"I connect to peer (or vice versa)" No. Time Source Destination Protocol Info 104 54.203760 192.168.177.109 70.135.XXX.XXX TCP 10941 > 6881 [SYN] Seq=0 Len=0 MSS=1460 WS=2 Frame 104 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX), Dst: D-Link_XX:XX:XX (00:11:95:XX:XX:XX) Internet Protocol, Src: 192.168.177.109 (192.168.177.109), Dst: 70.135.XXX.XXX (70.135.XXX.XXX) Transmission Control Protocol, Src Port: 10941 (10941), Dst Port: 6881 (6881), Seq: 0, Len: 0 "Peer ACKs back and sends own connect request" No. Time Source Destination Protocol Info 108 54.302523 70.135.XXX.XXX 192.168.177.109 TCP 6881 > 10941 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1452 WS=0 Frame 108 (66 bytes on wire, 66 bytes captured) Ethernet II, Src: D-Link_XX:XX:XX (00:11:95:XX:XX:XX), Dst: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX) Internet Protocol, Src: 70.135.XXX.XXX (70.135.XXX.XXX), Dst: 192.168.177.109 (192.168.177.109) Transmission Control Protocol, Src Port: 6881 (6881), Dst Port: 10941 (10941), Seq: 0, Ack: 1, Len: 0 "I ACK back" No. Time Source Destination Protocol Info 109 54.302555 192.168.177.109 70.135.XXX.XXX TCP 10941 > 6881 [ACK] Seq=1 Ack=1 Win=169360 Len=0 Frame 109 (54 bytes on wire, 54 bytes captured) Ethernet II, Src: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX), Dst: D-Link_XX:XX:XX (00:11:95:XX:XX:XX) Internet Protocol, Src: 192.168.177.109 (192.168.177.109), Dst: 70.135.XXX.XXX (70.135.XXX.XXX) Transmission Control Protocol, Src Port: 10941 (10941), Dst Port: 6881 (6881), Seq: 1, Ack: 1, Len: 0 "BitTorrent handshake, contains info_hash and ClientID" No. Time Source Destination Protocol Info 110 54.302806 192.168.177.109 70.135.XXX.XXX TCP 10941 > 6881 [PSH, ACK] Seq=1 Ack=1 Win=169360 Len=68 Frame 110 (122 bytes on wire, 122 bytes captured) Ethernet II, Src: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX), Dst: D-Link_XX:XX:XX (00:11:95:XX:XX:XX) Internet Protocol, Src: 192.168.177.109 (192.168.177.109), Dst: 70.135.XXX.XXX (70.135.XXX.XXX) Transmission Control Protocol, Src Port: 10941 (10941), Dst Port: 6881 (6881), Seq: 1, Ack: 1, Len: 68 Data (68 bytes) 0000 00 11 95 XX XX XX 00 0a e4 XX XX XX 08 00 45 00 .....i...=....E. 0010 00 6c 66 59 40 00 80 06 17 bf c0 a8 b1 6d 46 87 .lfY@........mF. 0020 XX XX 2a bd 1a e1 37 aa 32 01 97 31 58 a7 50 18 ..*...7.2..1X.P. 0030 a5 64 7c d2 00 00 13 42 69 74 54 6f 72 72 65 6e .d|....BitTorren 0040 74 20 70 72 6f 74 6f 63 6f 6c 00 00 00 00 00 10 t protocol...... 0050 00 00 ba d9 83 03 a4 03 c9 71 da 5d bf 58 11 bf .........q.].X.. 0060 a9 8a 94 d1 c5 b7 2d 55 54 31 37 32 30 2d 82 8d ......-UT1720-.. 0070 95 d9 7c 83 6a 34 72 1e 91 6a ..|.j4r..j "Peer ACKs back, sends info_hash and ClientID" No. Time Source Destination Protocol Info 114 54.445004 70.135.XXX.XXX 192.168.177.109 TCP 6881 > 10941 [PSH, ACK] Seq=1 Ack=69 Win=65467 Len=68 Frame 114 (122 bytes on wire, 122 bytes captured) Ethernet II, Src: D-Link_XX:XX:XX (00:11:95:XX:XX:XX), Dst: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX) Internet Protocol, Src: 70.135.XXX.XXX (70.135.XXX.XXX), Dst: 192.168.177.109 (192.168.177.109) Transmission Control Protocol, Src Port: 6881 (6881), Dst Port: 10941 (10941), Seq: 1, Ack: 69, Len: 68 Data (68 bytes) 0000 00 0a e4 XX XX XX 00 11 95 XX XX XX 08 00 45 20 ...=.......i..E 0010 00 6c 91 ad 40 00 73 06 f9 4a 46 87 XX XX c0 a8 .l..@.s..JF..... 0020 b1 6d 1a e1 2a bd 97 31 58 a7 37 aa 32 45 50 18 .m..*..1X.7.2EP. 0030 ff bb 8f af 00 00 13 42 69 74 54 6f 72 72 65 6e .......BitTorren 0040 74 20 70 72 6f 74 6f 63 6f 6c 00 00 00 00 00 10 t protocol...... 0050 00 0d ba d9 83 03 a4 03 c9 71 da 5d bf 58 11 bf .........q.].X.. 0060 a9 8a 94 d1 c5 b7 4d 35 2d 30 2d 37 2d 2d 63 65 ......M5-0-7--ce 0070 36 36 33 66 62 34 65 37 64 34 663fb4e7d4 "Simple ACK" No. Time Source Destination Protocol Info 118 54.562770 192.168.177.109 70.135.XXX.XXX TCP 10941 > 6881 [ACK] Seq=69 Ack=69 Win=169292 Len=0 Frame 118 (54 bytes on wire, 54 bytes captured) Ethernet II, Src: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX), Dst: D-Link_XX:XX:XX (00:11:95:XX:XX:XX) Internet Protocol, Src: 192.168.177.109 (192.168.177.109 ), Dst: 70.135.XXX.XXX (70.135.XXX.XXX) Transmission Control Protocol, Src Port: 10941 (10941), Dst Port: 6881 (6881), Seq: 69, Ack: 69, Len: 0 "Peer sends bitfield" No. Time Source Destination Protocol Info 124 54.827638 70.135.XXX.XXX 192.168.177.109 TCP 6881 > 10941 [PSH, ACK] Seq=69 Ack=69 Win=65467 Len=288 Frame 124 (342 bytes on wire, 342 bytes captured) Ethernet II, Src: D-Link_XX:XX:XX (00:11:95:XX:XX:XX), Dst: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX) Internet Protocol, Src: 70.135.XXX.XXX (70.135.XXX.XXX), Dst: 192.168.177.109 ( 192.168.177.109) Transmission Control Protocol, Src Port: 6881 (6881), Dst Port: 10941 (10941), Seq: 69, Ack: 69, Len: 288 Data (288 bytes) 0000 00 0a e4 XX XX XX 00 11 95 XX XX XX 08 00 45 20 ...=.......i..E 0010 01 48 91 cd 40 00 73 06 f8 4e 46 87 XX XX c0 a8 .H..@.s..NF..... 0020 b1 6d 1a e1 2a bd 97 31 58 eb 37 aa 32 45 50 18 .m..*..1X.7.2EP. 0030 ff bb d2 e9 00 00 00 00 00 df 05 00 00 00 00 00 ................ 0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 ................ 0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0080 00 00 00 00 00 80 00 00 00 00 00 00 00 40 00 00 .............@.. 0090 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 ..... .......... 00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00c0 08 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 ................ 00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 ................ 00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0100 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 ................ 0110 00 00 00 00 00 00 00 00 00 00 00 00 39 14 00 64 ............9..d 0120 31 3a 65 69 30 65 31 3a 6d 64 36 3a 75 74 5f 70 1:ei0e1:md6:ut_p 0130 65 78 69 31 65 65 31 3a 70 69 36 38 38 31 65 31 exi1ee1:pi6881e1 0140 3a 76 31 36 3a 42 69 74 54 6f 72 72 65 6e 74 20 :v16:BitTorrent 0150 35 2e 30 2e 37 65 5.0.7e "I send bitfield" No. Time Source Destination Protocol Info 125 54.827822 192.168.177.109 70.135.XXX.XXX TCP 10941 > 6881 [PSH, ACK] Seq=69 Ack=357 Win=169004 Len=493 Frame 125 (547 bytes on wire, 547 bytes captured) Ethernet II, Src: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX), Dst: D-Link_XX:XX:XX (00:11:95:XX:XX:XX) Internet Protocol, Src: 192.168.177.109 (192.168.177.109), Dst: 70.135.XXX.XXX (70.135.XXX.XXX) Transmission Control Protocol, Src Port: 10941 (10941), Dst Port: 6881 (6881), Seq: 69, Ack: 357, Len: 493 Data (493 bytes) 0000 00 11 95 XX XX XX 00 0a e4 XX XX XX 08 00 45 00 .....i...=....E. 0010 02 15 66 62 40 00 80 06 16 0d c0 a8 b1 6d 46 87 ..fb@........mF. 0020 XX XX 2a bd 1a e1 37 aa 32 45 97 31 5a 0b 50 18 ..*...7.2E.1Z.P. 0030 a5 0b 7e 7b 00 00 00 00 00 2e 14 00 64 31 3a 65 ..~{........d1:e 0040 69 30 65 31 3a 6d 64 65 31 3a 70 69 31 30 39 34 i0e1:mde1:pi1094 0050 31 65 31 3a 76 31 35 3a c2 b5 54 6f 72 72 65 6e 1e1:v15:..Torren 0060 74 20 31 2e 37 2e 32 65 00 00 00 df 05 ff ff ff t 1.7.2e........ 0070 ff ff ff ff ff ff ef ff ff ff ff ff ff fe ff ff ................ 0080 ff fd ff 7f ff fd ff ff ff ff ff ff ff ff ff ff ................ 0090 ff ff ff ff ff ff ff ef ff ff ff ff ff ff ff ff ................ 00a0 ff ff ff ff ff fd ff ff ff ff ff ff ff ff ff ff ................ 00b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ 00c0 ff ff 7f ff ff ff fb ff ff ff bf ff ff f7 ff df ................ 00d0 ff ff ff ff ff ff f7 ff ff ff ff ff ff ff ff ff ................ 00e0 ff ff ff ff ff ff 7f ff 7f ff ff ff ff ff ff ff ................ 00f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ 0100 ff ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ 0110 ff ff ff ff ff bf ff ff ff ff ff ff ff ff ff ff ................ 0120 ff ff df ff ff ff df ff ff ff ff ff ff ff ff ff ................ 0130 bd ff 7f ff fb ff ff ff ff ff ff ff ff ff ff ff ................ 0140 ff ff ff ff ff ff ff ef ff ff 80 00 00 00 05 04 ................ 0150 00 00 05 41 00 00 00 05 04 00 00 02 a8 00 00 00 ...A............ 0160 05 04 00 00 03 d8 00 00 00 05 04 00 00 03 4c 00 ..............L. 0170 00 00 05 04 00 00 03 04 00 00 00 05 04 00 00 00 ................ 0180 a6 00 00 00 05 04 00 00 02 cd 00 00 00 05 04 00 ................ 0190 00 06 28 00 00 00 05 04 00 00 05 aa 00 00 00 05 ..(............. 01a0 04 00 00 00 b0 00 00 00 05 04 00 00 04 a3 00 00 ................ 01b0 00 05 04 00 00 06 3d 00 00 00 05 04 00 00 06 1e ......=......... 01c0 00 00 00 05 04 00 00 00 c6 00 00 00 05 04 00 00 ................ 01d0 05 ca 00 00 00 05 04 00 00 00 87 00 00 00 05 04 ................ 01e0 00 00 06 19 00 00 00 05 04 00 00 03 12 00 00 00 ................ 01f0 05 04 00 00 03 c8 00 00 00 05 04 00 00 01 c6 00 ................ 0200 00 00 05 04 00 00 01 53 00 00 00 05 04 00 00 06 .......S........ 0210 d3 00 00 00 05 04 00 00 00 4b 00 00 00 05 04 00 .........K...... 0220 00 02 e9 ... "I receive unexpected RST! (with correct sequence number)" No. Time Source Destination Protocol Info 126 54.842677 70.135.XXX.XXX 192.168.177.109 TCP 6881 > 10941 [RST] Seq=357 Len=0 Frame 126 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: D-Link_XX:XX:XX (00:11:95:XX:XX:XX), Dst: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX) Internet Protocol, Src: 70.135.XXX.XXX (70.135.XXX.XXX), Dst: 192.168.177.109 (192.168.177.109) Transmission Control Protocol, Src Port: 6881 (6881), Dst Port: 10941 (10941), Seq: 357, Len: 0 0000 00 0a e4 XX XX XX 00 11 95 XX XX XX 08 00 45 40 ...=.......i..E@ 0010 00 28 13 5e 40 00 7b 06 6f be 46 87 XX XX c0 a8 .(.^@.{.o.F..... 0020 b1 6d 1a e1 2a bd 97 31 5a 0b 00 00 00 00 50 04 .m..*..1Z.....P. 0030 28 00 d4 91 00 00 00 00 00 00 00 00 (........... "At this point, the connection is severed, however, for the sake of completeness, note that I also receive another RST, but this time with a strange sequence number. But it doesn't matter. We're disconnected." No. Time Source Destination Protocol Info 127 54.842864 70.135.XXX.XXX 192.168.177.109 TCP 6881 > 10941 [RST] Seq=12860 Len=0 Frame 127 (60 bytes on wire, 60 bytes captured) Ethernet II, Src: D-Link_XX:XX:XX (00:11:95:XX:XX:XX), Dst: Wistron_XX:XX:XX (00:0a:e4:XX:XX:XX) Internet Protocol, Src: 70.135.XXX.XXX (70.135.XXX.XXX), Dst: 192.168.177.109 (192.168.177.109) Transmission Control Protocol, Src Port: 6881 (6881), Dst Port: 10941 (10941), Seq: 12860, Len: 0 0000 00 0a e4 XX XX XX 00 11 95 XX XX XX 08 00 45 40 ...=.......i..E@ 0010 00 28 13 60 40 00 7b 06 6f bc 46 87 XX XX c0 a8 .(.`@.{.o.F..... 0020 b1 6d 1a e1 2a bd 97 31 8a e2 00 00 00 00 50 04 .m..*..1......P. 0030 28 00 a3 ba 00 00 00 00 00 00 00 00 (...........