1 1 08:56:35.148077 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [S], seq 3648253419, win 16384, options [mss 1460,nop,nop,sackOK], length 0 2 2 08:56:35.148207 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [S.], seq 2339250119, ack 3648253420, win 32120, options [mss 1460,nop,nop,sackOK], length 0 3 3 08:56:35.148313 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [S.], seq 2339250119, ack 3648253420, win 32120, options [mss 1460,nop,nop,sackOK], length 0 4 4 08:56:35.148666 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [.], ack 1, win 17520, length 0 5 5 08:56:35.148886 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [P.], seq 1:157, ack 1, win 17520, length 156: pptp CTRL_MSGTYPE=SCCRQ PROTO_VER(1.0) FRAME_CAP(A) BEARER_CAP(A) MAX_CHAN(0) FIRM_REV(2160) HOSTNAME() VENDOR(Microsoft Windows NT) 6 6 08:56:35.148956 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 157, win 32120, length 0 7 7 08:56:35.149056 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 157, win 32120, length 0 8 8 08:56:35.217355 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [P.], seq 1:157, ack 157, win 32120, length 156: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP() BEARER_CAP() MAX_CHAN(1) FIRM_REV(1) HOSTNAME(local) VENDOR(MoretonBay) 9 9 08:56:35.217591 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [P.], seq 1:157, ack 157, win 32120, length 156: pptp CTRL_MSGTYPE=SCCRP PROTO_VER(1.0) RESULT_CODE(1) ERR_CODE(0) FRAME_CAP() BEARER_CAP() MAX_CHAN(1) FIRM_REV(1) HOSTNAME(local) VENDOR(MoretonBay) 10 10 08:56:35.218221 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [P.], seq 157:325, ack 157, win 17364, length 168: pptp CTRL_MSGTYPE=OCRQ CALL_ID(0) CALL_SER_NUM(30760) MIN_BPS(300) MAX_BPS(100000000) BEARER_TYPE(Any) FRAME_TYPE(E) RECV_WIN(64) PROC_DELAY(0) PHONE_NO_LEN(0) PHONE_NO() SUB_ADDR() 11 11 08:56:35.232225 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 325, win 32120, length 0 12 12 08:56:35.232337 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 325, win 32120, length 0 13 13 08:56:35.387060 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [P.], seq 157:189, ack 325, win 32120, length 32: pptp CTRL_MSGTYPE=OCRP CALL_ID(0) PEER_CALL_ID(0) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(100000000) RECV_WIN(64) PROC_DELAY(0) PHY_CHAN_ID(0) 14 14 08:56:35.387196 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [P.], seq 157:189, ack 325, win 32120, length 32: pptp CTRL_MSGTYPE=OCRP CALL_ID(0) PEER_CALL_ID(0) RESULT_CODE(1) ERR_CODE(0) CAUSE_CODE(0) CONN_SPEED(100000000) RECV_WIN(64) PROC_DELAY(0) PHY_CHAN_ID(0) 15 15 08:56:35.395885 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [P.], seq 325:349, ack 189, win 17332, length 24: pptp CTRL_MSGTYPE=SLI PEER_CALL_ID(0) SEND_ACCM(0xffffffff) RECV_ACCM(0xffffffff) 16 16 08:56:35.411903 IP 10.1.1.11 > 10.1.1.10: GREv1, call 0, seq 0, length 60: LCP, Conf-Request (0x01), id 0, length 46 17 17 08:56:35.412217 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 349, win 32120, length 0 18 18 08:56:35.412318 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 349, win 32120, length 0 19 19 08:56:36.347146 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [F.], seq 189, ack 349, win 32120, length 0 20 20 08:56:36.347265 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [F.], seq 189, ack 349, win 32120, length 0 21 21 08:56:36.347587 IP 10.1.1.11.3025 > 10.1.1.10.1723: Flags [F.], seq 349, ack 190, win 17332, length 0 22 22 08:56:36.347676 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 350, win 32120, length 0 23 23 08:56:36.347775 IP 10.1.1.10.1723 > 10.1.1.11.3025: Flags [.], ack 350, win 32120, length 0 24