS: EAP-login: got reject from radius
Switch#askl;djfhakl;sfhasd
% Unknown command or computer name, or unable to find computer address
Switch#
06:39:59: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down
06:40:01: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to up
06:40:03: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2,
changed state to up

_________________________________________-

ethreal packet captuer as follows:



No. Time Source Destination Protocol
Info
1 0.000000 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Failure

Frame 1 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
2 0.000836 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, Identity [RFC3748]

Frame 2 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
3 0.005753 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, Identity [RFC3748]

Frame 3 (45 bytes on wire, 45 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
4 0.008519 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, Identity [RFC3748]

Frame 4 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
5 0.008741 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, Identity [RFC3748]

Frame 5 (45 bytes on wire, 45 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
6 0.047893 Intel_fe:25:23 Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.2

Frame 6 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Intel_fe:25:23 (00:03:47:fe:25:23), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
7 0.056808 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, PEAP [Palekar]

Frame 7 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
8 0.066766 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
SSL Client Hello

Frame 8 (98 bytes on wire, 98 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
9 0.097897 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 9 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
10 0.100568 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 10 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
11 0.130651 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 11 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
12 0.130989 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 12 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
13 0.162726 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 13 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
14 0.163036 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 14 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
15 0.186343 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 15 (233 bytes on wire, 233 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
16 0.238289 10.1.1.3 10.1.1.2 TCP 3107 >
ldap [SYN] Seq=0 Len=0 MSS=1460

Frame 16 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3107 (3107), Dst Port: ldap
(389), Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
17 3.280398 10.1.1.3 10.1.1.2 TCP 3107 >
ldap [SYN] Seq=0 Len=0 MSS=1460

Frame 17 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3107 (3107), Dst Port: ldap
(389), Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
18 9.296643 10.1.1.3 10.1.1.2 TCP 3107 >
ldap [SYN] Seq=0 Len=0 MSS=1460

Frame 18 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3107 (3107), Dst Port: ldap
(389), Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
19 9.904564 10.1.1.2 10.1.1.255 BROWSER
Become Backup Browser

Frame 19 (223 bytes on wire, 223 bytes captured)
Ethernet II, Src: Intel_fe:25:23 (00:03:47:fe:25:23), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.2 (10.1.1.2), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port: netbios-dgm
(138)
NetBIOS Datagram Service
SMB (Server Message Block Protocol)
SMB MailSlot Protocol
Microsoft Windows Browser Protocol

No. Time Source Destination Protocol
Info
20 15.224844 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 20 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
21 15.240165 10.1.1.3 10.1.1.2 TCP 3108 >
ldap [SYN] Seq=0 Len=0 MSS=1460

Frame 21 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3108 (3108), Dst Port: ldap
(389), Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
22 16.219286 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 22 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
23 17.219401 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 23 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
24 17.240852 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 24 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3109 (3109), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
25 18.235199 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 25 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3109 (3109), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
26 19.219905 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 26 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
27 19.219993 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 27 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
28 19.235236 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 28 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3109 (3109), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
29 21.235422 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 29 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3109 (3109), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
30 22.748168 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 30 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
31 23.220587 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 31 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
32 23.220678 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 32 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
33 23.735688 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 33 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
34 24.735772 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 34 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
35 24.767902 10.1.1.3 10.1.1.255 NBNS Name
query NB ENGIN_LASER<00>

Frame 35 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
36 25.235952 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 36 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3109 (3109), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
37 25.517054 10.1.1.3 10.1.1.255 NBNS Name
query NB ENGIN_LASER<00>

Frame 37 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
38 26.267154 10.1.1.3 10.1.1.255 NBNS Name
query NB ENGIN_LASER<00>

Frame 38 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
39 26.735962 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 39 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
40 26.736049 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 40 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
41 30.188507 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Continuation Data, [Malformed Packet]

Frame 41 (233 bytes on wire, 233 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication
[Malformed Packet: SSL]

No. Time Source Destination Protocol
Info
42 30.736381 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 42 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
43 30.736469 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 43 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
44 37.741998 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 44 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
45 37.742263 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAPOL Start

Frame 45 (19 bytes on wire, 19 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
46 37.747510 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, Identity [RFC3748]

Frame 46 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
47 37.747954 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, Identity [RFC3748]

Frame 47 (45 bytes on wire, 45 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
48 37.759367 10.1.1.1 10.1.1.2 RADIUS
Access-Request(1) (id=80, l=163)

Frame 48 (205 bytes on wire, 205 bytes captured)
Ethernet II, Src: Cisco_9d:ca:40 (00:15:62:9d:ca:40), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.1 (10.1.1.1), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812)
Radius Protocol

No. Time Source Destination Protocol
Info
49 39.907183 10.1.1.2 10.1.1.255 BROWSER
Become Backup Browser

Frame 49 (223 bytes on wire, 223 bytes captured)
Ethernet II, Src: Intel_fe:25:23 (00:03:47:fe:25:23), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.2 (10.1.1.2), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port: netbios-dgm
(138)
NetBIOS Datagram Service
SMB (Server Message Block Protocol)
SMB MailSlot Protocol
Microsoft Windows Browser Protocol

No. Time Source Destination Protocol
Info
50 41.274392 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 50 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
51 41.274954 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 51 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
52 42.268816 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 52 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
53 43.268933 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 53 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
54 43.269042 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 54 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
55 45.269154 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 55 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
56 45.269280 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 56 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
57 47.244542 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 57 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3111 (3111), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
58 48.238191 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 58 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
59 49.238269 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 59 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3111 (3111), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
60 49.269518 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 60 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1026 (1026), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
61 49.269593 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 61 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
62 49.269683 10.1.1.3 10.1.1.2 DNS
Standard query A wpad.motosat.int

Frame 62 (76 bytes on wire, 76 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
63 51.238471 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 63 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3111 (3111), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
64 51.238561 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 64 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
65 55.238887 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 65 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3111 (3111), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
66 55.238977 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 66 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
67 56.272203 10.1.1.3 10.1.1.2 DNS
Standard query A www.download.windowsupdate.com

Frame 67 (90 bytes on wire, 90 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
68 56.275814 10.1.1.3 10.1.1.2 TCP 3112 >
http [SYN] Seq=0 Len=0 MSS=1460

Frame 68 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3112 (3112), Dst Port: http (80),
Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
69 58.270506 10.1.1.3 10.1.1.2 DNS
Standard query A www.download.windowsupdate.com

Frame 69 (90 bytes on wire, 90 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
70 59.286104 10.1.1.3 10.1.1.2 TCP 3112 >
http [SYN] Seq=0 Len=0 MSS=1460

Frame 70 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
Transmission Control Protocol, Src Port: 3112 (3112), Dst Port: http (80),
Seq: 0, Len: 0

No. Time Source Destination Protocol
Info
71 60.270657 10.1.1.3 10.1.1.2 DNS
Standard query A www.download.windowsupdate.com

Frame 71 (90 bytes on wire, 90 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
72 60.270747 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 72 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
73 64.271067 10.1.1.3 10.1.1.2 DNS
Standard query A www.download.windowsupdate.com

Frame 73 (90 bytes on wire, 90 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 1027 (1027), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
74 64.271149 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 74 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
75 64.490210 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 75 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
76 65.239869 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 76 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
77 65.989930 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 77 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
78 66.748982 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 78 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3113 (3113), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
79 67.740145 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 79 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
80 67.755839 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAPOL Start

Frame 80 (19 bytes on wire, 19 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
81 67.758595 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, Identity [RFC3748]

Frame 81 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
82 67.758805 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, Identity [RFC3748]

Frame 82 (45 bytes on wire, 45 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
83 67.785922 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Request, PEAP [Palekar]

Frame 83 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
84 67.787219 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
SSL Client Hello

Frame 84 (98 bytes on wire, 98 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
85 67.818378 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 85 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
86 67.818702 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 86 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
87 67.849206 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 87 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
88 67.849569 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 88 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
89 67.879990 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 89 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
90 67.880296 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 90 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
91 67.910223 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
TLSv1 Server Hello, Certificate, Certificate Request, Server Hello Done

Frame 91 (233 bytes on wire, 233 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
92 67.934892 Runtop_00:67:ca Spanning-tree-(for-bridges)_03
EAP Response, PEAP [Palekar]

Frame 92 (24 bytes on wire, 24 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
93 67.957760 Cisco_9d:ca:41 Spanning-tree-(for-bridges)_03
EAP Failure

Frame 93 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Cisco_9d:ca:41 (00:15:62:9d:ca:41), Dst:
Spanning-tree-(for-bridges)_03 (01:80:c2:00:00:03)
802.1X Authentication

No. Time Source Destination Protocol
Info
94 68.740256 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 94 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3113 (3113), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
95 69.908686 10.1.1.2 10.1.1.255 BROWSER
Become Backup Browser

Frame 95 (223 bytes on wire, 223 bytes captured)
Ethernet II, Src: Intel_fe:25:23 (00:03:47:fe:25:23), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.2 (10.1.1.2), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port: netbios-dgm
(138)
NetBIOS Datagram Service
SMB (Server Message Block Protocol)
SMB MailSlot Protocol
Microsoft Windows Browser Protocol

No. Time Source Destination Protocol
Info
96 70.740485 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 96 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3113 (3113), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
97 70.740578 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 97 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
98 74.740879 10.1.1.3 10.1.1.2 DNS
Standard query SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.motosat.int

Frame 98 (123 bytes on wire, 123 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Intel_fe:25:23
(00:03:47:fe:25:23)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.2 (10.1.1.2)
User Datagram Protocol, Src Port: 3113 (3113), Dst Port: domain (53)
Domain Name System (query)

No. Time Source Destination Protocol
Info
99 74.740969 Runtop_00:67:ca Broadcast ARP
Who has 10.1.1.1? Tell 10.1.1.3

Frame 99 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No. Time Source Destination Protocol
Info
100 83.992164 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 100 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
101 84.741855 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 101 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service

No. Time Source Destination Protocol
Info
102 85.491917 10.1.1.3 10.1.1.255 NBNS Name
query NB MOTOSAT<1c>

Frame 102 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: Runtop_00:67:ca (00:03:6d:00:67:ca), Dst: Broadcast
(ff:ff:ff:ff:ff:ff)
Internet Protocol, Src: 10.1.1.3 (10.1.1.3), Dst: 10.1.1.255 (10.1.1.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns
(137)
NetBIOS Name Service







.