1 0.000000 NetmonFilter NetmonFilter: Updated Capture Filter: None 2 0.000000 NetworkInfo NetworkInfo: Network info for TEST124, Network Adapter Count = 1 3 0.000000 {DNS:3, UDP:2, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7869, QUERY (Standard query), Query for test125.test.local of type Host Addr on class Internet 4 0.000000 {DNS:3, UDP:2, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x7869, QUERY (Standard query), Response - Success 5 0.015625 {ARP:4} 172.16.11.124 172.16.11.125 ARP ARP: Request, 172.16.11.124 asks for 172.16.11.125 6 0.015625 {ARP:4} 172.16.11.125 172.16.11.124 ARP ARP: Response, 172.16.11.125 at 00-11-D8-E3-EC-84 7 0.015625 {TCP:6, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1063, DstPort=DCE endpoint resolution(135), Len=0, Seq=539163285, Ack=0, Win=65535 (scale factor 0) = 65535 8 0.015625 {TCP:6, IPv4:5} test125.test.local test124.test.local TCP TCP: Flags=.S..A..., SrcPort=DCE endpoint resolution(135), DstPort=1063, Len=0, Seq=981335265, Ack=539163286, Win=65535 (scale factor 0) = 65535 9 0.015625 {TCP:6, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1063, DstPort=DCE endpoint resolution(135), Len=0, Seq=539163286, Ack=981335266, Win=65535 (scale factor 0) = 65535 10 0.015625 {MSRPC:7, TCP:6, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Bind: UUID{99FCFEC4-5260-101B-BBCB-00AA0021347A} DCOM-IObjectExporter Call=0x1 Assoc Grp=0x0 Xmit=0x16D0 Recv=0x16D0 11 0.015625 {MSRPC:7, TCP:6, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Bind Ack: Call=0x1 Assoc Grp=0x32EA Xmit=0x16D0 Recv=0x16D0 12 0.031250 {MSRPC:7, TCP:6, IPv4:5} test124.test.local test125.test.local DCOM DCOM 13 0.031250 {MSRPC:7, TCP:6, IPv4:5} test125.test.local test124.test.local DCOM DCOM 14 0.078125 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367843928, Ack=0, Win=65535 (scale factor 0) = 65535 15 0.078125 {TCP:8, IPv4:5} test125.test.local test124.test.local TCP TCP: Flags=.S..A..., SrcPort=DCE endpoint resolution(135), DstPort=1064, Len=0, Seq=3625279350, Ack=1367843929, Win=65535 (scale factor 0) = 65535 16 0.078125 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367843929, Ack=3625279351, Win=65535 (scale factor 0) = 65535 17 0.078125 {UDP:9, IPv4:1} test124.test.local dc181.test.local KerberosV5 KerberosV5: TGS Request Realm: TEST.LOCAL Sname: RPCSS/test125.test.local 18 0.078125 {UDP:9, IPv4:1} dc181.test.local test124.test.local KerberosV5 KerberosV5: TGS Response Cname: Administrator 19 0.078125 {MSRPC:10, TCP:8, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Bind: UUID{000001A0-0000-0000-C000-000000000046} DCOM-IRemoteSCMActivator Call=0x2 Assoc Grp=0x32EA Xmit=0x16D0 Recv=0x16D0 20 0.093750 {ARP:11} 172.16.11.125 172.16.11.181 ARP ARP: Request, 172.16.11.125 asks for 172.16.11.181 21 0.093750 {MSRPC:10, TCP:8, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Bind Ack: Call=0x2 Assoc Grp=0x32EA Xmit=0x16D0 Recv=0x16D0 22 0.093750 {MSRPC:10, TCP:8, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{000001A0-0000-0000-C000-000000000046} DCOM-IRemoteSCMActivator Call=0x2 23 0.093750 {MSRPC:10, TCP:8, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x2 Assoc Grp=0x32EA Xmit=0x16D0 Recv=0x16D0 24 0.093750 {MSRPC:10, TCP:8, IPv4:5} test124.test.local test125.test.local DCOM DCOM 25 0.093750 {MSRPC:10, TCP:8, IPv4:5} test125.test.local test124.test.local DCOM DCOM 26 0.093750 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1066, DstPort=1117, Len=0, Seq=1180773456, Ack=0, Win=65535 (scale factor 0) = 65535 27 0.093750 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: Flags=.S..A..., SrcPort=1117, DstPort=1066, Len=0, Seq=539972629, Ack=1180773457, Win=65535 (scale factor 0) = 65535 28 0.093750 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180773457, Ack=539972630, Win=65535 (scale factor 0) = 65535 29 0.093750 {UDP:13, IPv4:1} test124.test.local dc181.test.local KerberosV5 KerberosV5: TGS Request Realm: TEST.LOCAL Sname: TEST125$ 30 0.109375 {UDP:13, IPv4:1} dc181.test.local test124.test.local KerberosV5 KerberosV5: TGS Response Cname: Administrator 31 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Bind: UUID{00000143-0000-0000-C000-000000000046} DCOM-IRemUnknown2 Call=0x1 Assoc Grp=0x0 Xmit=0x16D0 Recv=0x16D0 32 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Bind Ack: Call=0x1 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 33 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{00000143-0000-0000-C000-000000000046} DCOM-IRemUnknown2 Call=0x1 34 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x1 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 35 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 36 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 37 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{D4781CD6-E5D3-44DF-AD94-930EFE48A887} WMI-IWbemLoginClientID Call=0x2 38 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x2 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 39 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 40 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 41 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{F309AD18-D86A-11D0-A075-00C04FB68820} WMI-IWbemLevel1Login Call=0x3 42 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x3 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 43 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 44 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 45 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 46 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 47 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{9556DC99-828C-11CF-A37E-00AA003240C7} WMI-IWbemServices Call=0x5 48 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x5 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 49 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 50 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 51 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 52 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 53 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{1C1C45EE-4395-11D2-B60B-00104B703EFD} WMI-IWbemFetchSmartEnum Call=0x7 54 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x7 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 55 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 56 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 57 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local MSRPC MSRPC: c/o Alter Cont: UUID{423EC01E-2E35-11D2-B604-00104B703EFD} WMI-IWbemWCOSmartEnum Call=0x8 58 0.109375 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Alter Cont Resp: Call=0x8 Assoc Grp=0x333E Xmit=0x16D0 Recv=0x16D0 59 0.109375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 60 0.187500 {TCP:6, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1063, DstPort=DCE endpoint resolution(135), Len=0, Seq=539163382, Ack=981335462, Win=65339 (scale factor 0) = 65339 61 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 62 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #61]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539975906 - 539977366, Ack=1180776977, Win=65061 (scale factor 0) = 65061 63 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180776977, Ack=539977366, Win=65535 (scale factor 0) = 65535 64 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #61]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539977366 - 539978826, Ack=1180776977, Win=65061 (scale factor 0) = 65061 65 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180776977, Ack=539978826, Win=65535 (scale factor 0) = 65535 66 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #61]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=539978826 - 539980275, Ack=1180776977, Win=65061 (scale factor 0) = 65061 67 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemWCOSmartEnum Call=0x8 Context=0x5 Hint=0x198C Cancels=0x0 68 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180776977, Ack=539981735, Win=65535 (scale factor 0) = 65535 69 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #67]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539981735 - 539983195, Ack=1180776977, Win=65061 (scale factor 0) = 65061 70 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #67]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539983195 - 539984655, Ack=1180776977, Win=65061 (scale factor 0) = 65061 71 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180776977, Ack=539984655, Win=65535 (scale factor 0) = 65535 72 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #67]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=539984655 - 539986104, Ack=1180776977, Win=65061 (scale factor 0) = 65061 73 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemWCOSmartEnum Call=0x8 Context=0x5 Hint=0x30C Cancels=0x0 74 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180776977, Ack=539986957, Win=65535 (scale factor 0) = 65535 75 0.187500 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 76 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local DCOM DCOM 77 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #76]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539988417 - 539989877, Ack=1180777222, Win=64816 (scale factor 0) = 64816 78 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=539989877, Win=65535 (scale factor 0) = 65535 79 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #76]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539989877 - 539991337, Ack=1180777222, Win=64816 (scale factor 0) = 64816 80 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #76]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=539991337 - 539992786, Ack=1180777222, Win=64816 (scale factor 0) = 64816 81 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=539992786, Win=65535 (scale factor 0) = 65535 82 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x11704 Cancels=0x0 83 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #82]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539994246 - 539995706, Ack=1180777222, Win=64816 (scale factor 0) = 64816 84 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=539995706, Win=65535 (scale factor 0) = 65535 85 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #82]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=539995706 - 539997166, Ack=1180777222, Win=64816 (scale factor 0) = 64816 86 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #82]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=539997166 - 539998615, Ack=1180777222, Win=64816 (scale factor 0) = 64816 87 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=539998615, Win=65535 (scale factor 0) = 65535 88 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x10084 Cancels=0x0 89 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #88]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540000075 - 540001535, Ack=1180777222, Win=64816 (scale factor 0) = 64816 90 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540001535, Win=65535 (scale factor 0) = 65535 91 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #88]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540001535 - 540002995, Ack=1180777222, Win=64816 (scale factor 0) = 64816 92 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #88]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540002995 - 540004444, Ack=1180777222, Win=64816 (scale factor 0) = 64816 93 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540004444, Win=65535 (scale factor 0) = 65535 94 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0xEA04 Cancels=0x0 95 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #94]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540005904 - 540007364, Ack=1180777222, Win=64816 (scale factor 0) = 64816 96 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540007364, Win=65535 (scale factor 0) = 65535 97 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #94]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540007364 - 540008824, Ack=1180777222, Win=64816 (scale factor 0) = 64816 98 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #94]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540008824 - 540010273, Ack=1180777222, Win=64816 (scale factor 0) = 64816 99 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540010273, Win=65535 (scale factor 0) = 65535 100 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0xD384 Cancels=0x0 101 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #100]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540011733 - 540013193, Ack=1180777222, Win=64816 (scale factor 0) = 64816 102 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540013193, Win=65535 (scale factor 0) = 65535 103 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #100]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540013193 - 540014653, Ack=1180777222, Win=64816 (scale factor 0) = 64816 104 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #100]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540014653 - 540016102, Ack=1180777222, Win=64816 (scale factor 0) = 64816 105 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540016102, Win=65535 (scale factor 0) = 65535 106 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0xBD04 Cancels=0x0 107 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #106]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540017562 - 540019022, Ack=1180777222, Win=64816 (scale factor 0) = 64816 108 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540019022, Win=65535 (scale factor 0) = 65535 109 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #106]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540019022 - 540020482, Ack=1180777222, Win=64816 (scale factor 0) = 64816 110 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #106]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540020482 - 540021931, Ack=1180777222, Win=64816 (scale factor 0) = 64816 111 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540021931, Win=65535 (scale factor 0) = 65535 112 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0xA684 Cancels=0x0 113 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #112]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540023391 - 540024851, Ack=1180777222, Win=64816 (scale factor 0) = 64816 114 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540024851, Win=65535 (scale factor 0) = 65535 115 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #112]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540024851 - 540026311, Ack=1180777222, Win=64816 (scale factor 0) = 64816 116 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #112]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540026311 - 540027760, Ack=1180777222, Win=64816 (scale factor 0) = 64816 117 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540027760, Win=65535 (scale factor 0) = 65535 118 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x9004 Cancels=0x0 119 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #118]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540029220 - 540030680, Ack=1180777222, Win=64816 (scale factor 0) = 64816 120 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540030680, Win=65535 (scale factor 0) = 65535 121 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #118]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540030680 - 540032140, Ack=1180777222, Win=64816 (scale factor 0) = 64816 122 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #118]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540032140 - 540033589, Ack=1180777222, Win=64816 (scale factor 0) = 64816 123 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540033589, Win=65535 (scale factor 0) = 65535 124 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x7984 Cancels=0x0 125 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #124]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540035049 - 540036509, Ack=1180777222, Win=64816 (scale factor 0) = 64816 126 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540036509, Win=65535 (scale factor 0) = 65535 127 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #124]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540036509 - 540037969, Ack=1180777222, Win=64816 (scale factor 0) = 64816 128 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #124]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540037969 - 540039418, Ack=1180777222, Win=64816 (scale factor 0) = 64816 129 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540039418, Win=65535 (scale factor 0) = 65535 130 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x6304 Cancels=0x0 131 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #130]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540040878 - 540042338, Ack=1180777222, Win=64816 (scale factor 0) = 64816 132 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540042338, Win=65535 (scale factor 0) = 65535 133 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #130]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540042338 - 540043798, Ack=1180777222, Win=64816 (scale factor 0) = 64816 134 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #130]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540043798 - 540045247, Ack=1180777222, Win=64816 (scale factor 0) = 64816 135 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540045247, Win=65535 (scale factor 0) = 65535 136 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x4C84 Cancels=0x0 137 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #136]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540046707 - 540048167, Ack=1180777222, Win=64816 (scale factor 0) = 64816 138 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540048167, Win=65535 (scale factor 0) = 65535 139 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #136]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540048167 - 540049627, Ack=1180777222, Win=64816 (scale factor 0) = 64816 140 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #136]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540049627 - 540051076, Ack=1180777222, Win=64816 (scale factor 0) = 64816 141 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540051076, Win=65535 (scale factor 0) = 65535 142 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x3604 Cancels=0x0 143 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #142]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540052536 - 540053996, Ack=1180777222, Win=64816 (scale factor 0) = 64816 144 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540053996, Win=65535 (scale factor 0) = 65535 145 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #142]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540053996 - 540055456, Ack=1180777222, Win=64816 (scale factor 0) = 64816 146 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #142]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540055456 - 540056905, Ack=1180777222, Win=64816 (scale factor 0) = 64816 147 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540056905, Win=65535 (scale factor 0) = 65535 148 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x1F84 Cancels=0x0 149 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #148]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540058365 - 540059825, Ack=1180777222, Win=64816 (scale factor 0) = 64816 150 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540059825, Win=65535 (scale factor 0) = 65535 151 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #148]Flags=....A..., SrcPort=1117, DstPort=1066, Len=1460, Seq=540059825 - 540061285, Ack=1180777222, Win=64816 (scale factor 0) = 64816 152 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #148]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=1449, Seq=540061285 - 540062734, Ack=1180777222, Win=64816 (scale factor 0) = 64816 153 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540062734, Win=65535 (scale factor 0) = 65535 154 0.187500 {MSRPC:14, TCP:12, IPv4:5} test125.test.local test124.test.local MSRPC MSRPC: c/o Continued Response: WMI-IWbemServices Call=0x9 Context=0x3 Hint=0x904 Cancels=0x0 155 0.187500 {TCP:12, IPv4:5} test125.test.local test124.test.local TCP TCP: [Continuation to #154]Flags=...PA..., SrcPort=1117, DstPort=1066, Len=929, Seq=540064194 - 540065123, Ack=1180777222, Win=64816 (scale factor 0) = 64816 156 0.187500 {TCP:12, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1066, DstPort=1117, Len=0, Seq=1180777222, Ack=540065123, Win=65535 (scale factor 0) = 65535 157 0.187500 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 158 0.218750 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 159 0.296875 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=....A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 160 0.437500 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 161 0.515625 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 162 1.062500 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 163 1.437500 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 164 2.265625 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 165 2.453125 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 166 3.437500 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 167 4.437500 {ARP:15} 172.16.11.144 172.16.11.144 ARP ARP: Request, 172.16.11.144 asks for 172.16.11.144 168 4.671875 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 169 5.453125 {ARP:16} 172.16.11.181 172.16.11.144 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.144 170 5.453125 {UDP:18, IPv4:17} 172.16.11.144 239.255.255.250 UDP UDP: SrcPort = 1198, DstPort = 1900, Length = 141 171 5.453125 {UDP:19, IPv4:17} 172.16.11.144 239.255.255.250 UDP UDP: SrcPort = 1202, DstPort = 1900, Length = 141 172 5.515625 {NbtNs:22, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 173 5.562500 {DNS:24, UDP:23, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x4470, QUERY (Standard query), Query for test124.test.local of type SOA on class Internet 174 5.562500 {DNS:24, UDP:23, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x4470, QUERY (Standard query), Response - Success 175 5.562500 {DNS:26, UDP:25, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0xE772, Update, Query for test.local of type SOA on class Internet 176 5.562500 {DNS:26, UDP:25, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0xE772, Update, Response - Success 177 5.562500 {DNS:28, UDP:27, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Query for 124.11.16.172.in-addr.arpa of type SOA on class Internet 178 5.562500 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 179 6.265625 {NbtNs:22, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 180 6.562500 {DNS:28, UDP:27, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Query for 124.11.16.172.in-addr.arpa of type SOA on class Internet 181 7.015625 {NbtNs:22, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 182 7.562500 {DNS:28, UDP:27, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Query for 124.11.16.172.in-addr.arpa of type SOA on class Internet 183 7.765625 {NbtNs:22, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 184 8.468750 {UDP:19, IPv4:17} 172.16.11.144 239.255.255.250 UDP UDP: SrcPort = 1202, DstPort = 1900, Length = 141 185 8.515625 {NbtNs:30, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 186 9.265625 {NbtNs:30, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 187 9.484375 {MSRPC:14, TCP:12, IPv4:5} test124.test.local test125.test.local DCOM DCOM 188 9.562500 {DNS:28, UDP:27, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Query for 124.11.16.172.in-addr.arpa of type SOA on class Internet 189 10.015625 {NbtNs:30, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 190 10.765625 {NbtNs:30, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 191 10.828125 {UDP:32, IPv4:31} dc181.test.local 172.16.11.255 BROWSER BROWSER: Become Backup Browser 192 11.312500 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 193 11.484375 {UDP:19, IPv4:17} 172.16.11.144 239.255.255.250 UDP UDP: SrcPort = 1202, DstPort = 1900, Length = 141 194 11.515625 {NbtNs:33, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 195 11.515625 {NbtNs:34, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 196 12.265625 {NbtNs:33, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 197 12.265625 {NbtNs:34, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 198 12.328125 {TCP:35, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=.S......, SrcPort=1071, DstPort=DCE endpoint resolution(135), Len=0, Seq=2068311888, Ack=0, Win=65535 (scale factor 0) = 65535 199 12.328125 {TCP:35, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=.S..A..., SrcPort=DCE endpoint resolution(135), DstPort=1071, Len=0, Seq=2757538088, Ack=2068311889, Win=16384 (scale factor 0) = 16384 200 12.328125 {TCP:35, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1071, DstPort=DCE endpoint resolution(135), Len=0, Seq=2068311889, Ack=2757538089, Win=65535 (scale factor 0) = 65535 201 12.328125 {MSRPC:36, TCP:35, IPv4:1} test124.test.local dc181.test.local MSRPC MSRPC: c/o Bind: UUID{E1AF8308-5D1F-11C9-91A4-08002B14A0FA} Endpoint Mapper Call=0x1 Assoc Grp=0x0 Xmit=0x16D0 Recv=0x16D0 202 12.328125 {MSRPC:36, TCP:35, IPv4:1} dc181.test.local test124.test.local MSRPC MSRPC: c/o Bind Ack: Call=0x1 Assoc Grp=0x7DB2 Xmit=0x16D0 Recv=0x16D0 203 12.328125 {MSRPC:36, TCP:35, IPv4:1} test124.test.local dc181.test.local EPM EPM: Request: ept_map: NDR, Tracking Server Service v1.0, RPC v5, 0.0.0.0:135 (0x87) [DCE endpoint resolution(135)] 204 12.328125 {MSRPC:36, TCP:35, IPv4:1} dc181.test.local test124.test.local EPM EPM: Response: ept_map: 0x16C9A0D6 - EP_S_NOT_REGISTERED 205 12.328125 {DNS:38, UDP:37, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x876B, QUERY (Standard query), Query for _ldap._tcp.Default-First-Site._sites.dc._msdcs.test.local of type SRV on class Internet 206 12.328125 {DNS:38, UDP:37, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x876B, QUERY (Standard query), Response - Success 207 12.328125 {LDAP:40, UDP:39, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:3, BaseObject: NULL, SearchScope: base Object, SearchAlias: neverDerefAliases 208 12.328125 {LDAP:40, UDP:39, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Search Result Entry, MessageID:3, Status: Success 209 12.546875 {TCP:35, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1071, DstPort=DCE endpoint resolution(135), Len=0, Seq=2068312117, Ack=2757538213, Win=65411 (scale factor 0) = 65411 210 13.015625 {NbtNs:33, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 211 13.015625 {NbtNs:34, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 212 13.562500 {DNS:28, UDP:27, IPv4:1} test124.test.local dc181.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Query for 124.11.16.172.in-addr.arpa of type SOA on class Internet 213 13.765625 {NbtNs:33, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST125 214 13.765625 {NbtNs:34, UDP:21, IPv4:20} 172.16.11.144 172.16.11.255 NbtNs NbtNs: Registration Request for TEST 215 14.515625 {UDP:41, IPv4:20} 172.16.11.144 172.16.11.255 BROWSER BROWSER: Request Announcement, ReplySystemName = TEST125 216 14.515625 {UDP:41, IPv4:20} 172.16.11.144 172.16.11.255 BROWSER BROWSER: Host Announcement, Name = TEST125 217 14.531250 {UDP:32, IPv4:31} dc181.test.local 172.16.11.255 BROWSER BROWSER: Local Master Announcement, Name = DC181 218 16.500000 {TCP:42, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=.S......, SrcPort=1075, DstPort=LDAP(389), Len=0, Seq=218699484, Ack=0, Win=65535 (scale factor 0) = 65535 219 16.500000 {TCP:42, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=.S..A..., SrcPort=LDAP(389), DstPort=1075, Len=0, Seq=304272442, Ack=218699485, Win=16384 (scale factor 0) = 16384 220 16.500000 {TCP:42, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1075, DstPort=LDAP(389), Len=0, Seq=218699485, Ack=304272443, Win=65535 (scale factor 0) = 65535 221 16.500000 {LDAP:43, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:1, BaseObject: NULL, SearchScope: base Object, SearchAlias: neverDerefAliases 222 16.500000 {LDAP:43, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Search Result Entry, MessageID:1 223 16.500000 {TCP:42, IPv4:1} dc181.test.local test124.test.local TCP TCP: [Continuation to #222]Flags=...PA..., SrcPort=LDAP(389), DstPort=1075, Len=546, Seq=304273903 - 304274449, Ack=218699835, Win=65185 (scale factor 0) = 65185 224 16.500000 {TCP:42, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1075, DstPort=LDAP(389), Len=0, Seq=218699835, Ack=304274449, Win=65535 (scale factor 0) = 65535 225 16.500000 {LDAP:44, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Bind Request, MessageID:3, Version: 3 226 16.500000 {LDAP:44, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Bind Response, MessageID:3, Status: Success 227 16.500000 {LDAP:45, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:4, BaseObject: NULL, SearchScope: base Object, SearchAlias: neverDerefAliases 228 16.500000 {LDAP:45, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Search Result Entry, MessageID:4, Status: Success 229 16.500000 {LDAP:46, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:5, BaseObject: NULL, SearchScope: base Object, SearchAlias: neverDerefAliases 230 16.500000 {LDAP:46, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Search Result Entry, MessageID:5, Status: Success 231 16.500000 {LDAP:47, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:6, BaseObject: CN=NTDS Settings,CN=DC181,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=test,DC=local, SearchScope: base Object, SearchAlias: neverDerefAliases 232 16.500000 {LDAP:47, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: Search Result Entry, MessageID:6, Status: Success 233 16.500000 {LDAP:48, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Search Request, MessageID:7, BaseObject: CN=Public Key Services,CN=Services,CN=Configuration,DC=test,DC=local, SearchScope: WholeSubtree, SearchAlias: neverDerefAliases 234 16.500000 {LDAP:48, TCP:42, IPv4:1} dc181.test.local test124.test.local LDAP LDAP: search Result Done, MessageID:7, Status: Success 235 16.500000 {LDAP:49, TCP:42, IPv4:1} test124.test.local dc181.test.local LDAP LDAP: Unbind Request, MessageID:8 236 16.500000 {TCP:42, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=F...A..., SrcPort=1075, DstPort=LDAP(389), Len=0, Seq=218701842, Ack=304275347, Win=64637 (scale factor 0) = 64637 237 16.500000 {TCP:42, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=....A..., SrcPort=LDAP(389), DstPort=1075, Len=0, Seq=304275347, Ack=218701843, Win=64782 (scale factor 0) = 64782 238 16.500000 {TCP:42, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=F...A..., SrcPort=LDAP(389), DstPort=1075, Len=0, Seq=304275347, Ack=218701843, Win=64782 (scale factor 0) = 64782 239 16.500000 {TCP:42, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1075, DstPort=LDAP(389), Len=0, Seq=218701843, Ack=304275348, Win=64637 (scale factor 0) = 64637 240 17.296875 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 241 19.109375 {TCP:50, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1076, DstPort=1117, Len=0, Seq=2940169666, Ack=0, Win=65535 (scale factor 0) = 65535 242 21.312500 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 243 22.062500 {TCP:50, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1076, DstPort=1117, Len=0, Seq=2940169666, Ack=0, Win=65535 (scale factor 0) = 65535 244 25.328125 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 245 28.078125 {TCP:50, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1076, DstPort=1117, Len=0, Seq=2940169666, Ack=0, Win=65535 (scale factor 0) = 65535 246 30.234375 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 247 33.609375 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 248 35.937500 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 249 35.937500 {TCP:6, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=..R.A..., SrcPort=1063, DstPort=DCE endpoint resolution(135), Len=0, Seq=539163382, Ack=981335462, Win=0 (scale factor 0) = 0 250 37.265625 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 251 39.390625 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 252 40.109375 {TCP:51, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1077, DstPort=1117, Len=0, Seq=3563029517, Ack=0, Win=65535 (scale factor 0) = 65535 253 40.328125 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 254 40.890625 {UDP:32, IPv4:31} dc181.test.local 172.16.11.255 BROWSER BROWSER: Become Backup Browser 255 43.062500 {TCP:51, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1077, DstPort=1117, Len=0, Seq=3563029517, Ack=0, Win=65535 (scale factor 0) = 65535 256 43.390625 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 257 43.390625 {DNS:28, UDP:27, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Response - Server failure 258 43.390625 {DNS:28, UDP:27, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Response - Server failure 259 45.406250 {TCP:35, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=F...A..., SrcPort=1071, DstPort=DCE endpoint resolution(135), Len=0, Seq=2068312117, Ack=2757538213, Win=65411 (scale factor 0) = 65411 260 45.406250 {TCP:35, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=....A..., SrcPort=DCE endpoint resolution(135), DstPort=1071, Len=0, Seq=2757538213, Ack=2068312118, Win=65307 (scale factor 0) = 65307 261 45.406250 {TCP:35, IPv4:1} dc181.test.local test124.test.local TCP TCP: Flags=F...A..., SrcPort=DCE endpoint resolution(135), DstPort=1071, Len=0, Seq=2757538213, Ack=2068312118, Win=65307 (scale factor 0) = 65307 262 45.406250 {TCP:35, IPv4:1} test124.test.local dc181.test.local TCP TCP: Flags=....A..., SrcPort=1071, DstPort=DCE endpoint resolution(135), Len=0, Seq=2068312118, Ack=2757538214, Win=65411 (scale factor 0) = 65411 263 46.343750 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 264 47.375000 {ARP:29} 172.16.11.181 172.16.11.1 ARP ARP: Request, 172.16.11.181 asks for 172.16.11.1 265 49.078125 {TCP:51, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1077, DstPort=1117, Len=0, Seq=3563029517, Ack=0, Win=65535 (scale factor 0) = 65535 266 49.703125 {UDP:32, IPv4:31} dc181.test.local 172.16.11.255 BROWSER BROWSER: Domain/Workgroup Announcement, Name = TEST, serverName = DC181 267 51.375000 {DNS:28, UDP:27, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Response - Server failure 268 51.375000 {DNS:28, UDP:27, IPv4:1} dc181.test.local test124.test.local DNS DNS: QueryId = 0x7772, QUERY (Standard query), Response - Server failure 269 58.265625 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535 270 61.109375 {TCP:52, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1078, DstPort=1117, Len=0, Seq=263846691, Ack=0, Win=65535 (scale factor 0) = 65535 271 64.062500 {TCP:52, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1078, DstPort=1117, Len=0, Seq=263846691, Ack=0, Win=65535 (scale factor 0) = 65535 272 70.078125 {TCP:52, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=.S......, SrcPort=1078, DstPort=1117, Len=0, Seq=263846691, Ack=0, Win=65535 (scale factor 0) = 65535 273 70.921875 {UDP:32, IPv4:31} dc181.test.local 172.16.11.255 BROWSER BROWSER: Become Backup Browser 274 82.328125 {TCP:8, IPv4:5} test124.test.local test125.test.local TCP TCP: Flags=F...A..., SrcPort=1064, DstPort=DCE endpoint resolution(135), Len=0, Seq=1367846254, Ack=3625280836, Win=65535 (scale factor 0) = 65535