On Aug 26, 2014, at 8:37 PM, John York <jo...@griffintechnology.com> wrote:
> In this case, 17 is both the protocol and port number. Confusing coincidence > :) Not in this output which the OP sent to the list: > 8:33:58.482193 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP > (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 > 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 > <mailto:E.....@.8>.....;. > 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 > @^....i.....C... > 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. > 18:33:58.482193 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP > (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 > 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 > <mailto:E.....@.8>.....;. > 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 > @^....i.....C... > 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. > 18:33:58.484625 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP > (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 > 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 > <mailto:E.....@.8>.....;. > 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 > @^....i.....C... > 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. > 18:33:58.486137 IP (tos 0x0, ttl 56, id 0, offset 0, flags [DF], proto UDP > (17), length 29) x.x.x.x.2072 > x.x.x.x.27015: UDP, length 1 > 0x0000: 4500 001d 0000 4000 3811 088c cf9a 3b8c E.....@.8 > <mailto:E.....@.8>.....;. > 0x0010: 405e eebf 0818 6987 0009 10f8 4300 0000 > @^....i.....C... > 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. Source port 2072, destination port 27015. ---------------------------------------------------------------------- Roland Dobbins <rdobb...@arbor.net> // <http://www.arbornetworks.com> Equo ne credite, Teucri. -- Laocoön
