15:01:12.407053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263368457:263368533, ack 311989530, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.414893 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1:73, ack 76, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.417431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76:152, ack 73, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.418251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73:161, ack 152, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.419926 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152:254, ack 161, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.421850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 161:881, ack 254, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:12.428391 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254:299, ack 881, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.429015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 881:920, ack 299, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.433014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299:425, ack 920, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.433992 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 920:1059, ack 425, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.435619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 425:501, ack 1059, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.436457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1059:1131, ack 501, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.440660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 501:577, ack 1131, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.441483 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1131:1219, ack 577, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.444152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 577:703, ack 1219, win 4031, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.470515 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1219:15819, ack 703, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:12.474628 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4139, win 4380, length 0 15:01:12.476625 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 7059, win 4380, length 0 15:01:12.476701 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 15819:17279, ack 703, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:12.476743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 17279:17523, ack 703, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:12.478765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 9979, win 4380, length 0 15:01:12.480995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 12899, win 4380, length 0 15:01:12.491662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 15819, win 4380, length 0 15:01:12.492137 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 17523, win 4380, length 0 15:01:12.508946 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 703:863, ack 17523, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.535437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 17523:33583, ack 863, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:12.535797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 33583:33943, ack 863, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:12.539222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 20443, win 4380, length 0 15:01:12.543762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 23363, win 4380, length 0 15:01:12.544156 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 26283, win 4380, length 0 15:01:12.548914 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 29203, win 4380, length 0 15:01:12.549310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 32123, win 4380, length 0 15:01:12.551256 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 33943, win 4380, length 0 15:01:12.551321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 33943:34047, ack 863, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:12.551899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 863:979, ack 33943, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.553115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 979:1067, ack 34047, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:12.577745 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 34047:50107, ack 1067, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:12.578084 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50107:50391, ack 1067, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:12.580672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 36967, win 4380, length 0 15:01:12.589083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 39887, win 4380, length 0 15:01:12.595701 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 42807, win 4380, length 0 15:01:12.596134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 45727, win 4380, length 0 15:01:12.596623 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 48647, win 4380, length 0 15:01:12.597055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 50391, win 4380, length 0 15:01:12.597507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1067:1108, ack 50391, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:12.598375 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50391:50430, ack 1108, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:12.599946 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1108:1153, ack 50430, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.600633 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50430:50469, ack 1153, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.603000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1153:1281, ack 50469, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.603946 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50469:50608, ack 1281, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.607212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1281:1357, ack 50608, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.608115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50608:50680, ack 1357, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.609735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1357:1433, ack 50680, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.610557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 50680:50768, ack 1433, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.612227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1433:1561, ack 50768, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.618747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 50768:53688, ack 1561, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:12.618978 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 53688:54188, ack 1561, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:12.622586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 53688, win 4380, length 0 15:01:12.628864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1561:1606, ack 54188, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.629229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 54188:54292, ack 1606, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:12.630947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1606:1694, ack 54292, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:12.631033 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 54292:54331, ack 1694, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.633378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1694:1802, ack 54331, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.634325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 54331:54470, ack 1802, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.635932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1802:1878, ack 54470, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.636785 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 54470:54542, ack 1878, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.638380 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1878:1954, ack 54542, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.639192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 54542:54630, ack 1954, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.640877 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 1954:2062, ack 54630, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.644691 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 54630:56090, ack 2062, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:12.644894 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56090:56526, ack 2062, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:12.647320 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 56526, win 4380, length 0 15:01:12.648478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2062:2107, ack 56526, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.649172 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56526:56565, ack 2107, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.651476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2107:2233, ack 56565, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.652352 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56565:56704, ack 2233, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.653935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2233:2309, ack 56704, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.654791 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56704:56776, ack 2309, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.656415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2309:2385, ack 56776, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.657234 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56776:56864, ack 2385, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.658913 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2385:2511, ack 56864, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.660911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 56864:57564, ack 2511, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:12.663313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2511:2556, ack 57564, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.664055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 57564:57603, ack 2556, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.671355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2556:2690, ack 57603, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.672228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 57603:57742, ack 2690, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.673837 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2690:2766, ack 57742, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.673921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 57742:57846, ack 2766, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:12.675564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2766:2854, ack 57846, win 4050, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:12.675647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 57846:57918, ack 2854, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.677262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2854:2930, ack 57918, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.678100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 57918:58006, ack 2930, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.679978 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 2930:3064, ack 58006, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.681237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58006:58274, ack 3064, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:12.682943 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3064:3109, ack 58274, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.683618 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58274:58313, ack 3109, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.687396 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3109:3243, ack 58313, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:12.688561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58313:58452, ack 3243, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:12.690181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3243:3319, ack 58452, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.691039 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58452:58524, ack 3319, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:12.693268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3319:3395, ack 58524, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.694485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58524:58612, ack 3395, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:12.696130 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3395:3529, ack 58612, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:12.698931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 58612:59552, ack 3529, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:12.701854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3529:3574, ack 59552, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:12.702555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 59552:59591, ack 3574, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:12.908706 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 59591, win 4370, length 0 15:01:13.360050 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 43518:43604, ack 1203999797, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:13.361277 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [P.], seq 1:101, ack 86, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:13.370717 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 86:172, ack 101, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:13.371816 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [P.], seq 101:189, ack 172, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:13.381096 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 172:260, ack 189, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:13.382086 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [P.], seq 189:289, ack 260, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:13.386291 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 59591:59695, ack 3574, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:13.388659 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3574:3662, ack 59695, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:13.391940 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 260:348, ack 289, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:13.392987 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [P.], seq 289:377, ack 348, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:13.402339 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 348:453, ack 377, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:13.403166 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [P.], seq 377:416, ack 453, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:13.415173 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [.], ack 416, win 8192, length 0 15:01:13.423707 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 3662, win 3247, length 0 15:01:14.911264 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3662:3752, ack 59695, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:14.911378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 3752, win 3247, length 0 15:01:14.912425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 59695:59834, ack 3752, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:14.915710 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3752:3832, ack 59834, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:14.916660 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 59834:59938, ack 3832, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:14.918230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3832:3912, ack 59938, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:14.919074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 59938:60026, ack 3912, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:14.921657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 3912:4002, ack 60026, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:14.930139 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 60026:64406, ack 4002, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:14.930386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 64406:64434, ack 4002, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:14.933117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 62946, win 4380, length 0 15:01:14.934935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 64434, win 4380, length 0 15:01:14.936815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4002:4092, ack 64434, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:14.937695 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 64434:64573, ack 4092, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:14.939653 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4092:4137, ack 64573, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:14.940346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 64573:64612, ack 4137, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:14.943802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4137:4227, ack 64612, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:14.952142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 64612:68992, ack 4227, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:14.952383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 68992:69020, ack 4227, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:14.955124 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 67532, win 4380, length 0 15:01:14.957041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 69020, win 4380, length 0 15:01:14.957127 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 69020:69124, ack 4227, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:14.958072 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4227:4272, ack 69020, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:14.993777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 4272, win 3247, length 0 15:01:15.152338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 69124, win 4354, length 0 15:01:15.152413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 69124:69163, ack 4272, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.171497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4272:4360, ack 69163, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.171714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 4360, win 3247, length 0 15:01:15.172332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4360:4478, ack 69163, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.172661 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 4478, win 3247, length 0 15:01:15.173485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 69163:69302, ack 4478, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.175260 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4478:4554, ack 69302, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.176135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 69302:69374, ack 4554, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.177928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4554:4630, ack 69374, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.178801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 69374:69462, ack 4630, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.181836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4630:4748, ack 69462, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.186420 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 69462:70922, ack 4748, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.186627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 70922:71662, ack 4748, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:15.190236 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 71662, win 4380, length 0 15:01:15.190600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4748:4793, ack 71662, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.191272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 71662:71701, ack 4793, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.193768 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4793:4893, ack 71701, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.194654 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 71701:71840, ack 4893, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.196244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4893:4969, ack 71840, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.197074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 71840:71912, ack 4969, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.198663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 4969:5045, ack 71912, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.199474 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 71912:72000, ack 5045, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.201256 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5045:5145, ack 72000, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.201617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72000:72104, ack 5145, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.203234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5145:5233, ack 72104, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.203606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72104:72684, ack 5233, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:15.205493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5233:5278, ack 72684, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.206183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72684:72723, ack 5278, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.208561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5278:5388, ack 72723, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.209430 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72723:72862, ack 5388, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.211019 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5388:5464, ack 72862, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.211846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72862:72934, ack 5464, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.213414 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5464:5540, ack 72934, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.214289 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 72934:73022, ack 5540, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.215946 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5540:5650, ack 73022, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.217488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73022:73518, ack 5650, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:15.219391 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5650:5695, ack 73518, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.220085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73518:73557, ack 5695, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.222431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5695:5799, ack 73557, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.223345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73557:73696, ack 5799, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.224932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5799:5875, ack 73696, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.225784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73696:73768, ack 5875, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.227349 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5875:5951, ack 73768, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.228159 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 73768:73856, ack 5951, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.229815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 5951:6055, ack 73856, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.249524 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 73856:84076, ack 6055, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.253127 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 76776, win 4380, length 0 15:01:15.253222 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 84076:88456, ack 6055, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:15.255273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 79696, win 4380, length 0 15:01:15.255346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 88456:89916, ack 6055, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:15.255389 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 89916:90256, ack 6055, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:15.257405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 82616, win 4380, length 0 15:01:15.259557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 85536, win 4380, length 0 15:01:15.261647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 88456, win 4380, length 0 15:01:15.263688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 90256, win 4380, length 0 15:01:15.263756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90256:90360, ack 6055, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.264139 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6055:6096, ack 90256, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:15.265454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6096:6184, ack 90360, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.265536 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90360:90399, ack 6184, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:15.267092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6184:6229, ack 90399, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.267774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90399:90438, ack 6229, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.270159 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6229:6339, ack 90438, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.271040 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90438:90577, ack 6339, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.272627 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6339:6415, ack 90577, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.273508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90577:90649, ack 6415, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.275081 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6415:6491, ack 90649, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.275931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 90649:90737, ack 6491, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.277608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6491:6601, ack 90737, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.283776 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 90737:93657, ack 6601, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.284009 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 93657:94125, ack 6601, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:15.286741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 93657, win 4380, length 0 15:01:15.289028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6601:6646, ack 94125, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.289737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 94125:94164, ack 6646, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.292686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6646:6748, ack 94164, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.293555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 94164:94303, ack 6748, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.295150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6748:6824, ack 94303, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.296000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 94303:94375, ack 6824, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.297627 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6824:6900, ack 94375, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.297995 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 94375:94479, ack 6900, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.299710 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6900:6988, ack 94479, win 4174, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.299791 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 94479:94567, ack 6988, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.301524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 6988:7090, ack 94567, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.307014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 94567:97487, ack 7090, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.307250 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97487:97579, ack 7090, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:15.310455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 97487, win 4380, length 0 15:01:15.326404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7090:7135, ack 97579, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.327086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97579:97618, ack 7135, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.330018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7135:7231, ack 97618, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.330907 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97618:97757, ack 7231, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.333576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7231:7307, ack 97757, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.334626 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97757:97829, ack 7307, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.336387 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7307:7383, ack 97829, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.337223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97829:97917, ack 7383, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.338923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7383:7479, ack 97917, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.341390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 97917:99205, ack 7479, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:15.343590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7479:7524, ack 99205, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.344324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 99205:99244, ack 7524, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.347790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7524:7632, ack 99244, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.348709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 99244:99383, ack 7632, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.350297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7632:7708, ack 99383, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.351135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 99383:99455, ack 7708, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.353136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7708:7784, ack 99455, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.354018 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 99455:99543, ack 7784, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.355743 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7784:7892, ack 99543, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.358708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 99543:101003, ack 7892, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.359001 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101003:101011, ack 7892, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:15.361346 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 101011, win 4380, length 0 15:01:15.361427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101011:101115, ack 7892, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.361819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7892:7937, ack 101011, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.363121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 7937:8025, ack 101115, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.363202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101115:101154, ack 8025, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.365594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8025:8143, ack 101154, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.366475 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101154:101293, ack 8143, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.368072 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8143:8219, ack 101293, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.368948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101293:101365, ack 8219, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.370538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8219:8295, ack 101365, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.371356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 101365:101453, ack 8295, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.372995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8295:8413, ack 101453, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.378484 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 101453:102913, ack 8413, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.378689 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 102913:104221, ack 8413, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:15.381354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 104221, win 4380, length 0 15:01:15.381760 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8413:8458, ack 104221, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.382420 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 104221:104260, ack 8458, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.384759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8458:8560, ack 104260, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.385679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 104260:104399, ack 8560, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.387490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8560:8636, ack 104399, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.388334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 104399:104471, ack 8636, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.390323 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8636:8712, ack 104471, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.391138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 104471:104559, ack 8712, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.394575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8712:8814, ack 104559, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.408188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 104559:111859, ack 8814, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.408555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 111859:112047, ack 8814, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:15.411226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 107479, win 4380, length 0 15:01:15.414478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 110399, win 4380, length 0 15:01:15.415608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 112047, win 4380, length 0 15:01:15.415672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112047:112151, ack 8814, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.416118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8814:8859, ack 112047, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.417422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8859:8947, ack 112151, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.417506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112151:112190, ack 8947, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.419998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 8947:9049, ack 112190, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.420886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112190:112329, ack 9049, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.422476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9049:9125, ack 112329, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.423310 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112329:112401, ack 9125, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.424876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9125:9201, ack 112401, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.425705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112401:112489, ack 9201, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.427345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9201:9303, ack 112489, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.429301 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 112489:113209, ack 9303, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:15.437477 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9303:9348, ack 113209, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.438171 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 113209:113248, ack 9348, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.440555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9348:9474, ack 113248, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.441437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 113248:113387, ack 9474, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.443017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9474:9550, ack 113387, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.443948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 113387:113459, ack 9550, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.445517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9550:9626, ack 113459, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.446347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 113459:113547, ack 9626, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.448015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9626:9752, ack 113547, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.474352 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 113547:128147, ack 9752, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.477315 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 116467, win 4380, length 0 15:01:15.481953 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 119387, win 4380, length 0 15:01:15.482027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 128147:129607, ack 9752, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:15.482070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 129607:129851, ack 9752, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:15.483968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 122307, win 4380, length 0 15:01:15.486146 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 125227, win 4380, length 0 15:01:15.488392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 128147, win 4380, length 0 15:01:15.490201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 129851, win 4380, length 0 15:01:15.490268 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 129851:129955, ack 9752, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.490835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9752:9912, ack 129851, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.492054 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 9912:10000, ack 129955, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.519590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 129955:146015, ack 10000, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.519981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 146015:146375, ack 10000, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:15.522630 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 132875, win 4380, length 0 15:01:15.524715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 135795, win 4380, length 0 15:01:15.526761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 138715, win 4380, length 0 15:01:15.528978 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 141635, win 4380, length 0 15:01:15.531052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 144555, win 4380, length 0 15:01:15.533010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 146375, win 4380, length 0 15:01:15.533520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10000:10116, ack 146375, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.559283 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 146375:162435, ack 10116, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.559651 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 162435:162719, ack 10116, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:15.562357 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 149295, win 4380, length 0 15:01:15.564454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 152215, win 4380, length 0 15:01:15.566574 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 155135, win 4380, length 0 15:01:15.568797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 158055, win 4380, length 0 15:01:15.570911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 160975, win 4380, length 0 15:01:15.572766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 162719, win 4380, length 0 15:01:15.573201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10116:10157, ack 162719, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:15.574139 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 162719:162758, ack 10157, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:15.575692 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10157:10202, ack 162758, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.576404 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 162758:162797, ack 10202, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.578840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10202:10330, ack 162797, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.578923 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 162797:162901, ack 10330, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.580576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10330:10418, ack 162901, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.580665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 162901:163040, ack 10418, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.582251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10418:10494, ack 163040, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.583135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 163040:163112, ack 10494, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.585491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10494:10570, ack 163112, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.586335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 163112:163200, ack 10570, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.588400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10570:10698, ack 163200, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.595152 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 163200:166120, ack 10698, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.595388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 166120:166620, ack 10698, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:15.600400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 166120, win 4380, length 0 15:01:15.601916 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10698:10743, ack 166620, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.602630 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 166620:166659, ack 10743, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.605872 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10743:10851, ack 166659, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.606779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 166659:166798, ack 10851, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.608792 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10851:10927, ack 166798, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.609639 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 166798:166870, ack 10927, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.611367 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 10927:11003, ack 166870, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.612190 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 166870:166958, ack 11003, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.613826 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11003:11111, ack 166958, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.617595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 166958:168418, ack 11111, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:15.617804 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 168418:168854, ack 11111, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:15.621212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 168854, win 4380, length 0 15:01:15.621632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11111:11156, ack 168854, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.622286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 168854:168893, ack 11156, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.624651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11156:11282, ack 168893, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.625035 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 168893:168997, ack 11282, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.626692 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11282:11370, ack 168997, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.626778 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 168997:169136, ack 11370, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.628378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11370:11446, ack 169136, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.629225 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 169136:169208, ack 11446, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.630801 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11446:11522, ack 169208, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.631623 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 169208:169296, ack 11522, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.633263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11522:11648, ack 169296, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.635943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 169296:169996, ack 11648, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:15.643844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11648:11693, ack 169996, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.644602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 169996:170035, ack 11693, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.647026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11693:11827, ack 170035, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.647934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170035:170174, ack 11827, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.649550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11827:11903, ack 170174, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.650397 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170174:170246, ack 11903, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.651975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11903:11979, ack 170246, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.652797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170246:170334, ack 11979, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.654443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 11979:12113, ack 170334, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.655723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170334:170602, ack 12113, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:15.657462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12113:12158, ack 170602, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.658140 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170602:170641, ack 12158, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.660562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12158:12292, ack 170641, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:15.661481 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170641:170780, ack 12292, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:15.663069 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12292:12368, ack 170780, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.663975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170780:170852, ack 12368, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:15.665546 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12368:12444, ack 170852, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.665927 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170852:170956, ack 12444, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:15.667582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12444:12532, ack 170956, win 4224, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:15.667668 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 170956:171044, ack 12532, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:15.669371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12532:12666, ack 171044, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:15.671862 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 171044:171984, ack 12666, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:15.673871 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12666:12711, ack 171984, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:15.674584 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 171984:172023, ack 12711, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:15.869955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 172023, win 4370, length 0 15:01:16.205381 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [F.], seq 416, ack 453, win 5360, length 0 15:01:16.206133 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [.], ack 417, win 8191, length 0 15:01:16.412541 IP 192.168.0.10.27362 > guruplug.microsoft-ds: Flags [P.], seq 453:512, ack 417, win 8191, length 59SMB PACKET: SMBecho (REQUEST) 15:01:16.412619 IP guruplug.microsoft-ds > 192.168.0.10.27362: Flags [R], seq 1204000213, win 0, length 0 15:01:16.421847 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [S], seq 42787, win 8192, options [mss 1460], length 0 15:01:16.421946 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [S.], seq 2159240352, ack 42788, win 4380, options [mss 1460], length 0 15:01:16.431430 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1:52, ack 1, win 8192, length 51SMB PACKET: SMBnegprot (REQUEST) 15:01:16.431528 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [.], ack 52, win 4380, length 0 15:01:16.439856 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1:106, ack 52, win 4380, length 105SMB PACKET: SMBnegprot (REPLY) 15:01:16.449675 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 52:184, ack 106, win 8192, length 132SMB PACKET: SMBsesssetupX (REQUEST) 15:01:16.454430 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 106:210, ack 184, win 5360, length 104SMB PACKET: SMBsesssetupX (REPLY) 15:01:16.462853 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 184:223, ack 210, win 8192, length 39SMB PACKET: SMBtdis (REQUEST) 15:01:16.463753 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 210:249, ack 223, win 5360, length 39SMB PACKET: SMBtdis (REPLY) 15:01:16.473823 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 223:319, ack 249, win 8192, length 96SMB PACKET: SMBtconX (REQUEST) 15:01:16.477670 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 249:307, ack 319, win 5360, length 58SMB PACKET: SMBtconX (REPLY) 15:01:16.528183 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 307, win 8192, length 0 15:01:17.205650 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12711:12791, ack 172023, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.206569 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 172023:172127, ack 12791, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:17.208268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12791:12871, ack 172127, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.209162 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 172127:172215, ack 12871, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.210745 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12871:12961, ack 172215, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.211130 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 172215:172319, ack 12961, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.414342 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 172319, win 4296, length 0 15:01:17.414427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 172319:172458, ack 12961, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.416320 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 12961:13049, ack 172458, win 4261, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.453719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 13049, win 3247, length 0 15:01:17.455345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13049:13139, ack 172458, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.455406 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 13139, win 3247, length 0 15:01:17.463864 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 172458:176838, ack 13139, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.464111 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 176838:176866, ack 13139, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:17.469030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 175378, win 4380, length 0 15:01:17.470152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 176866, win 4380, length 0 15:01:17.471984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13139:13229, ack 176866, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.472858 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 176866:177005, ack 13229, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.474739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13229:13274, ack 177005, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.475462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 177005:177044, ack 13274, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.477061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13274:13364, ack 177044, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.485500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 177044:181424, ack 13364, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.485748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181424:181452, ack 13364, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:17.489857 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 179964, win 4380, length 0 15:01:17.491482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 181452, win 4380, length 0 15:01:17.492129 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13364:13409, ack 181452, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.492790 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181452:181491, ack 13409, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.499393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13409:13527, ack 181491, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.501388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181491:181630, ack 13527, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.505594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13527:13603, ack 181630, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.506489 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181630:181702, ack 13603, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.508694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13603:13679, ack 181702, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.509520 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181702:181790, ack 13679, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.511833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13679:13797, ack 181790, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.511915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 181790:181894, ack 13797, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.513502 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13797:13885, ack 181894, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.516801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 181894:183354, ack 13885, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.517005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 183354:184094, ack 13885, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:17.524821 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 184094, win 4380, length 0 15:01:17.525227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13885:13930, ack 184094, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.525879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 184094:184133, ack 13930, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.529938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 13930:14030, ack 184133, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.530818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 184133:184272, ack 14030, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.533048 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14030:14106, ack 184272, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.533935 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 184272:184344, ack 14106, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.535479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14106:14182, ack 184344, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.536339 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 184344:184432, ack 14182, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.537969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14182:14282, ack 184432, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.539680 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 184432:185012, ack 14282, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:17.545606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14282:14327, ack 185012, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.546316 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185012:185051, ack 14327, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.548585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14327:14437, ack 185051, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.549459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185051:185190, ack 14437, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.551757 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14437:14513, ack 185190, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.552592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185190:185262, ack 14513, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.554133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14513:14589, ack 185262, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.554962 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185262:185350, ack 14589, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.557168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14589:14699, ack 185350, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.558693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185350:185846, ack 14699, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:17.560506 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14699:14744, ack 185846, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.560589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185846:185950, ack 14744, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.564797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14744:14832, ack 185950, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.564879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185950:185989, ack 14832, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.568194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14832:14936, ack 185989, win 4344, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.569066 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 185989:186128, ack 14936, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.570655 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 14936:15012, ack 186128, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.571484 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 186128:186200, ack 15012, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.573029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15012:15088, ack 186200, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.573897 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 186200:186288, ack 15088, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.576251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15088:15192, ack 186288, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.595996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 186288:196508, ack 15192, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.600731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 189208, win 4380, length 0 15:01:17.600829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 196508:200888, ack 15192, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:17.614734 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 192128, win 4380, length 0 15:01:17.614815 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 200888:202348, ack 15192, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:17.614856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 202348:202688, ack 15192, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:17.615184 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 195048, win 4380, length 0 15:01:17.615594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 197968, win 4380, length 0 15:01:17.616123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 200888, win 4380, length 0 15:01:17.618830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 202688, win 4380, length 0 15:01:17.619208 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15192:15233, ack 202688, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:17.620061 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 202688:202727, ack 15233, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:17.624646 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15233:15278, ack 202727, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.625360 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 202727:202766, ack 15278, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.628155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15278:15388, ack 202766, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.629053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 202766:202905, ack 15388, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.630618 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15388:15464, ack 202905, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.631006 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 202905:203009, ack 15464, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.632590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15464:15552, ack 203009, win 4299, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.632675 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 203009:203081, ack 15552, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.634250 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15552:15628, ack 203081, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.635090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 203081:203169, ack 15628, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.636704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15628:15738, ack 203169, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.642833 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 203169:206089, ack 15738, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.643062 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 206089:206557, ack 15738, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:17.648899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 206089, win 4380, length 0 15:01:17.650325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15738:15783, ack 206557, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.651158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 206557:206596, ack 15783, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.653429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15783:15885, ack 206596, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.654361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 206596:206735, ack 15885, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.656492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15885:15961, ack 206735, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.657346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 206735:206807, ack 15961, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.658929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 15961:16037, ack 206807, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.659748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 206807:206895, ack 16037, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.662064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16037:16139, ack 206895, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.667554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 206895:209815, ack 16139, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.667782 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 209815:209907, ack 16139, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:17.672125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 209815, win 4380, length 0 15:01:17.673451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16139:16184, ack 209907, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.674161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 209907:209946, ack 16184, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.676400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16184:16280, ack 209946, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.677281 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 209946:210085, ack 16280, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.678870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16280:16356, ack 210085, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.679248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 210085:210189, ack 16356, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.680855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16356:16444, ack 210189, win 4286, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.680939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 210189:210261, ack 16444, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.683186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16444:16520, ack 210261, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.684057 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 210261:210349, ack 16520, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.685657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16520:16616, ack 210349, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.688118 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 210349:211637, ack 16616, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:17.690261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16616:16661, ack 211637, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.690986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 211637:211676, ack 16661, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.693232 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16661:16769, ack 211676, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.694251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 211676:211815, ack 16769, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.713567 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16769:16845, ack 211815, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.714444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 211815:211887, ack 16845, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.716190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16845:16921, ack 211887, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.717018 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 211887:211975, ack 16921, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.718836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 16921:17029, ack 211975, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.721811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 211975:213435, ack 17029, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.722015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213435:213443, ack 17029, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:17.725121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 213443, win 4380, length 0 15:01:17.725522 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17029:17074, ack 213443, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.726178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213443:213482, ack 17074, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.728583 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17074:17192, ack 213482, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.729460 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213482:213621, ack 17192, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.731050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17192:17268, ack 213621, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.731878 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213621:213693, ack 17268, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.733429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17268:17344, ack 213693, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.733829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213693:213797, ack 17344, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.735408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17344:17432, ack 213797, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.735492 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 213797:213885, ack 17432, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.737149 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17432:17550, ack 213885, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.742594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 213885:215345, ack 17550, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.742803 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 215345:216653, ack 17550, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:17.746111 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 216653, win 4380, length 0 15:01:17.746575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17550:17595, ack 216653, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.747272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 216653:216692, ack 17595, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.750170 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17595:17697, ack 216692, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.751045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 216692:216831, ack 17697, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.752627 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17697:17773, ack 216831, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.753457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 216831:216903, ack 17773, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.754999 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17773:17849, ack 216903, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.755823 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 216903:216991, ack 17849, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.757421 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17849:17951, ack 216991, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.771039 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 216991:224291, ack 17951, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.771305 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224291:224479, ack 17951, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:17.774704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 219911, win 4380, length 0 15:01:17.777464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 222831, win 4380, length 0 15:01:17.780279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 224479, win 4380, length 0 15:01:17.780640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17951:17996, ack 224479, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.781314 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224479:224518, ack 17996, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.784567 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 17996:18098, ack 224518, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.785466 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224518:224657, ack 18098, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.787027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18098:18174, ack 224657, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.787868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224657:224729, ack 18174, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.789661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18174:18250, ack 224729, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.789742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224729:224833, ack 18250, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.791327 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18250:18338, ack 224833, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.791409 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224833:224921, ack 18338, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.793038 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18338:18440, ack 224921, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.795134 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 224921:225641, ack 18440, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:17.798683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18440:18485, ack 225641, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.799370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 225641:225680, ack 18485, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.805847 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18485:18611, ack 225680, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.806742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 225680:225819, ack 18611, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.808322 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18611:18687, ack 225819, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.809206 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 225819:225891, ack 18687, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.810775 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18687:18763, ack 225891, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.811590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 225891:225979, ack 18763, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.813199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18763:18889, ack 225979, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.839723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 225979:240579, ack 18889, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.845295 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 228899, win 4380, length 0 15:01:17.852795 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 231819, win 4380, length 0 15:01:17.852868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 240579:242039, ack 18889, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:17.852912 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 242039:242283, ack 18889, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:17.855694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 234739, win 4380, length 0 15:01:17.859613 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 237659, win 4380, length 0 15:01:17.868031 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 240579, win 4380, length 0 15:01:17.868386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 242283, win 4380, length 0 15:01:17.868894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 18889:19049, ack 242283, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.895488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 242283:258343, ack 19049, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.895839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 258343:258703, ack 19049, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:17.900122 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 245203, win 4380, length 0 15:01:17.913504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 248123, win 4380, length 0 15:01:17.913979 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 251043, win 4380, length 0 15:01:17.915619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 253963, win 4380, length 0 15:01:17.918355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 256883, win 4380, length 0 15:01:17.920272 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 258703, win 4380, length 0 15:01:17.920339 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 258703:258807, ack 19049, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.920880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19049:19165, ack 258703, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.922155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19165:19253, ack 258807, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.946732 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 258807:274867, ack 19253, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.947069 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 274867:275151, ack 19253, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:17.950466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 261727, win 4380, length 0 15:01:17.955967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 264647, win 4380, length 0 15:01:17.958928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 267567, win 4380, length 0 15:01:17.962724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 270487, win 4380, length 0 15:01:17.967386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 273407, win 4380, length 0 15:01:17.970160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 275151, win 4380, length 0 15:01:17.970578 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19253:19294, ack 275151, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:17.971437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 275151:275190, ack 19294, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:17.972959 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19294:19339, ack 275190, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.973641 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 275190:275229, ack 19339, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:17.976065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19339:19467, ack 275229, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:17.976994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 275229:275368, ack 19467, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:17.979108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19467:19543, ack 275368, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.979949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 275368:275440, ack 19543, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:17.981504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19543:19619, ack 275440, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.982361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 275440:275528, ack 19619, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:17.983972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19619:19747, ack 275528, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:17.990410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 275528:278448, ack 19747, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:17.990659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 278448:278948, ack 19747, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:17.994924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 278448, win 4380, length 0 15:01:17.997467 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19747:19792, ack 278948, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:17.997539 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 278948:279052, ack 19792, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:17.999145 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19792:19880, ack 279052, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:17.999227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 279052:279091, ack 19880, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:18.001507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19880:19988, ack 279091, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:18.002792 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 279091:279230, ack 19988, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:18.004361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 19988:20064, ack 279230, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.006306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 279230:279302, ack 20064, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:18.008480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20064:20140, ack 279302, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.009347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 279302:279390, ack 20140, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.011476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20140:20248, ack 279390, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.015647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 279390:280850, ack 20248, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:18.015863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 280850:281286, ack 20248, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:18.019157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 281286, win 4380, length 0 15:01:18.019614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20248:20293, ack 281286, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:18.020304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 281286:281325, ack 20293, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:18.022600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20293:20419, ack 281325, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:18.023505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 281325:281464, ack 20419, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:18.025724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20419:20495, ack 281464, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.026638 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 281464:281536, ack 20495, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:18.029589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20495:20571, ack 281536, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.030424 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 281536:281624, ack 20571, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.032035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20571:20697, ack 281624, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.034179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 281624:282324, ack 20697, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:18.037127 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20697:20742, ack 282324, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:18.037519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282324:282428, ack 20742, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:18.043549 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20742:20830, ack 282428, win 4094, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:18.043632 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282428:282467, ack 20830, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:18.046012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20830:20964, ack 282467, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:18.046910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282467:282606, ack 20964, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:18.049882 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 20964:21040, ack 282606, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.050721 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282606:282678, ack 21040, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:18.052266 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21040:21116, ack 282678, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.053092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282678:282766, ack 21116, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.056837 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21116:21250, ack 282766, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.058158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 282766:283034, ack 21250, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:18.060490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21250:21295, ack 283034, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:18.061178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 283034:283073, ack 21295, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:18.063468 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21295:21429, ack 283073, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:18.064398 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 283073:283212, ack 21429, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:18.066626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21429:21505, ack 283212, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.067498 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 283212:283284, ack 21505, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:18.069719 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21505:21581, ack 283284, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.070550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 283284:283372, ack 21581, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.072160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21581:21715, ack 283372, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.074713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 283372:284312, ack 21715, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:18.077395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21715:21760, ack 284312, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:18.078095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 284312:284351, ack 21760, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:18.272383 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 284351, win 4370, length 0 15:01:18.380166 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 319:405, ack 307, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.381690 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 307:407, ack 405, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:18.391491 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 405:491, ack 407, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.393321 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 407:495, ack 491, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.393876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 284351:284455, ack 21760, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:18.395707 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21760:21848, ack 284455, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:18.402592 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 491:579, ack 495, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.403601 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 495:595, ack 579, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:18.413592 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 579:667, ack 595, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:18.414562 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 595:683, ack 667, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:18.423913 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 667:772, ack 683, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:18.424776 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 683:722, ack 772, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:18.433714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 21848, win 3247, length 0 15:01:18.494295 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 722, win 8192, length 0 15:01:19.918316 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21848:21928, ack 284455, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:19.918430 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 21928, win 3247, length 0 15:01:19.919446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 284455:284559, ack 21928, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:19.921244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 21928:22008, ack 284559, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:19.922120 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 284559:284647, ack 22008, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:19.923719 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22008:22098, ack 284647, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:19.924615 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 284647:284786, ack 22098, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:19.926290 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22098:22188, ack 284786, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:19.934809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 284786:289166, ack 22188, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:19.935049 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 289166:289194, ack 22188, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:19.937785 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 287706, win 4380, length 0 15:01:19.939777 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 289194, win 4380, length 0 15:01:19.941592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22188:22278, ack 289194, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:19.942448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 289194:289333, ack 22278, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:19.944371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22278:22323, ack 289333, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:19.945074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 289333:289372, ack 22323, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:19.946669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22323:22413, ack 289372, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:19.947065 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 289372:289476, ack 22413, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:19.955530 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 289476:293856, ack 22413, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:19.960103 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 290936, win 4380, length 0 15:01:19.960191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 293856:293884, ack 22413, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:19.960537 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 293856, win 4380, length 0 15:01:19.961764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22413:22501, ack 293884, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:19.993712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 22501, win 3247, length 0 15:01:19.995442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22501:22546, ack 293884, win 4373, length 45SMB PACKET: SMBclose (REQUEST) 15:01:19.995652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 22546, win 3247, length 0 15:01:19.996271 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 293884:293923, ack 22546, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:19.998668 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22546:22664, ack 293923, win 4363, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:19.999559 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 293923:294062, ack 22664, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.002443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22664:22740, ack 294062, win 4328, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.004107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 294062:294134, ack 22740, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.005846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22740:22816, ack 294134, win 4310, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.006853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 294134:294222, ack 22816, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.008530 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22816:22934, ack 294222, win 4288, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.013076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 294222:295682, ack 22934, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.013286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 295682:296422, ack 22934, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:20.015834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 296422, win 4380, length 0 15:01:20.016338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22934:22979, ack 296422, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.017029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296422:296461, ack 22979, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.019356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 22979:23079, ack 296461, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.020249 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296461:296600, ack 23079, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.021935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23079:23155, ack 296600, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.022822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296600:296672, ack 23155, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.024462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23155:23231, ack 296672, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.024845 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296672:296776, ack 23231, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.026472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23231:23319, ack 296776, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.026556 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296776:296864, ack 23319, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.028262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23319:23419, ack 296864, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.030002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 296864:297444, ack 23419, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:20.031868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23419:23464, ack 297444, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.032555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 297444:297483, ack 23464, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.034867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23464:23574, ack 297483, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.035753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 297483:297622, ack 23574, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.037355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23574:23650, ack 297622, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.038194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 297622:297694, ack 23650, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.039803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23650:23726, ack 297694, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.040619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 297694:297782, ack 23726, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.042259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23726:23836, ack 297782, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.043926 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 297782:298278, ack 23836, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:20.045745 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23836:23881, ack 298278, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.046441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 298278:298317, ack 23881, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.048745 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23881:23985, ack 298317, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.049616 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 298317:298456, ack 23985, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.051300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 23985:24061, ack 298456, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.052130 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 298456:298528, ack 24061, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.053884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24061:24137, ack 298528, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.054722 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 298528:298616, ack 24137, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.056377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24137:24241, ack 298616, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.076261 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 298616:308836, ack 24241, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.079244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 301536, win 4380, length 0 15:01:20.079343 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 308836:313216, ack 24241, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:20.081464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 304456, win 4380, length 0 15:01:20.081548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 313216:314676, ack 24241, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:20.081594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 314676:315120, ack 24241, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:01:20.083634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 307376, win 4380, length 0 15:01:20.085893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 310296, win 4380, length 0 15:01:20.088070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 313216, win 4380, length 0 15:01:20.090068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 315120, win 4380, length 0 15:01:20.090457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24241:24282, ack 315120, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:20.090969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24282:24370, ack 315120, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.091645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 315120:315159, ack 24370, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:20.093227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24370:24415, ack 315159, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.094042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 315159:315198, ack 24415, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.096358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24415:24525, ack 315198, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.097256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 315198:315337, ack 24525, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.098878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24525:24601, ack 315337, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.099720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 315337:315409, ack 24601, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.101303 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24601:24677, ack 315409, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.102114 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 315409:315497, ack 24677, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.104828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24677:24787, ack 315497, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.110986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 315497:318417, ack 24787, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.111223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 318417:318885, ack 24787, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:20.113961 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 318417, win 4380, length 0 15:01:20.115458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24787:24832, ack 318885, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.116137 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 318885:318924, ack 24832, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.118510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24832:24934, ack 318924, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.119383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 318924:319063, ack 24934, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.120997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 24934:25010, ack 319063, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.121374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 319063:319167, ack 25010, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.122987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25010:25098, ack 319167, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.123071 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 319167:319239, ack 25098, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.124678 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25098:25174, ack 319239, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.125519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 319239:319327, ack 25174, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.127168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25174:25276, ack 319327, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.132554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 319327:322247, ack 25276, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.132786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322247:322339, ack 25276, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:20.135493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 322247, win 4380, length 0 15:01:20.136764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25276:25321, ack 322339, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.137433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322339:322378, ack 25321, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.139758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25321:25417, ack 322378, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.140634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322378:322517, ack 25417, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.142241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25417:25493, ack 322517, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.143079 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322517:322589, ack 25493, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.144674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25493:25569, ack 322589, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.145512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322589:322677, ack 25569, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.147143 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25569:25665, ack 322677, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.149644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 322677:323965, ack 25665, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:20.152686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25665:25710, ack 323965, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.153373 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 323965:324004, ack 25710, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.155661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25710:25818, ack 324004, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.156546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 324004:324143, ack 25818, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.158166 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25818:25894, ack 324143, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.158998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 324143:324215, ack 25894, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.160712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25894:25970, ack 324215, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.161078 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 324215:324319, ack 25970, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.178482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 25970:26058, ack 324319, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.178567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 324319:324407, ack 26058, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.182824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26058:26166, ack 324407, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.185886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 324407:325867, ack 26166, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.186089 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 325867:325875, ack 26166, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:20.188534 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 325875, win 4380, length 0 15:01:20.188938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26166:26211, ack 325875, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.189653 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 325875:325914, ack 26211, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.191993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26211:26329, ack 325914, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.192872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 325914:326053, ack 26329, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.194464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26329:26405, ack 326053, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.195326 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 326053:326125, ack 26405, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.196903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26405:26481, ack 326125, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.197727 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 326125:326213, ack 26481, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.199394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26481:26599, ack 326213, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.204920 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 326213:327673, ack 26599, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.205129 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 327673:328981, ack 26599, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:20.208048 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 328981, win 4380, length 0 15:01:20.208505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26599:26644, ack 328981, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.209166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 328981:329020, ack 26644, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.211495 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26644:26746, ack 329020, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.212364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 329020:329159, ack 26746, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.213962 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26746:26822, ack 329159, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.214809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 329159:329231, ack 26822, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.216383 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26822:26898, ack 329231, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.216748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 329231:329335, ack 26898, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.218408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26898:26986, ack 329335, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.218492 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 329335:329423, ack 26986, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.220235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 26986:27088, ack 329423, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.233913 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 329423:336723, ack 27088, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.234174 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 336723:336911, ack 27088, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:20.236903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 332343, win 4380, length 0 15:01:20.239105 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 335263, win 4380, length 0 15:01:20.240970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 336911, win 4380, length 0 15:01:20.241406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27088:27133, ack 336911, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.242083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 336911:336950, ack 27133, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.244475 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27133:27235, ack 336950, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.245387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 336950:337089, ack 27235, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.246998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27235:27311, ack 337089, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.247846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 337089:337161, ack 27311, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.249457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27311:27387, ack 337161, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.250274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 337161:337249, ack 27387, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.251924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27387:27489, ack 337249, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.253950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 337249:337969, ack 27489, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:20.262059 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27489:27534, ack 337969, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.262743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 337969:338008, ack 27534, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.265127 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27534:27660, ack 338008, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.266058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 338008:338147, ack 27660, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.267672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27660:27736, ack 338147, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.268510 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 338147:338219, ack 27736, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.270661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27736:27812, ack 338219, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.271473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 338219:338307, ack 27812, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.273115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27812:27938, ack 338307, win 4031, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.273195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 338307:338411, ack 27938, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.274822 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 27938:28026, ack 338411, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.299981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 338411:353011, ack 28026, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.302989 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 341331, win 4380, length 0 15:01:20.305191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 344251, win 4380, length 0 15:01:20.305272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 353011:354471, ack 28026, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:20.305316 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 354471:354715, ack 28026, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:20.307413 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 347171, win 4380, length 0 15:01:20.311169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 350091, win 4380, length 0 15:01:20.313363 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 353011, win 4380, length 0 15:01:20.315321 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 354715, win 4380, length 0 15:01:20.335636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28026:28186, ack 354715, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.361934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 354715:370775, ack 28186, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.362287 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 370775:371135, ack 28186, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:20.365006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 357635, win 4380, length 0 15:01:20.367100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 360555, win 4380, length 0 15:01:20.369219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 363475, win 4380, length 0 15:01:20.371442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 366395, win 4380, length 0 15:01:20.373620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 369315, win 4380, length 0 15:01:20.375480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 371135, win 4380, length 0 15:01:20.376117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28186:28302, ack 371135, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.401702 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 371135:387195, ack 28302, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.402038 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387195:387479, ack 28302, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:20.404762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 374055, win 4380, length 0 15:01:20.406805 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 376975, win 4380, length 0 15:01:20.408923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 379895, win 7300, length 0 15:01:20.415247 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 382815, win 7300, length 0 15:01:20.415743 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 385735, win 7300, length 0 15:01:20.417730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 387479, win 7300, length 0 15:01:20.418229 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28302:28343, ack 387479, win 7300, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:20.418606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387479:387583, ack 28343, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.420247 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28343:28431, ack 387583, win 7274, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.420335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387583:387622, ack 28431, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:20.421903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28431:28476, ack 387622, win 7264, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.423065 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387622:387661, ack 28476, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.425628 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28476:28604, ack 387661, win 7254, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.426610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387661:387800, ack 28604, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.428216 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28604:28680, ack 387800, win 7219, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.429100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387800:387872, ack 28680, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.430681 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28680:28756, ack 387872, win 7201, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.431518 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 387872:387960, ack 28756, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.433162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28756:28884, ack 387960, win 7179, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.439743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 387960:390880, ack 28884, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.439979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 390880:391380, ack 28884, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:20.442582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 390880, win 6449, length 0 15:01:20.444085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28884:28929, ack 391380, win 6324, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.444771 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 391380:391419, ack 28929, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.447169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 28929:29037, ack 391419, win 6315, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.448057 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 391419:391558, ack 29037, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.449672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29037:29113, ack 391558, win 6280, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.450517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 391558:391630, ack 29113, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.452092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29113:29189, ack 391630, win 6262, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.452907 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 391630:391718, ack 29189, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.454563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29189:29297, ack 391718, win 6240, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.458379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 391718:393178, ack 29297, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:20.458588 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393178:393614, ack 29297, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:20.461045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 393614, win 5766, length 0 15:01:20.461134 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393614:393718, ack 29297, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.461488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29297:29342, ack 393614, win 5766, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.462761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29342:29430, ack 393718, win 5740, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.462844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393718:393757, ack 29430, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.465226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29430:29556, ack 393757, win 5730, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.466125 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393757:393896, ack 29556, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.467759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29556:29632, ack 393896, win 5695, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.468599 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393896:393968, ack 29632, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.470196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29632:29708, ack 393968, win 5677, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.471010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 393968:394056, ack 29708, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.472699 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29708:29834, ack 394056, win 5655, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.474792 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 394056:394756, ack 29834, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:20.482739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29834:29879, ack 394756, win 5480, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.483428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 394756:394795, ack 29879, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.485808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 29879:30013, ack 394795, win 5471, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.486744 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 394795:394934, ack 30013, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.488363 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30013:30089, ack 394934, win 5436, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.489214 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 394934:395006, ack 30089, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.490799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30089:30165, ack 395006, win 5418, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.491622 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395006:395094, ack 30165, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.493274 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30165:30299, ack 395094, win 5396, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.494579 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395094:395362, ack 30299, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:20.496937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30299:30344, ack 395362, win 5329, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.497629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395362:395401, ack 30344, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.500043 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30344:30478, ack 395401, win 5319, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:20.500915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395401:395540, ack 30478, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:20.502505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30478:30554, ack 395540, win 5284, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.502602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395540:395644, ack 30554, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:20.504267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30554:30642, ack 395644, win 5258, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:20.504374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395644:395716, ack 30642, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:20.505985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30642:30718, ack 395716, win 5240, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.507413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395716:395804, ack 30718, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:20.509093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30718:30852, ack 395804, win 5218, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:20.511679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 395804:396744, ack 30852, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:20.514544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30852:30897, ack 396744, win 4983, length 45SMB PACKET: SMBclose (REQUEST) 15:01:20.515271 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 396744:396783, ack 30897, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:20.705897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 396783, win 4974, length 0 15:01:21.053883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30897:30936, ack 396783, win 4974, length 39SMB PACKET: SMBtdis (REQUEST) 15:01:21.055372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 396783:396822, ack 30936, win 3247, length 39SMB PACKET: SMBtdis (REPLY) 15:01:21.252057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 396822, win 4964, length 0 15:01:21.433826 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 772:831, ack 722, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:21.434437 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 722:781, ack 831, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:21.443471 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 781, win 8192, length 0 15:01:22.040856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 30936:31026, ack 396822, win 4964, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.042108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 396822:396961, ack 31026, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.043892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31026:31106, ack 396961, win 4929, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.044797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 396961:397065, ack 31106, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:22.046319 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31106:31186, ack 397065, win 4903, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.047165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 397065:397153, ack 31186, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.050316 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31186:31276, ack 397153, win 4881, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.058791 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 397153:401533, ack 31276, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.059042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 401533:401561, ack 31276, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:22.063292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 400073, win 4151, length 0 15:01:22.065799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 401561, win 4380, length 0 15:01:22.065889 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 401561:401665, ack 31276, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.067883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31276:31366, ack 401665, win 4354, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.068813 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 401665:401804, ack 31366, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.070518 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31366:31454, ack 401804, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.103708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 31454, win 3247, length 0 15:01:22.105302 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31454:31544, ack 401804, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.105368 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 31544, win 3247, length 0 15:01:22.113786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 401804:406184, ack 31544, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.114032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406184:406212, ack 31544, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:22.117742 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 404724, win 4380, length 0 15:01:22.119660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 406212, win 4380, length 0 15:01:22.120025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31544:31589, ack 406212, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.120719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406212:406251, ack 31589, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.122481 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31589:31634, ack 406251, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.123161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406251:406290, ack 31634, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.125510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31634:31752, ack 406290, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.126405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406290:406429, ack 31752, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.128141 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31752:31828, ack 406429, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.128974 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406429:406501, ack 31828, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.130714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31828:31904, ack 406501, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.131522 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 406501:406589, ack 31904, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.133380 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 31904:32022, ack 406589, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.137949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 406589:408049, ack 32022, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.138156 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 408049:408789, ack 32022, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:22.140778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 408789, win 4380, length 0 15:01:22.141189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32022:32067, ack 408789, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.141854 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 408789:408828, ack 32067, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.144161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32067:32167, ack 408828, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.144247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 408828:408932, ack 32167, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.145937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32167:32255, ack 408932, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.146025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 408932:409071, ack 32255, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.147599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32255:32331, ack 409071, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.148437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409071:409143, ack 32331, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.150057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32331:32407, ack 409143, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.150876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409143:409231, ack 32407, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.152927 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32407:32507, ack 409231, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.154729 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409231:409811, ack 32507, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:22.156587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32507:32552, ack 409811, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.157272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409811:409850, ack 32552, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.159610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32552:32662, ack 409850, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.160482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409850:409989, ack 32662, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.162091 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32662:32738, ack 409989, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.163101 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 409989:410061, ack 32738, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.164686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32738:32814, ack 410061, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.165517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410061:410149, ack 32814, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.167174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32814:32924, ack 410149, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.168716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410149:410645, ack 32924, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:22.170561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32924:32969, ack 410645, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.171238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410645:410684, ack 32969, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.173525 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 32969:33073, ack 410684, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.174437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410684:410823, ack 33073, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.176053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33073:33149, ack 410823, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.176891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410823:410895, ack 33149, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.179090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33149:33225, ack 410895, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.179170 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410895:410999, ack 33225, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.181539 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33225:33313, ack 410999, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.181622 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 410999:411087, ack 33313, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.183307 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33313:33417, ack 411087, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.203068 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 411087:421307, ack 33417, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.207844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 414007, win 4380, length 0 15:01:22.207944 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 421307:425687, ack 33417, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:22.210833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 416927, win 4380, length 0 15:01:22.210904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 425687:427147, ack 33417, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:22.210944 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427147:427487, ack 33417, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:22.213006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 419847, win 4380, length 0 15:01:22.215978 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 422767, win 4380, length 0 15:01:22.219113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 425687, win 4380, length 0 15:01:22.221186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 427487, win 4380, length 0 15:01:22.221644 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33417:33458, ack 427487, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:22.222486 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427487:427526, ack 33458, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:22.224029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33458:33503, ack 427526, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.224740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427526:427565, ack 33503, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.227044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33503:33613, ack 427565, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.227936 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427565:427704, ack 33613, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.229564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33613:33689, ack 427704, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.230400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427704:427776, ack 33689, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.231977 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33689:33765, ack 427776, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.232788 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 427776:427864, ack 33765, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.234426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33765:33875, ack 427864, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.240595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 427864:430784, ack 33875, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.240933 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 430784:431252, ack 33875, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:22.243458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 430784, win 4380, length 0 15:01:22.246303 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33875:33920, ack 431252, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.246377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 431252:431356, ack 33920, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.248027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 33920:34008, ack 431356, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.248111 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 431356:431395, ack 34008, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.250471 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34008:34110, ack 431395, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.251389 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 431395:431534, ack 34110, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.253001 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34110:34186, ack 431534, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.253891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 431534:431606, ack 34186, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.255864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34186:34262, ack 431606, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.256694 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 431606:431694, ack 34262, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.258395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34262:34364, ack 431694, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.263820 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 431694:434614, ack 34364, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.264043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 434614:434706, ack 34364, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:22.266820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 434614, win 4380, length 0 15:01:22.268163 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34364:34409, ack 434706, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.268868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 434706:434745, ack 34409, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.271216 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34409:34505, ack 434745, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.272091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 434745:434884, ack 34505, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.273704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34505:34581, ack 434884, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.274557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 434884:434956, ack 34581, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.276157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34581:34657, ack 434956, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.276962 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 434956:435044, ack 34657, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.278617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34657:34753, ack 435044, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.281053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 435044:436332, ack 34753, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:22.283257 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34753:34798, ack 436332, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.283643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 436332:436436, ack 34798, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.285284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34798:34886, ack 436436, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.285371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 436436:436475, ack 34886, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.287687 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34886:34994, ack 436475, win 4344, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.288553 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 436475:436614, ack 34994, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.290189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 34994:35070, ack 436614, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.291058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 436614:436686, ack 35070, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.292636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35070:35146, ack 436686, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.293453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 436686:436774, ack 35146, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.295091 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35146:35254, ack 436774, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.298094 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 436774:438234, ack 35254, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.298301 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 438234:438242, ack 35254, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:22.300667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 438242, win 4380, length 0 15:01:22.301082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35254:35299, ack 438242, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.301742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 438242:438281, ack 35299, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.304065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35299:35417, ack 438281, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.304958 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 438281:438420, ack 35417, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.306559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35417:35493, ack 438420, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.307398 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 438420:438492, ack 35493, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.309070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35493:35569, ack 438492, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.309887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 438492:438580, ack 35569, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.311526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35569:35687, ack 438580, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.317027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 438580:440040, ack 35687, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.317232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 440040:441348, ack 35687, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:22.319822 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 441348, win 4380, length 0 15:01:22.320257 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35687:35732, ack 441348, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.320600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 441348:441452, ack 35732, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.322251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35732:35820, ack 441452, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.322334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 441452:441491, ack 35820, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.324606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35820:35922, ack 441491, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.325494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 441491:441630, ack 35922, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.327099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35922:35998, ack 441630, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.327964 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 441630:441702, ack 35998, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.329576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 35998:36074, ack 441702, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.330391 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 441702:441790, ack 36074, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.332677 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36074:36176, ack 441790, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.346354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 441790:449090, ack 36176, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.346628 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449090:449278, ack 36176, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:22.350798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 444710, win 4380, length 0 15:01:22.351198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 447630, win 4380, length 0 15:01:22.353213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 449278, win 4380, length 0 15:01:22.367304 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36176:36221, ack 449278, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.368005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449278:449317, ack 36221, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.370446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36221:36323, ack 449317, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.371331 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449317:449456, ack 36323, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.373059 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36323:36399, ack 449456, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.374003 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449456:449528, ack 36399, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.375737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36399:36475, ack 449528, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.376566 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449528:449616, ack 36475, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.378238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36475:36577, ack 449616, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.380191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 449616:450336, ack 36577, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:22.382370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36577:36622, ack 450336, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.383059 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 450336:450375, ack 36622, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.385405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36622:36748, ack 450375, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.385487 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 450375:450479, ack 36748, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.390063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36748:36836, ack 450479, win 4079, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.390163 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 450479:450618, ack 36836, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.391862 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36836:36912, ack 450618, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.392735 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 450618:450690, ack 36912, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.394382 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36912:36988, ack 450690, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.395278 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 450690:450778, ack 36988, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.396961 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 36988:37114, ack 450778, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.423537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 450778:465378, ack 37114, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.426520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 453698, win 4380, length 0 15:01:22.428601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 456618, win 4380, length 0 15:01:22.428675 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 465378:466838, ack 37114, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:22.428719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 466838:467082, ack 37114, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:22.433974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 459538, win 4380, length 0 15:01:22.434390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 462458, win 4380, length 0 15:01:22.435789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 465378, win 4380, length 0 15:01:22.437817 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 467082, win 4380, length 0 15:01:22.438394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37114:37274, ack 467082, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.464687 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 467082:483142, ack 37274, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.465045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 483142:483502, ack 37274, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:22.467739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 470002, win 4380, length 0 15:01:22.469907 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 472922, win 4380, length 0 15:01:22.472072 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 475842, win 4380, length 0 15:01:22.474196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 478762, win 4380, length 0 15:01:22.477089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 481682, win 4380, length 0 15:01:22.479116 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 483502, win 4380, length 0 15:01:22.479643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37274:37390, ack 483502, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.505253 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 483502:499562, ack 37390, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.505708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 499562:499846, ack 37390, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:22.509056 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 486422, win 4380, length 0 15:01:22.510386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 489342, win 4380, length 0 15:01:22.512464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 492262, win 4380, length 0 15:01:22.516839 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 495182, win 4380, length 0 15:01:22.517237 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 498102, win 4380, length 0 15:01:22.518544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 499846, win 4380, length 0 15:01:22.518616 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 499846:499950, ack 37390, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.521588 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37390:37431, ack 499950, win 4354, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:22.522534 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 499950:499989, ack 37431, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:22.524047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37431:37519, ack 499950, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.524442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37519:37564, ack 499989, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.525074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 37564, win 3247, length 0 15:01:22.525693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 499989:500028, ack 37564, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.528183 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37564:37692, ack 500028, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.529134 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 500028:500167, ack 37692, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.530867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37692:37768, ack 500167, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.531716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 500167:500239, ack 37768, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.533361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37768:37844, ack 500239, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.534238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 500239:500327, ack 37844, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.535911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37844:37972, ack 500327, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.542387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 500327:503247, ack 37972, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.542632 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 503247:503747, ack 37972, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:22.545744 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 503247, win 4380, length 0 15:01:22.546231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 37972:38017, ack 503747, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.546911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 503747:503786, ack 38017, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.549291 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38017:38125, ack 503786, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.550175 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 503786:503925, ack 38125, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.551789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38125:38201, ack 503925, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.551873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 503925:504029, ack 38201, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.553484 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38201:38289, ack 504029, win 4184, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.553568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 504029:504101, ack 38289, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.555199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38289:38365, ack 504101, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.556030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 504101:504189, ack 38365, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.557694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38365:38473, ack 504189, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.561480 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 504189:505649, ack 38473, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:22.561685 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 505649:506085, ack 38473, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:22.671812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 506085, win 4380, length 0 15:01:22.672285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38473:38518, ack 506085, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.672964 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 506085:506124, ack 38518, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.675454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38518:38644, ack 506124, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.676364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 506124:506263, ack 38644, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.677985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38644:38720, ack 506263, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.678824 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 506263:506335, ack 38720, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.680410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38720:38796, ack 506335, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.681223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 506335:506423, ack 38796, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.682868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38796:38922, ack 506423, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.685015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 506423:507123, ack 38922, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:22.687228 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38922:38967, ack 507123, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.687927 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507123:507162, ack 38967, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.690288 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 38967:39101, ack 507162, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.691171 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507162:507301, ack 39101, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.692858 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39101:39177, ack 507301, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.693779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507301:507373, ack 39177, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.695509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39177:39253, ack 507373, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.695590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507373:507477, ack 39253, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:22.697216 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39253:39341, ack 507477, win 4032, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:22.697297 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507477:507565, ack 39341, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.699004 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39341:39475, ack 507565, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.700275 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507565:507833, ack 39475, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:22.702003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39475:39520, ack 507833, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.702692 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507833:507872, ack 39520, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.705060 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39520:39654, ack 507872, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:22.705955 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 507872:508011, ack 39654, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:22.707569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39654:39730, ack 508011, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.708407 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 508011:508083, ack 39730, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:22.710017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39730:39806, ack 508083, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.710835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 508083:508171, ack 39806, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:22.712481 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39806:39940, ack 508171, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:22.715043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 508171:509111, ack 39940, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:22.717065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39940:39985, ack 509111, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:22.717756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 509111:509150, ack 39985, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:22.921125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 509150, win 4370, length 0 15:01:23.400226 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 831:917, ack 781, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:23.401423 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 781:881, ack 917, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:23.409585 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 881, win 8192, length 0 15:01:23.411375 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 917:1003, ack 881, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:23.412417 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 881:969, ack 1003, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:23.421664 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1003:1091, ack 969, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:23.422621 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 969:1069, ack 1091, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:23.432503 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1091:1179, ack 1069, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:23.433439 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1069:1157, ack 1179, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:23.433856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 509150:509254, ack 39985, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:23.442788 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1179:1284, ack 1157, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:23.443599 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1157:1196, ack 1284, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:23.519662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 39985:40073, ack 509254, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:23.553718 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 40073, win 3247, length 0 15:01:23.573423 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 1196, win 8192, length 0 15:01:25.036471 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40073:40163, ack 509254, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.036584 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 40163, win 3247, length 0 15:01:25.037621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 509254:509393, ack 40163, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.039530 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40163:40243, ack 509393, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.040419 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 509393:509497, ack 40243, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:25.041983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40243:40323, ack 509497, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.042817 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 509497:509585, ack 40323, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.044401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40323:40413, ack 509585, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.052789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 509585:513965, ack 40413, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.053032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 513965:513993, ack 40413, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:25.055741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 512505, win 4380, length 0 15:01:25.057563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 513993, win 4380, length 0 15:01:25.059400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40413:40503, ack 513993, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.060257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 513993:514132, ack 40503, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.062193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40503:40548, ack 514132, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.062887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 514132:514171, ack 40548, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.064473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40548:40638, ack 514171, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.072925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 514171:518551, ack 40638, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.073165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518551:518579, ack 40638, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:25.075919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 517091, win 4380, length 0 15:01:25.077843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 518579, win 4380, length 0 15:01:25.078831 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40638:40683, ack 518579, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.079388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518579:518683, ack 40683, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.276726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 518683, win 4354, length 0 15:01:25.276824 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518683:518722, ack 40683, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.294676 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40683:40771, ack 518722, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.295505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40771:40889, ack 518722, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.295751 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 40889, win 3247, length 0 15:01:25.296578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518722:518861, ack 40889, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.298255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40889:40965, ack 518861, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.299113 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518861:518933, ack 40965, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.302026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 40965:41041, ack 518933, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.302855 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 518933:519021, ack 41041, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.304880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41041:41159, ack 519021, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.309426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 519021:520481, ack 41159, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.309634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 520481:521221, ack 41159, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:25.312176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 521221, win 4380, length 0 15:01:25.312587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41159:41204, ack 521221, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.313478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 521221:521260, ack 41204, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.315909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41204:41304, ack 521260, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.317053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 521260:521399, ack 41304, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.318674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41304:41380, ack 521399, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.319536 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 521399:521471, ack 41380, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.321144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41380:41456, ack 521471, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.321969 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 521471:521559, ack 41456, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.324830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41456:41556, ack 521559, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.326572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 521559:522139, ack 41556, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:25.328521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41556:41601, ack 522139, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.329210 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522139:522178, ack 41601, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.331563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41601:41711, ack 522178, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.331644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522178:522282, ack 41711, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.333342 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41711:41799, ack 522282, win 4114, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.333427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522282:522421, ack 41799, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.335010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41799:41875, ack 522421, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.335902 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522421:522493, ack 41875, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.337451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41875:41951, ack 522493, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.338279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522493:522581, ack 41951, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.339924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 41951:42061, ack 522581, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.341479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 522581:523077, ack 42061, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:25.343255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42061:42106, ack 523077, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.344016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 523077:523116, ack 42106, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.346330 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42106:42210, ack 523116, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.347205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 523116:523255, ack 42210, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.348776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42210:42286, ack 523255, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.349616 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 523255:523327, ack 42286, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.351160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42286:42362, ack 523327, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.351981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 523327:523415, ack 42362, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.353582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42362:42466, ack 523415, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.373242 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 523415:533635, ack 42466, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.376974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 526335, win 4380, length 0 15:01:25.377071 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 533635:538015, ack 42466, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:25.379075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 529255, win 4380, length 0 15:01:25.379148 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 538015:539475, ack 42466, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:25.379188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 539475:539815, ack 42466, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:25.381231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 532175, win 4380, length 0 15:01:25.384238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 535095, win 4380, length 0 15:01:25.386376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 538015, win 4380, length 0 15:01:25.388449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 539815, win 4380, length 0 15:01:25.388516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 539815:539919, ack 42466, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.388919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42466:42507, ack 539815, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:25.390177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42507:42595, ack 539919, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.390264 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 539919:539958, ack 42595, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:25.391796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42595:42640, ack 539958, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.392471 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 539958:539997, ack 42640, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.394799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42640:42750, ack 539997, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.395709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 539997:540136, ack 42750, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.397258 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42750:42826, ack 540136, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.398102 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 540136:540208, ack 42826, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.399689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42826:42902, ack 540208, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.400506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 540208:540296, ack 42902, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.402128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 42902:43012, ack 540296, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.408378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 540296:543216, ack 43012, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.408606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 543216:543684, ack 43012, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:25.411221 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 543216, win 4380, length 0 15:01:25.412656 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43012:43057, ack 543684, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.413336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 543684:543723, ack 43057, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.415662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43057:43159, ack 543723, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.416554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 543723:543862, ack 43159, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.418144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43159:43235, ack 543862, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.418982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 543862:543934, ack 43235, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.420535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43235:43311, ack 543934, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.421341 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 543934:544022, ack 43311, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.422946 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43311:43413, ack 544022, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.423025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 544022:544126, ack 43413, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.424603 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43413:43501, ack 544126, win 4152, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.428748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 544126:547046, ack 43501, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.428969 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547046:547138, ack 43501, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:25.431648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 547046, win 4380, length 0 15:01:25.453408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43501:43546, ack 547138, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.454126 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547138:547177, ack 43546, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.456577 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43546:43642, ack 547177, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.457457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547177:547316, ack 43642, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.459208 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43642:43718, ack 547316, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.460039 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547316:547388, ack 43718, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.461759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43718:43794, ack 547388, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.462568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547388:547476, ack 43794, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.464207 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43794:43890, ack 547476, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.466703 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 547476:548764, ack 43890, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:25.468854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43890:43935, ack 548764, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.469550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 548764:548803, ack 43935, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.471911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 43935:44043, ack 548803, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.472777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 548803:548942, ack 44043, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.474332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44043:44119, ack 548942, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.475202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 548942:549014, ack 44119, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.476748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44119:44195, ack 549014, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.477581 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 549014:549102, ack 44195, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.479209 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44195:44303, ack 549102, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.482219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 549102:550562, ack 44303, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.482512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550562:550570, ack 44303, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:25.484844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 550570, win 4380, length 0 15:01:25.484928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550570:550674, ack 44303, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.485297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44303:44348, ack 550570, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.486576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44348:44436, ack 550674, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.486659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550674:550713, ack 44436, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.489026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44436:44554, ack 550713, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.489898 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550713:550852, ack 44554, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.491458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44554:44630, ack 550852, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.492292 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550852:550924, ack 44630, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.493824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44630:44706, ack 550924, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.494656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 550924:551012, ack 44706, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.496266 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44706:44824, ack 551012, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.501724 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 551012:552472, ack 44824, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.501930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 552472:553780, ack 44824, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:25.505349 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 553780, win 4380, length 0 15:01:25.505740 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44824:44869, ack 553780, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.506450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 553780:553819, ack 44869, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.508827 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44869:44971, ack 553819, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.509719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 553819:553958, ack 44971, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.511284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 44971:45047, ack 553958, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.512121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 553958:554030, ack 45047, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.513664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45047:45123, ack 554030, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.514868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 554030:554118, ack 45123, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.516463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45123:45225, ack 554118, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.530319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 554118:561418, ack 45225, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.530703 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561418:561606, ack 45225, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:25.533215 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 557038, win 4380, length 0 15:01:25.535221 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 559958, win 4380, length 0 15:01:25.537214 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 561606, win 4380, length 0 15:01:25.537282 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561606:561710, ack 45225, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.537782 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45225:45270, ack 561606, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.539039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45270:45358, ack 561710, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.539126 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561710:561749, ack 45358, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.541477 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45358:45460, ack 561749, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.542370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561749:561888, ack 45460, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.543942 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45460:45536, ack 561888, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.544810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561888:561960, ack 45536, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.546392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45536:45612, ack 561960, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.547213 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 561960:562048, ack 45612, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.548831 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45612:45714, ack 562048, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.550840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 562048:562768, ack 45714, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:25.558963 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45714:45759, ack 562768, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.559682 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 562768:562807, ack 45759, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.562035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45759:45885, ack 562807, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.562918 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 562807:562946, ack 45885, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.564466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45885:45961, ack 562946, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.565321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 562946:563018, ack 45961, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.566870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 45961:46037, ack 563018, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.567688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 563018:563106, ack 46037, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.569327 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46037:46163, ack 563106, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.595651 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 563106:577706, ack 46163, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.598610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 566026, win 4380, length 0 15:01:25.601233 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 568946, win 4380, length 0 15:01:25.601308 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 577706:579166, ack 46163, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:25.601352 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 579166:579410, ack 46163, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:25.602663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 571866, win 4380, length 0 15:01:25.604711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 574786, win 4380, length 0 15:01:25.606727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 577706, win 4380, length 0 15:01:25.608611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 579410, win 4380, length 0 15:01:25.608678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 579410:579514, ack 46163, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.609199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46163:46323, ack 579410, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.610430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46323:46411, ack 579514, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.635787 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 579514:595574, ack 46411, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.636143 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 595574:595934, ack 46411, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:25.638734 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 582434, win 4380, length 0 15:01:25.641381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 585354, win 4380, length 0 15:01:25.643686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 588274, win 4380, length 0 15:01:25.645758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 591194, win 4380, length 0 15:01:25.647963 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 594114, win 4380, length 0 15:01:25.650769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 595934, win 4380, length 0 15:01:25.651399 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46411:46527, ack 595934, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.676874 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 595934:611994, ack 46527, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.677209 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 611994:612278, ack 46527, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:25.681382 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 598854, win 4380, length 0 15:01:25.684131 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 601774, win 4380, length 0 15:01:25.685456 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 604694, win 4380, length 0 15:01:25.687541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 607614, win 4380, length 0 15:01:25.690352 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 610534, win 4380, length 0 15:01:25.692333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 612278, win 4380, length 0 15:01:25.692739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46527:46568, ack 612278, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:25.693660 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612278:612317, ack 46568, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:25.695202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46568:46613, ack 612317, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.695909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612317:612356, ack 46613, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.698388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46613:46741, ack 612356, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.698770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612356:612460, ack 46741, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.700398 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46741:46829, ack 612460, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.700487 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612460:612599, ack 46829, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.702043 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46829:46905, ack 612599, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.702893 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612599:612671, ack 46905, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.704430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46905:46981, ack 612671, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.705278 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 612671:612759, ack 46981, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.706884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 46981:47109, ack 612759, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.713369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 612759:615679, ack 47109, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.713600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 615679:616179, ack 47109, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:25.716165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 615679, win 4380, length 0 15:01:25.717641 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47109:47154, ack 616179, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.718318 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 616179:616218, ack 47154, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.720689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47154:47262, ack 616218, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.721568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 616218:616357, ack 47262, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.723123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47262:47338, ack 616357, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.724009 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 616357:616429, ack 47338, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.725548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47338:47414, ack 616429, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.726368 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 616429:616517, ack 47414, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.728044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47414:47522, ack 616517, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.731817 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 616517:617977, ack 47522, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:25.732024 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 617977:618413, ack 47522, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:25.734434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 618413, win 4380, length 0 15:01:25.734829 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47522:47567, ack 618413, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.735510 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618413:618452, ack 47567, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.738483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47567:47693, ack 618452, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.738860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618452:618556, ack 47693, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.740494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47693:47781, ack 618556, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.740580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618556:618695, ack 47781, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.742133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47781:47857, ack 618695, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.742979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618695:618767, ack 47857, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.744519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47857:47933, ack 618767, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.745351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618767:618855, ack 47933, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.747003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 47933:48059, ack 618855, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.749066 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 618855:619555, ack 48059, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:25.756890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48059:48104, ack 619555, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.757600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 619555:619594, ack 48104, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.759964 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48104:48238, ack 619594, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.760853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 619594:619733, ack 48238, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.762406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48238:48314, ack 619733, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.763246 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 619733:619805, ack 48314, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.764789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48314:48390, ack 619805, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.765621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 619805:619893, ack 48390, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.767238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48390:48524, ack 619893, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.768478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 619893:620161, ack 48524, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:25.770169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48524:48569, ack 620161, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.770844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620161:620200, ack 48569, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.773194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48569:48703, ack 620200, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:25.774119 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620200:620339, ack 48703, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:25.775672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48703:48779, ack 620339, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.776508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620339:620411, ack 48779, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:25.778114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48779:48855, ack 620411, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.778479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620411:620515, ack 48855, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:25.780646 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48855:48943, ack 620515, win 4224, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:25.780730 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620515:620603, ack 48943, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:25.782376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 48943:49077, ack 620603, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:25.784926 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 620603:621543, ack 49077, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:25.786890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49077:49122, ack 621543, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:25.787589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 621543:621582, ack 49122, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:25.978665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 621582, win 4370, length 0 15:01:26.452972 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1284:1343, ack 1196, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:26.453621 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1196:1255, ack 1343, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:26.522599 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 1255, win 8192, length 0 15:01:27.313064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49122:49212, ack 621582, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.314178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 621582:621721, ack 49212, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.315923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49212:49292, ack 621721, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.316815 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 621721:621825, ack 49292, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:27.318353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49292:49372, ack 621825, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.319190 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 621825:621913, ack 49372, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.320750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49372:49462, ack 621913, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.329223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 621913:626293, ack 49462, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.329482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 626293:626321, ack 49462, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:27.335803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 624833, win 4380, length 0 15:01:27.336283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 626321, win 4380, length 0 15:01:27.338794 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49462:49552, ack 626321, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.339652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 626321:626460, ack 49552, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.341608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49552:49597, ack 626460, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.342340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 626460:626499, ack 49597, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.343901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49597:49687, ack 626499, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.344541 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 626499:626603, ack 49687, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.353547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 626603:630983, ack 49687, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.357327 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 628063, win 4380, length 0 15:01:27.357420 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 630983:631011, ack 49687, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:27.358694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 630983, win 4380, length 0 15:01:27.359852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49687:49775, ack 631011, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.393709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 49775, win 3247, length 0 15:01:27.395407 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49775:49820, ack 631011, win 4373, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.395476 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 49820, win 3247, length 0 15:01:27.396174 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 631011:631050, ack 49820, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.398588 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49820:49938, ack 631050, win 4363, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.399495 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 631050:631189, ack 49938, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.401164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 49938:50014, ack 631189, win 4328, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.402016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 631189:631261, ack 50014, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.403732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50014:50090, ack 631261, win 4310, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.404573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 631261:631349, ack 50090, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.406260 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50090:50208, ack 631349, win 4288, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.410796 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 631349:632809, ack 50208, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.411005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 632809:633549, ack 50208, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:27.414446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 633549, win 4380, length 0 15:01:27.415267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50208:50253, ack 633549, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.415943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633549:633588, ack 50253, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.418446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50253:50353, ack 633588, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.419329 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633588:633727, ack 50353, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.422045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50353:50429, ack 633727, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.422878 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633727:633799, ack 50429, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.424531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50429:50505, ack 633799, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.425363 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633799:633887, ack 50505, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.426985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50505:50605, ack 633887, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.427067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633887:633991, ack 50605, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.428660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50605:50693, ack 633991, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.429024 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 633991:634571, ack 50693, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:27.430885 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50693:50738, ack 634571, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.431602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 634571:634610, ack 50738, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.433899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50738:50848, ack 634610, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.434788 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 634610:634749, ack 50848, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.436347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50848:50924, ack 634749, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.437180 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 634749:634821, ack 50924, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.438737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 50924:51000, ack 634821, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.439556 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 634821:634909, ack 51000, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.441165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51000:51110, ack 634909, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.442723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 634909:635405, ack 51110, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:27.444494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51110:51155, ack 635405, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.445198 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 635405:635444, ack 51155, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.447547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51155:51259, ack 635444, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.448415 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 635444:635583, ack 51259, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.450079 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51259:51335, ack 635583, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.450902 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 635583:635655, ack 51335, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.452457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51335:51411, ack 635655, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.453270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 635655:635743, ack 51411, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.454878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51411:51515, ack 635743, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.474571 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 635743:645963, ack 51515, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.478490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 638663, win 4380, length 0 15:01:27.478587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 645963:650343, ack 51515, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:27.482272 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 641583, win 4380, length 0 15:01:27.482354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 650343:651803, ack 51515, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:27.482397 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 651803:652247, ack 51515, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:01:27.484401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 644503, win 4380, length 0 15:01:27.488036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 647423, win 4380, length 0 15:01:27.489418 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 650343, win 4380, length 0 15:01:27.492211 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 652247, win 4380, length 0 15:01:27.492715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51515:51556, ack 652247, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:27.493205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51556:51644, ack 652247, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.493788 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 652247:652286, ack 51644, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:27.495324 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51644:51689, ack 652286, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.496019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 652286:652325, ack 51689, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.498351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51689:51799, ack 652325, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.499244 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 652325:652464, ack 51799, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.500814 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51799:51875, ack 652464, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.501652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 652464:652536, ack 51875, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.503192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51875:51951, ack 652536, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.504061 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 652536:652624, ack 51951, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.505661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 51951:52061, ack 652624, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.511808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 652624:655544, ack 52061, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.512044 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 655544:656012, ack 52061, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:27.514676 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 655544, win 4380, length 0 15:01:27.516085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52061:52106, ack 656012, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.516761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 656012:656051, ack 52106, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.519029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52106:52208, ack 656051, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.521022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 656051:656190, ack 52208, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.522606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52208:52284, ack 656190, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.523014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 656190:656294, ack 52284, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.524612 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52284:52372, ack 656294, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.524703 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 656294:656366, ack 52372, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.526275 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52372:52448, ack 656366, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.527149 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 656366:656454, ack 52448, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.528786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52448:52550, ack 656454, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.534304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 656454:659374, ack 52550, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.534545 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659374:659466, ack 52550, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:27.537039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 659374, win 4380, length 0 15:01:27.538428 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52550:52595, ack 659466, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.539099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659466:659505, ack 52595, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.541366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52595:52691, ack 659505, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.542238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659505:659644, ack 52691, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.543799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52691:52767, ack 659644, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.544700 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659644:659716, ack 52767, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.546267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52767:52843, ack 659716, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.547083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659716:659804, ack 52843, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.548722 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52843:52939, ack 659804, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.551169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 659804:661092, ack 52939, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:27.553298 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52939:52984, ack 661092, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.554050 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 661092:661131, ack 52984, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.556384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 52984:53092, ack 661131, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.557274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 661131:661270, ack 53092, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.558933 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53092:53168, ack 661270, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.559763 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 661270:661342, ack 53168, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.561461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53168:53244, ack 661342, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.562280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 661342:661430, ack 53244, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.564556 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53244:53352, ack 661430, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.564637 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 661430:661534, ack 53352, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.567712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 661534:662994, ack 53352, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.570805 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 662994, win 4380, length 0 15:01:27.570888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 662994:663002, ack 53352, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:27.575894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53352:53440, ack 663002, win 4378, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.576354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53440:53485, ack 663002, win 4378, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.576899 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 53485, win 3247, length 0 15:01:27.577506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 663002:663041, ack 53485, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.581251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53485:53603, ack 663041, win 4368, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.582122 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 663041:663180, ack 53603, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.583803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53603:53679, ack 663180, win 4333, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.584655 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 663180:663252, ack 53679, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.586393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53679:53755, ack 663252, win 4315, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.587381 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 663252:663340, ack 53755, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.589194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53755:53873, ack 663340, win 4293, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.594725 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 663340:664800, ack 53873, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.594932 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 664800:666108, ack 53873, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:27.598366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 666108, win 4380, length 0 15:01:27.598830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53873:53918, ack 666108, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.599483 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 666108:666147, ack 53918, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.601831 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 53918:54020, ack 666147, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.602706 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 666147:666286, ack 54020, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.604269 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54020:54096, ack 666286, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.605132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 666286:666358, ack 54096, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.606678 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54096:54172, ack 666358, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.607048 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 666358:666462, ack 54172, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.608640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54172:54260, ack 666462, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.608724 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 666462:666550, ack 54260, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.610363 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54260:54362, ack 666550, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.624027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 666550:673850, ack 54362, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.624298 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 673850:674038, ack 54362, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:27.626823 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 669470, win 4380, length 0 15:01:27.628911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 672390, win 4380, length 0 15:01:27.631571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 674038, win 4380, length 0 15:01:27.631954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54362:54407, ack 674038, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.632616 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 674038:674077, ack 54407, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.634903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54407:54509, ack 674077, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.635820 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 674077:674216, ack 54509, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.637386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54509:54585, ack 674216, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.638228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 674216:674288, ack 54585, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.639799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54585:54661, ack 674288, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.640649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 674288:674376, ack 54661, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.643153 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54661:54763, ack 674376, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.645159 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 674376:675096, ack 54763, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:27.648114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54763:54808, ack 675096, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.648802 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 675096:675135, ack 54808, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.651161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54808:54934, ack 675135, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.652029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 675135:675274, ack 54934, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.654289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 54934:55010, ack 675274, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.655138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 675274:675346, ack 55010, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.656860 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55010:55086, ack 675346, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.657669 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 675346:675434, ack 55086, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.659936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55086:55212, ack 675434, win 4031, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.660016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 675434:675538, ack 55212, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.661621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55212:55300, ack 675538, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.686631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 675538:690138, ack 55300, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.691361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 678458, win 4380, length 0 15:01:27.694171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 681378, win 4380, length 0 15:01:27.694251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 690138:691598, ack 55300, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:27.694296 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 691598:691842, ack 55300, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:27.699350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 684298, win 4380, length 0 15:01:27.702334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 687218, win 4380, length 0 15:01:27.707475 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 690138, win 4380, length 0 15:01:27.708244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 691842, win 4380, length 0 15:01:27.716766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55300:55460, ack 691842, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.742957 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 691842:707902, ack 55460, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.743320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 707902:708262, ack 55460, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:27.747371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 694762, win 4380, length 0 15:01:27.749637 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 697682, win 4380, length 0 15:01:27.754848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 700602, win 4380, length 0 15:01:27.756202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 703522, win 4380, length 0 15:01:27.758402 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 706442, win 4380, length 0 15:01:27.761058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 708262, win 4380, length 0 15:01:27.761683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55460:55576, ack 708262, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.787238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 708262:724322, ack 55576, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.787590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724322:724606, ack 55576, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:27.790265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 711182, win 4380, length 0 15:01:27.794046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 714102, win 4380, length 0 15:01:27.796915 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 717022, win 4380, length 0 15:01:27.799927 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 719942, win 4380, length 0 15:01:27.802761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 722862, win 4380, length 0 15:01:27.805562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 724606, win 4380, length 0 15:01:27.806035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55576:55617, ack 724606, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:27.806410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724606:724710, ack 55617, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.808585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55617:55705, ack 724710, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.808674 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724710:724749, ack 55705, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:27.810181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55705:55750, ack 724749, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.810863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724749:724788, ack 55750, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.813216 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55750:55878, ack 724788, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.814185 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724788:724927, ack 55878, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.816345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55878:55954, ack 724927, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.817215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724927:724999, ack 55954, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.818782 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 55954:56030, ack 724999, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.819598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 724999:725087, ack 56030, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.821285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56030:56158, ack 725087, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.827835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 725087:728007, ack 56158, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.828072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 728007:728507, ack 56158, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:27.831483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 728007, win 4380, length 0 15:01:27.832884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56158:56203, ack 728507, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.833546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 728507:728546, ack 56203, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.835896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56203:56311, ack 728546, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.836811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 728546:728685, ack 56311, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.838406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56311:56387, ack 728685, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.839247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 728685:728757, ack 56387, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.840808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56387:56463, ack 728757, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.841626 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 728757:728845, ack 56463, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.843919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56463:56571, ack 728845, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.847713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 728845:730305, ack 56571, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:27.847919 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 730305:730741, ack 56571, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:27.850303 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 730741, win 4380, length 0 15:01:27.850388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 730741:730845, ack 56571, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.850809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56571:56616, ack 730741, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.852083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56616:56704, ack 730845, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.852165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 730845:730884, ack 56704, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.854439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56704:56830, ack 730884, win 4344, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.855337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 730884:731023, ack 56830, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.857426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56830:56906, ack 731023, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.858267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 731023:731095, ack 56906, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.859851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56906:56982, ack 731095, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.860676 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 731095:731183, ack 56982, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.862297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 56982:57108, ack 731183, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.864452 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 731183:731883, ack 57108, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:27.866801 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57108:57153, ack 731883, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.867492 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 731883:731922, ack 57153, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.869843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57153:57287, ack 731922, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.870720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 731922:732061, ack 57287, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.872379 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57287:57363, ack 732061, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.873221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732061:732133, ack 57363, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.874934 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57363:57439, ack 732133, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.875780 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732133:732221, ack 57439, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.877429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57439:57573, ack 732221, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.878687 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732221:732489, ack 57573, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:27.881011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57573:57618, ack 732489, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.881686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732489:732528, ack 57618, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:27.884046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57618:57752, ack 732528, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:27.884421 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732528:732632, ack 57752, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:27.887169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57752:57840, ack 732632, win 4277, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:27.887257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732632:732771, ack 57840, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:27.888791 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57840:57916, ack 732771, win 4242, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.889624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732771:732843, ack 57916, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:27.891180 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57916:57992, ack 732843, win 4224, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.891999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732843:732931, ack 57992, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:27.893616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 57992:58126, ack 732931, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:27.896112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 732931:733871, ack 58126, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:27.898198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58126:58171, ack 733871, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:27.899138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 733871:733910, ack 58171, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:28.100276 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 733910, win 4370, length 0 15:01:28.420319 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1343:1429, ack 1255, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:28.421505 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1255:1355, ack 1429, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:28.431276 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1429:1515, ack 1355, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:28.432317 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1355:1443, ack 1515, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:28.441572 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1515:1603, ack 1443, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:28.442537 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1443:1543, ack 1603, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:28.452407 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1603:1691, ack 1543, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:28.453347 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1543:1631, ack 1691, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:28.462702 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1691:1796, ack 1631, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:28.463490 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1631:1670, ack 1796, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:28.488711 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 1670, win 8192, length 0 15:01:29.402564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58171:58251, ack 733910, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.403625 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 733910:734014, ack 58251, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:29.406508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58251:58331, ack 734014, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.407390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 734014:734102, ack 58331, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.409012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58331:58421, ack 734102, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.409402 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 734102:734206, ack 58421, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.613476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 734206, win 4296, length 0 15:01:29.613592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 734206:734345, ack 58421, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.615465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58421:58509, ack 734345, win 4261, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.653723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 58509, win 3247, length 0 15:01:29.655358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58509:58599, ack 734345, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.655423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 58599, win 3247, length 0 15:01:29.663875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 734345:738725, ack 58599, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.664123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 738725:738753, ack 58599, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:29.666848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 737265, win 4380, length 0 15:01:29.668778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 738753, win 4380, length 0 15:01:29.670569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58599:58689, ack 738753, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.671444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 738753:738892, ack 58689, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.673373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58689:58734, ack 738892, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.674120 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 738892:738931, ack 58734, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.675708 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58734:58824, ack 738931, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.684104 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 738931:743311, ack 58824, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.684340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743311:743339, ack 58824, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:29.687077 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 741851, win 4380, length 0 15:01:29.689018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 743339, win 4380, length 0 15:01:29.689660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58824:58869, ack 743339, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.690335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743339:743378, ack 58869, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.696901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58869:58987, ack 743378, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.697827 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743378:743517, ack 58987, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.699457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 58987:59063, ack 743517, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.700307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743517:743589, ack 59063, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.701894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59063:59139, ack 743589, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.702711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743589:743677, ack 59139, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.704361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59139:59257, ack 743677, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.704442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 743677:743781, ack 59257, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.706055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59257:59345, ack 743781, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.709215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 743781:745241, ack 59345, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.709410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 745241:745981, ack 59345, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:29.711987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 745981, win 4380, length 0 15:01:29.712418 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59345:59390, ack 745981, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.713104 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 745981:746020, ack 59390, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.715395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59390:59490, ack 746020, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.716285 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746020:746159, ack 59490, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.717913 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59490:59566, ack 746159, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.718743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746159:746231, ack 59566, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.720331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59566:59642, ack 746231, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.721138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746231:746319, ack 59642, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.723058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59642:59742, ack 746319, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.724804 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746319:746899, ack 59742, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:29.726735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59742:59787, ack 746899, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.727419 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746899:746938, ack 59787, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.731128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59787:59897, ack 746938, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.731984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 746938:747077, ack 59897, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.733591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59897:59973, ack 747077, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.734468 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747077:747149, ack 59973, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.736045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 59973:60049, ack 747149, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.736865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747149:747237, ack 60049, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.738593 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60049:60159, ack 747237, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.740157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747237:747733, ack 60159, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:29.742023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60159:60204, ack 747733, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.742107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747733:747837, ack 60204, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.743757 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60204:60292, ack 747837, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.743839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747837:747876, ack 60292, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.746135 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60292:60396, ack 747876, win 4344, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.747009 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 747876:748015, ack 60396, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.748648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60396:60472, ack 748015, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.749484 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 748015:748087, ack 60472, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.751067 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60472:60548, ack 748087, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.751883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 748087:748175, ack 60548, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.753523 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60548:60652, ack 748175, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.773141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 748175:758395, ack 60652, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.776046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 751095, win 4380, length 0 15:01:29.776145 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 758395:762775, ack 60652, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:29.781931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 754015, win 4380, length 0 15:01:29.782002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 762775:764235, ack 60652, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:29.782043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764235:764575, ack 60652, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:29.782296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 756935, win 4380, length 0 15:01:29.782774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 759855, win 4380, length 0 15:01:29.784882 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 762775, win 4380, length 0 15:01:29.786945 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 764575, win 4380, length 0 15:01:29.787956 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60652:60693, ack 764575, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:29.788841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764575:764614, ack 60693, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:29.790406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60693:60738, ack 764614, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.791095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764614:764653, ack 60738, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.793354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60738:60848, ack 764653, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.794295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764653:764792, ack 60848, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.795894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60848:60924, ack 764792, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.795979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764792:764896, ack 60924, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.797595 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 60924:61012, ack 764896, win 4299, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.797681 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764896:764968, ack 61012, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.799314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61012:61088, ack 764968, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.800142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 764968:765056, ack 61088, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.801799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61088:61198, ack 765056, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.808000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 765056:767976, ack 61198, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.808229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 767976:768444, ack 61198, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:29.810938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 767976, win 4380, length 0 15:01:29.812454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61198:61243, ack 768444, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.813116 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 768444:768483, ack 61243, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.815408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61243:61345, ack 768483, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.816293 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 768483:768622, ack 61345, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.817919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61345:61421, ack 768622, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.818750 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 768622:768694, ack 61421, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.820355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61421:61497, ack 768694, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.821169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 768694:768782, ack 61497, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.822793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61497:61599, ack 768782, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.828228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 768782:771702, ack 61599, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.828463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 771702:771794, ack 61599, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:29.831087 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 771702, win 4380, length 0 15:01:29.834012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61599:61644, ack 771794, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.834689 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 771794:771833, ack 61644, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.836974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61644:61740, ack 771833, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.837837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 771833:771972, ack 61740, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.839461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61740:61816, ack 771972, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.839849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 771972:772076, ack 61816, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.841480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61816:61904, ack 772076, win 4286, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.841564 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 772076:772148, ack 61904, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.843167 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61904:61980, ack 772148, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.844050 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 772148:772236, ack 61980, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.845683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 61980:62076, ack 772236, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.848175 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 772236:773524, ack 62076, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:29.850392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62076:62121, ack 773524, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.851088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 773524:773563, ack 62121, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.853369 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62121:62229, ack 773563, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.854469 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 773563:773702, ack 62229, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.856062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62229:62305, ack 773702, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.856914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 773702:773774, ack 62305, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.858504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62305:62381, ack 773774, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.859316 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 773774:773862, ack 62381, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.860954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62381:62489, ack 773862, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.864042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 773862:775322, ack 62489, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.864247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775322:775330, ack 62489, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:29.866569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 775330, win 4380, length 0 15:01:29.866944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62489:62534, ack 775330, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.867599 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775330:775369, ack 62534, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.869947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62534:62652, ack 775369, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.870811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775369:775508, ack 62652, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.872415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62652:62728, ack 775508, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.873239 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775508:775580, ack 62728, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.874809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62728:62804, ack 775580, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.875186 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775580:775684, ack 62804, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.876796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62804:62892, ack 775684, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.876878 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 775684:775772, ack 62892, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.878582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 62892:63010, ack 775772, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.884123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 775772:777232, ack 63010, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.884332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 777232:778540, ack 63010, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:29.886947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 778540, win 4380, length 0 15:01:29.887439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63010:63055, ack 778540, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.888100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 778540:778579, ack 63055, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.890405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63055:63157, ack 778579, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.891279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 778579:778718, ack 63157, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.892874 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63157:63233, ack 778718, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.893750 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 778718:778790, ack 63233, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.912157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63233:63309, ack 778790, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.913008 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 778790:778878, ack 63309, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.914844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63309:63411, ack 778878, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.928519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 778878:786178, ack 63411, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.928789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786178:786366, ack 63411, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:29.932189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 781798, win 4380, length 0 15:01:29.933579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 784718, win 4380, length 0 15:01:29.937030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 786366, win 4380, length 0 15:01:29.937464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63411:63456, ack 786366, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.938148 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786366:786405, ack 63456, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.940513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63456:63558, ack 786405, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.941397 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786405:786544, ack 63558, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.943103 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63558:63634, ack 786544, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.943991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786544:786616, ack 63634, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.945598 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63634:63710, ack 786616, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.945679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786616:786720, ack 63710, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:29.947298 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63710:63798, ack 786720, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:29.947378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786720:786808, ack 63798, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.949084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63798:63900, ack 786808, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.951078 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 786808:787528, ack 63900, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:29.953278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63900:63945, ack 787528, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:29.954022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 787528:787567, ack 63945, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:29.960404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 63945:64071, ack 787567, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:29.961284 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 787567:787706, ack 64071, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:29.962894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64071:64147, ack 787706, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.963781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 787706:787778, ack 64147, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:29.965365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64147:64223, ack 787778, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.966190 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 787778:787866, ack 64223, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:29.967932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64223:64349, ack 787866, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:29.994240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 787866:802466, ack 64349, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:29.997249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 790786, win 4380, length 0 15:01:29.999504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 793706, win 4380, length 0 15:01:29.999577 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 802466:803926, ack 64349, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:29.999620 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 803926:804170, ack 64349, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:30.001530 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 796626, win 4380, length 0 15:01:30.003758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 799546, win 4380, length 0 15:01:30.005990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 802466, win 4380, length 0 15:01:30.008029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 804170, win 4380, length 0 15:01:30.008633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64349:64509, ack 804170, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.035209 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 804170:820230, ack 64509, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:30.035567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 820230:820590, ack 64509, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:30.038480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 807090, win 4380, length 0 15:01:30.040602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 810010, win 4380, length 0 15:01:30.042767 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 812930, win 4380, length 0 15:01:30.044902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 815850, win 4380, length 0 15:01:30.047127 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 818770, win 4380, length 0 15:01:30.049223 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 820590, win 4380, length 0 15:01:30.049290 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 820590:820694, ack 64509, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:30.049786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64509:64625, ack 820590, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.070151 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64625:64713, ack 820694, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:30.075999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 820694:836754, ack 64713, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:30.076333 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 836754:837038, ack 64713, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:30.080395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 823614, win 4380, length 0 15:01:30.080756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 826534, win 4380, length 0 15:01:30.082897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 829454, win 4380, length 0 15:01:30.085027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 832374, win 4380, length 0 15:01:30.087257 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 835294, win 4380, length 0 15:01:30.089169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 837038, win 4380, length 0 15:01:30.089621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64713:64754, ack 837038, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:30.090479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 837038:837077, ack 64754, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:30.092026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64754:64799, ack 837077, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.092752 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 837077:837116, ack 64799, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.095101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64799:64927, ack 837116, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:30.096028 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 837116:837255, ack 64927, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:30.097680 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 64927:65003, ack 837255, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.098531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 837255:837327, ack 65003, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:30.100157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65003:65079, ack 837327, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.100980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 837327:837415, ack 65079, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:30.102631 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65079:65207, ack 837415, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.109144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 837415:840335, ack 65207, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:30.109474 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 840335:840835, ack 65207, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:30.111971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 840335, win 4380, length 0 15:01:30.113401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65207:65252, ack 840835, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.113471 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 840835:840939, ack 65252, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:30.115083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65252:65340, ack 840939, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:30.115166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 840939:840978, ack 65340, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.117487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65340:65448, ack 840978, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:30.118366 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 840978:841117, ack 65448, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:30.120046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65448:65524, ack 841117, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.120881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 841117:841189, ack 65524, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:30.122471 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65524:65600, ack 841189, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.123280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 841189:841277, ack 65600, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:30.125663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65600:65708, ack 841277, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.129456 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 841277:842737, ack 65708, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:30.129665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 842737:843173, ack 65708, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:30.132154 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 843173, win 4380, length 0 15:01:30.132524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65708:65753, ack 843173, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.133183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 843173:843212, ack 65753, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.135502 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65753:65879, ack 843212, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:30.136405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 843212:843351, ack 65879, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:30.139521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65879:65955, ack 843351, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.140367 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 843351:843423, ack 65955, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:30.141992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 65955:66031, ack 843423, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.142808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 843423:843511, ack 66031, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:30.144494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66031:66157, ack 843511, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.146542 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 843511:844211, ack 66157, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:30.148752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66157:66202, ack 844211, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.149142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844211:844315, ack 66202, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:30.154900 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66202:66290, ack 844315, win 4094, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:30.154983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844315:844354, ack 66290, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.157395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66290:66424, ack 844354, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:30.158295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844354:844493, ack 66424, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:30.159911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66424:66500, ack 844493, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.160751 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844493:844565, ack 66500, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:30.162329 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66500:66576, ack 844565, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.163432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844565:844653, ack 66576, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:30.165082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66576:66710, ack 844653, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.166434 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844653:844921, ack 66710, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:30.168169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66710:66755, ack 844921, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.168893 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844921:844960, ack 66755, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.171234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66755:66889, ack 844960, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:30.172132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 844960:845099, ack 66889, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:30.173724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66889:66965, ack 845099, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.174583 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 845099:845171, ack 66965, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:30.176166 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 66965:67041, ack 845171, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.176988 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 845171:845259, ack 67041, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:30.178647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67041:67175, ack 845259, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:30.181164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 845259:846199, ack 67175, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:30.183174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67175:67220, ack 846199, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:30.183961 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 846199:846238, ack 67220, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:30.377971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 846238, win 4370, length 0 15:01:31.472859 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1796:1855, ack 1670, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:31.473564 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1670:1729, ack 1855, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:31.601727 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 1729, win 8192, length 0 15:01:31.602239 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 846238:846342, ack 67220, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:31.604134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67220:67308, ack 846342, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:31.643725 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 67308, win 3247, length 0 15:01:32.617129 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67308:67398, ack 846342, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.617241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 67398, win 3247, length 0 15:01:32.618283 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 846342:846481, ack 67398, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.620029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67398:67478, ack 846481, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.620918 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 846481:846585, ack 67478, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:32.622447 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67478:67558, ack 846585, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.623275 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 846585:846673, ack 67558, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.624830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67558:67648, ack 846673, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.633235 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 846673:851053, ack 67648, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.633486 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 851053:851081, ack 67648, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:32.639663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 849593, win 4380, length 0 15:01:32.640140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 851081, win 4380, length 0 15:01:32.641643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67648:67738, ack 851081, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.642507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 851081:851220, ack 67738, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.644406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67738:67783, ack 851220, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.645112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 851220:851259, ack 67783, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.646675 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67783:67873, ack 851259, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.655080 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 851259:855639, ack 67873, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.655324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 855639:855667, ack 67873, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:32.658094 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 854179, win 4380, length 0 15:01:32.660490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 855667, win 4380, length 0 15:01:32.661045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67873:67918, ack 855667, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.661715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 855667:855706, ack 67918, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.668442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 67918:68036, ack 855706, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.669378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 855706:855845, ack 68036, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.671017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68036:68112, ack 855845, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.671100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 855845:855949, ack 68112, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.672729 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68112:68200, ack 855949, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.672814 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 855949:856021, ack 68200, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.674423 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68200:68276, ack 856021, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.675270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 856021:856109, ack 68276, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.676934 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68276:68394, ack 856109, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.681406 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 856109:857569, ack 68394, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.681613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 857569:858309, ack 68394, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:32.684100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 858309, win 4380, length 0 15:01:32.684513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68394:68439, ack 858309, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.685221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 858309:858348, ack 68439, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.687543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68439:68539, ack 858348, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.688414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 858348:858487, ack 68539, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.690047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68539:68615, ack 858487, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.690892 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 858487:858559, ack 68615, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.692489 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68615:68691, ack 858559, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.693311 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 858559:858647, ack 68691, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.694948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68691:68791, ack 858647, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.696666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 858647:859227, ack 68791, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:32.699997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68791:68836, ack 859227, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.700681 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859227:859266, ack 68836, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.703101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68836:68946, ack 859266, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.704025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859266:859405, ack 68946, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.705651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 68946:69022, ack 859405, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.706488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859405:859477, ack 69022, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.708101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69022:69098, ack 859477, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.708180 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859477:859581, ack 69098, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.709801 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69098:69186, ack 859581, win 4062, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.709883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859581:859669, ack 69186, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.711554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69186:69296, ack 859669, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.713108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 859669:860165, ack 69296, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:32.714920 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69296:69341, ack 860165, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.715633 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 860165:860204, ack 69341, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.717985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69341:69445, ack 860204, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.718863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 860204:860343, ack 69445, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.720483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69445:69521, ack 860343, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.721330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 860343:860415, ack 69521, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.722902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69521:69597, ack 860415, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.723768 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 860415:860503, ack 69597, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.725404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69597:69701, ack 860503, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.745068 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 860503:870723, ack 69701, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.747990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 863423, win 4380, length 0 15:01:32.748088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 870723:875103, ack 69701, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:32.752406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 866343, win 4380, length 0 15:01:32.752476 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 875103:876563, ack 69701, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:32.752519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 876563:876903, ack 69701, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:32.752783 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 869263, win 4380, length 0 15:01:32.754170 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 872183, win 4380, length 0 15:01:32.756222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 875103, win 4380, length 0 15:01:32.758324 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 876903, win 4380, length 0 15:01:32.758707 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69701:69742, ack 876903, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:32.759582 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 876903:876942, ack 69742, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:32.761137 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69742:69787, ack 876942, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.761223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 876942:877046, ack 69787, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.763237 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69787:69875, ack 877046, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.763320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 877046:877085, ack 69875, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.765624 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69875:69985, ack 877085, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.766526 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 877085:877224, ack 69985, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.768154 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 69985:70061, ack 877224, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.769004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 877224:877296, ack 70061, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.770630 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70061:70137, ack 877296, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.771462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 877296:877384, ack 70137, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.773104 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70137:70247, ack 877384, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.779285 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 877384:880304, ack 70247, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.779524 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 880304:880772, ack 70247, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:32.782197 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 880304, win 4380, length 0 15:01:32.783661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70247:70292, ack 880772, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.784371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 880772:880811, ack 70292, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.786662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70292:70394, ack 880811, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.787540 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 880811:880950, ack 70394, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.789160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70394:70470, ack 880950, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.789993 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 880950:881022, ack 70470, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.791579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70470:70546, ack 881022, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.792383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 881022:881110, ack 70546, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.794010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70546:70648, ack 881110, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.799425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 881110:884030, ack 70648, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.799667 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884030:884122, ack 70648, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:32.803413 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 884030, win 4380, length 0 15:01:32.804770 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70648:70693, ack 884122, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.805131 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884122:884226, ack 70693, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.806737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70693:70781, ack 884226, win 4331, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.806822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884226:884265, ack 70781, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.809122 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70781:70877, ack 884265, win 4321, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.809992 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884265:884404, ack 70877, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.811601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70877:70953, ack 884404, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.812437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884404:884476, ack 70953, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.814030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 70953:71029, ack 884476, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.814865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884476:884564, ack 71029, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.816505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71029:71125, ack 884564, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.818993 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 884564:885852, ack 71125, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:32.821201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71125:71170, ack 885852, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.821897 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 885852:885891, ack 71170, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.824165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71170:71278, ack 885891, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.825052 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 885891:886030, ack 71278, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.826647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71278:71354, ack 886030, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.827482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 886030:886102, ack 71354, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.829112 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71354:71430, ack 886102, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.829932 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 886102:886190, ack 71430, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.831579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71430:71538, ack 886190, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.834672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 886190:887650, ack 71538, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.834876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 887650:887658, ack 71538, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:32.837361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 887658, win 4380, length 0 15:01:32.837765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71538:71583, ack 887658, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.838425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 887658:887697, ack 71583, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.840756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71583:71701, ack 887697, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.841129 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 887697:887801, ack 71701, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.842808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71701:71789, ack 887801, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.842899 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 887801:887940, ack 71789, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.844445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71789:71865, ack 887940, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.845300 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 887940:888012, ack 71865, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.846887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71865:71941, ack 888012, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.847699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 888012:888100, ack 71941, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.849362 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 71941:72059, ack 888100, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.854874 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 888100:889560, ack 72059, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.855081 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 889560:890868, ack 72059, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:32.857693 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 890868, win 4380, length 0 15:01:32.858133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72059:72104, ack 890868, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.858784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 890868:890907, ack 72104, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.876777 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72104:72206, ack 890907, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.877666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 890907:891046, ack 72206, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.881085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72206:72282, ack 891046, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.881928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 891046:891118, ack 72282, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.883732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72282:72358, ack 891118, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.884575 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 891118:891206, ack 72358, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.886450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72358:72460, ack 891206, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.900153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 891206:898506, ack 72460, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.900415 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 898506:898694, ack 72460, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:32.903056 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 894126, win 4380, length 0 15:01:32.907704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 897046, win 4380, length 0 15:01:32.909730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 898694, win 4380, length 0 15:01:32.910135 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72460:72505, ack 898694, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.910884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 898694:898733, ack 72505, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.913219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72505:72607, ack 898733, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.913305 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 898733:898837, ack 72607, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.914958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72607:72695, ack 898837, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:32.915049 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 898837:898976, ack 72695, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.916609 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72695:72771, ack 898976, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.917449 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 898976:899048, ack 72771, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.919073 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72771:72847, ack 899048, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.919888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 899048:899136, ack 72847, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.921529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72847:72949, ack 899136, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.923529 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 899136:899856, ack 72949, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:32.925713 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72949:72994, ack 899856, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:32.926414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 899856:899895, ack 72994, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:32.932711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 72994:73120, ack 899895, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:32.933589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 899895:900034, ack 73120, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:32.935201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73120:73196, ack 900034, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.936060 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 900034:900106, ack 73196, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:32.937655 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73196:73272, ack 900106, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.938472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 900106:900194, ack 73272, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:32.940147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73272:73398, ack 900194, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.966503 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 900194:914794, ack 73398, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:32.969551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 903114, win 4380, length 0 15:01:32.972318 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 906034, win 4380, length 0 15:01:32.972394 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 914794:916254, ack 73398, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:32.972437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 916254:916498, ack 73398, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:32.973713 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 908954, win 4380, length 0 15:01:32.975796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 911874, win 4380, length 0 15:01:32.978088 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 914794, win 4380, length 0 15:01:32.980805 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 916498, win 4380, length 0 15:01:32.980887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 916498:916602, ack 73398, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:32.981443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73398:73558, ack 916498, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:32.982683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73558:73646, ack 916602, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:33.008101 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 916602:932662, ack 73646, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:33.008467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 932662:933022, ack 73646, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:33.022586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 919522, win 4380, length 0 15:01:33.022961 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 922442, win 4380, length 0 15:01:33.023472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 925362, win 4380, length 0 15:01:33.023935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 928282, win 4380, length 0 15:01:33.024434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 931202, win 4380, length 0 15:01:33.024895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 933022, win 4380, length 0 15:01:33.025313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73646:73762, ack 933022, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.050817 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 933022:949082, ack 73762, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:33.051173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949082:949366, ack 73762, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:33.054469 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 935942, win 4380, length 0 15:01:33.055810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 938862, win 4380, length 0 15:01:33.058890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 941782, win 4380, length 0 15:01:33.062018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 944702, win 4380, length 0 15:01:33.064177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 947622, win 4380, length 0 15:01:33.066138 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 949366, win 4380, length 0 15:01:33.066607 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73762:73803, ack 949366, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:33.067501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949366:949405, ack 73803, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:33.069068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73803:73848, ack 949405, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.069806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949405:949444, ack 73848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.072157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73848:73976, ack 949444, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.073072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949444:949583, ack 73976, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:33.074674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 73976:74052, ack 949583, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.075546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949583:949655, ack 74052, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:33.077147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74052:74128, ack 949655, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.077531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949655:949759, ack 74128, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:33.079178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74128:74216, ack 949759, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:33.079262 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 949759:949847, ack 74216, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.080948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74216:74344, ack 949847, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.087512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 949847:952767, ack 74344, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:33.087747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 952767:953267, ack 74344, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:33.091000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 952767, win 4380, length 0 15:01:33.091491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74344:74389, ack 953267, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.092162 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 953267:953306, ack 74389, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.094479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74389:74497, ack 953306, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.095380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 953306:953445, ack 74497, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:33.096984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74497:74573, ack 953445, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.097825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 953445:953517, ack 74573, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:33.099432 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74573:74649, ack 953517, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.100243 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 953517:953605, ack 74649, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.101935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74649:74757, ack 953605, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.105781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 953605:955065, ack 74757, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:33.105985 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955065:955501, ack 74757, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:33.110078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 955501, win 4380, length 0 15:01:33.110464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74757:74802, ack 955501, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.111123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955501:955540, ack 74802, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.113427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74802:74928, ack 955540, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.114349 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955540:955679, ack 74928, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:33.115945 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 74928:75004, ack 955679, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.117067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955679:955751, ack 75004, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:33.118712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75004:75080, ack 955751, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.119091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955751:955855, ack 75080, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:33.120771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75080:75168, ack 955855, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:33.120855 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955855:955943, ack 75168, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.122530 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75168:75294, ack 955943, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.124924 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 955943:956643, ack 75294, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:33.127348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75294:75339, ack 956643, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.128228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 956643:956682, ack 75339, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.134197 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75339:75473, ack 956682, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.135135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 956682:956821, ack 75473, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:33.136735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75473:75549, ack 956821, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.137602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 956821:956893, ack 75549, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:33.139776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75549:75625, ack 956893, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.140640 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 956893:956981, ack 75625, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.142315 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75625:75759, ack 956981, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.143572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 956981:957249, ack 75759, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:33.145276 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75759:75804, ack 957249, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.145982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 957249:957288, ack 75804, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.148346 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75804:75938, ack 957288, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.149234 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 957288:957427, ack 75938, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:33.150836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 75938:76014, ack 957427, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.151678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 957427:957499, ack 76014, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:33.153277 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76014:76090, ack 957499, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.154161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 957499:957587, ack 76090, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.155816 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76090:76224, ack 957587, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.158279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 957587:958527, ack 76224, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:33.160314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76224:76269, ack 958527, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:33.160699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 958527:958631, ack 76269, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:33.162312 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76269:76357, ack 958631, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:33.162395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 958631:958670, ack 76357, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:33.357485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 958670, win 4344, length 0 15:01:33.440355 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1855:1941, ack 1729, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.441484 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1729:1829, ack 1941, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:33.451243 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 1941:2027, ack 1829, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.452286 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1829:1917, ack 2027, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.461534 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2027:2115, ack 1917, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.462498 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 1917:2017, ack 2115, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:33.471948 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2115:2203, ack 2017, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:33.472891 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2017:2105, ack 2203, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:33.482276 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2203:2308, ack 2105, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:33.483061 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2105:2144, ack 2308, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:33.567839 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 2144, win 8192, length 0 15:01:34.692161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76357:76447, ack 958670, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:34.693223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 958670:958809, ack 76447, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:34.694984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76447:76527, ack 958809, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.695884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 958809:958913, ack 76527, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:34.697416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76527:76607, ack 958913, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.698253 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 958913:959001, ack 76607, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:34.699847 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76607:76697, ack 959001, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.708268 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 959001:963381, ack 76697, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:34.708521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 963381:963409, ack 76697, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:34.713018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 961921, win 4380, length 0 15:01:34.713381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 963409, win 4380, length 0 15:01:34.714803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76697:76787, ack 963409, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:34.715690 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 963409:963548, ack 76787, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:34.717580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76787:76832, ack 963548, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:34.717664 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 963548:963652, ack 76832, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:34.917400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 963652, win 4319, length 0 15:01:34.917511 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 963652:963691, ack 76832, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:34.919237 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76832:76922, ack 963691, win 4309, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.927808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 963691:968071, ack 76922, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:34.928064 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 968071:968099, ack 76922, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:34.930697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 966611, win 4380, length 0 15:01:34.932540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 968099, win 4380, length 0 15:01:34.932983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 76922:77010, ack 968099, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:34.963720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 77010, win 3247, length 0 15:01:34.965422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77010:77055, ack 968099, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:34.965491 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 77055, win 3247, length 0 15:01:34.966173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 968099:968138, ack 77055, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:34.968477 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77055:77173, ack 968138, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:34.969431 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 968138:968277, ack 77173, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:34.971104 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77173:77249, ack 968277, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.971965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 968277:968349, ack 77249, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:34.973651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77249:77325, ack 968349, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.974521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 968349:968437, ack 77325, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:34.976304 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77325:77443, ack 968437, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.980771 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 968437:969897, ack 77443, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:34.980981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 969897:970637, ack 77443, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:34.985077 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 970637, win 4380, length 0 15:01:34.985466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77443:77488, ack 970637, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:34.986133 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 970637:970676, ack 77488, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:34.988449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77488:77588, ack 970676, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:34.988828 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 970676:970780, ack 77588, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:34.990468 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77588:77676, ack 970780, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:34.990554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 970780:970919, ack 77676, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:34.992597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77676:77752, ack 970919, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.993429 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 970919:970991, ack 77752, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:34.994972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77752:77828, ack 970991, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.995805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 970991:971079, ack 77828, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:34.997995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77828:77928, ack 971079, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:34.999707 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971079:971659, ack 77928, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:35.001516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77928:77973, ack 971659, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.002206 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971659:971698, ack 77973, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.004969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 77973:78083, ack 971698, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.005854 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971698:971837, ack 78083, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.008166 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78083:78159, ack 971837, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.009008 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971837:971909, ack 78159, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.010561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78159:78235, ack 971909, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.011423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971909:971997, ack 78235, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.013058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78235:78345, ack 971997, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.014672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 971997:972493, ack 78345, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:35.016446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78345:78390, ack 972493, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.017136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 972493:972532, ack 78390, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.019422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78390:78494, ack 972532, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.020280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 972532:972671, ack 78494, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.021851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78494:78570, ack 972671, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.022685 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 972671:972743, ack 78570, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.024228 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78570:78646, ack 972743, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.025055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 972743:972831, ack 78646, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.026716 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78646:78750, ack 972831, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.026797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 972831:972935, ack 78750, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.029993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78750:78838, ack 972935, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.046844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 972935:983155, ack 78838, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.051476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 975855, win 4380, length 0 15:01:35.051581 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 983155:987535, ack 78838, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:35.056101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 978775, win 4380, length 0 15:01:35.056177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 987535:988995, ack 78838, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:35.056219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 988995:989335, ack 78838, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:35.058984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 981695, win 4380, length 0 15:01:35.062786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 984615, win 4380, length 0 15:01:35.066560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 987535, win 4380, length 0 15:01:35.068523 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 989335, win 4380, length 0 15:01:35.068981 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78838:78879, ack 989335, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:35.069865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 989335:989374, ack 78879, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:35.071385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78879:78924, ack 989374, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.072086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 989374:989413, ack 78924, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.074384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 78924:79034, ack 989413, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.075302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 989413:989552, ack 79034, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.076872 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79034:79110, ack 989552, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.077716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 989552:989624, ack 79110, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.079327 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79110:79186, ack 989624, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.080320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 989624:989712, ack 79186, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.081931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79186:79296, ack 989712, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.088142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 989712:992632, ack 79296, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.088372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 992632:993100, ack 79296, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:35.091001 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 992632, win 4380, length 0 15:01:35.092422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79296:79341, ack 993100, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.092501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 993100:993204, ack 79341, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.094076 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79341:79429, ack 993204, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.094161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 993204:993243, ack 79429, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.096407 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79429:79531, ack 993243, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.097287 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 993243:993382, ack 79531, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.098881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79531:79607, ack 993382, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.099714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 993382:993454, ack 79607, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.101265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79607:79683, ack 993454, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.102077 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 993454:993542, ack 79683, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.103694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79683:79785, ack 993542, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.109108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 993542:996462, ack 79785, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.109341 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996462:996554, ack 79785, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:35.113621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 996462, win 4380, length 0 15:01:35.114935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79785:79830, ack 996554, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.115608 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996554:996593, ack 79830, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.118512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79830:79926, ack 996593, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.119376 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996593:996732, ack 79926, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.121022 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 79926:80002, ack 996732, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.121860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996732:996804, ack 80002, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.124079 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80002:80078, ack 996804, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.124914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996804:996892, ack 80078, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.126519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80078:80174, ack 996892, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.129004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 996892:998180, ack 80174, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:35.132667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80174:80219, ack 998180, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.133355 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 998180:998219, ack 80219, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.135610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80219:80327, ack 998219, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.135693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 998219:998323, ack 80327, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.153992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80327:80415, ack 998323, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.154085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 998323:998462, ack 80415, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.157180 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80415:80491, ack 998462, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.158027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 998462:998534, ack 80491, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.160387 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80491:80567, ack 998534, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.161209 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 998534:998622, ack 80567, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.163016 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80567:80675, ack 998622, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.166096 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 998622:1000082, ack 80675, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.166305 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1000082:1000090, ack 80675, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:35.169655 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1000090, win 4380, length 0 15:01:35.170129 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80675:80720, ack 1000090, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.170786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1000090:1000129, ack 80720, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.173090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80720:80838, ack 1000129, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.174019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1000129:1000268, ack 80838, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.175582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80838:80914, ack 1000268, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.176416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1000268:1000340, ack 80914, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.177995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80914:80990, ack 1000340, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.178807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1000340:1000428, ack 80990, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.180422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 80990:81108, ack 1000428, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.185938 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1000428:1001888, ack 81108, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.186145 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1001888:1003196, ack 81108, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:35.188714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1003196, win 4380, length 0 15:01:35.189108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81108:81153, ack 1003196, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.189761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1003196:1003235, ack 81153, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.192036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81153:81255, ack 1003235, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.192116 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1003235:1003339, ack 81255, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.193731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81255:81343, ack 1003339, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.193821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1003339:1003478, ack 81343, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.195830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81343:81419, ack 1003478, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.196672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1003478:1003550, ack 81419, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.198345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81419:81495, ack 1003550, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.199162 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1003550:1003638, ack 81495, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.200836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81495:81597, ack 1003638, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.214552 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1003638:1010938, ack 81597, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.214820 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1010938:1011126, ack 81597, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:35.218150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1006558, win 4380, length 0 15:01:35.221079 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1009478, win 4380, length 0 15:01:35.223842 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1011126, win 4380, length 0 15:01:35.224249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81597:81642, ack 1011126, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.224945 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1011126:1011165, ack 81642, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.227223 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81642:81744, ack 1011165, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.228104 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1011165:1011304, ack 81744, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.229697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81744:81820, ack 1011304, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.230528 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1011304:1011376, ack 81820, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.232070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81820:81896, ack 1011376, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.232872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1011376:1011464, ack 81896, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.234472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81896:81998, ack 1011464, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.236490 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1011464:1012184, ack 81998, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:35.244479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 81998:82043, ack 1012184, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.245178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1012184:1012223, ack 82043, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.247528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82043:82169, ack 1012223, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.247897 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1012223:1012327, ack 82169, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.249556 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82169:82257, ack 1012327, win 4079, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.249643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1012327:1012466, ack 82257, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.251201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82257:82333, ack 1012466, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.252040 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1012466:1012538, ack 82333, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.254100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82333:82409, ack 1012538, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.254938 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1012538:1012626, ack 82409, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.256555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82409:82535, ack 1012626, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.282841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1012626:1027226, ack 82535, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.288384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1015546, win 4380, length 0 15:01:35.290454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1018466, win 4380, length 0 15:01:35.290527 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1027226:1028686, ack 82535, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:35.290570 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1028686:1028930, ack 82535, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:35.293309 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1021386, win 4380, length 0 15:01:35.298510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1024306, win 4380, length 0 15:01:35.298960 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1027226, win 4380, length 0 15:01:35.300855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1028930, win 4380, length 0 15:01:35.304061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82535:82695, ack 1028930, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.330306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1028930:1044990, ack 82695, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.330659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1044990:1045350, ack 82695, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:35.334045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1031850, win 4380, length 0 15:01:35.337686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1034770, win 4380, length 0 15:01:35.340790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1037690, win 4380, length 0 15:01:35.343658 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1040610, win 4380, length 0 15:01:35.346504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1043530, win 4380, length 0 15:01:35.348411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1045350, win 4380, length 0 15:01:35.348972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82695:82811, ack 1045350, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.374600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1045350:1061410, ack 82811, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.374940 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1061410:1061694, ack 82811, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:35.378494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1048270, win 4380, length 0 15:01:35.383508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1051190, win 4380, length 0 15:01:35.386386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1054110, win 4380, length 0 15:01:35.389457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1057030, win 4380, length 0 15:01:35.392320 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1059950, win 4380, length 0 15:01:35.394937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1061694, win 4380, length 0 15:01:35.395007 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1061694:1061798, ack 82811, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.395479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82811:82852, ack 1061694, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:35.397416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82852:82940, ack 1061798, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.397505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1061798:1061837, ack 82940, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:35.399055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82940:82985, ack 1061837, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.399749 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1061837:1061876, ack 82985, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.402153 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 82985:83113, ack 1061876, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.403055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1061876:1062015, ack 83113, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.405291 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83113:83189, ack 1062015, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.406161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1062015:1062087, ack 83189, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.407753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83189:83265, ack 1062087, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.408589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1062087:1062175, ack 83265, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.410221 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83265:83393, ack 1062175, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.416767 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1062175:1065095, ack 83393, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.417006 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065095:1065595, ack 83393, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:35.420591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1065095, win 4380, length 0 15:01:35.422023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83393:83438, ack 1065595, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.422914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065595:1065634, ack 83438, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.425806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83438:83546, ack 1065634, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.426773 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065634:1065773, ack 83546, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.428351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83546:83622, ack 1065773, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.429246 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065773:1065845, ack 83622, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.430812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83622:83698, ack 1065845, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.430896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065845:1065949, ack 83698, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.433227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83698:83786, ack 1065949, win 4166, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.433308 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1065949:1066037, ack 83786, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.437478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83786:83894, ack 1066037, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.441305 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1066037:1067497, ack 83894, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:35.441519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1067497:1067933, ack 83894, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:35.445473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1067933, win 4380, length 0 15:01:35.445864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83894:83939, ack 1067933, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.446544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1067933:1067972, ack 83939, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.449944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 83939:84065, ack 1067972, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.450843 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1067972:1068111, ack 84065, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.452445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84065:84141, ack 1068111, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.453297 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1068111:1068183, ack 84141, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.454857 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84141:84217, ack 1068183, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.455706 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1068183:1068271, ack 84217, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.457333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84217:84343, ack 1068271, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.459362 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1068271:1068971, ack 84343, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:35.467440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84343:84388, ack 1068971, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.468148 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1068971:1069010, ack 84388, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.470594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84388:84522, ack 1069010, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.471470 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069010:1069149, ack 84522, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.473026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84522:84598, ack 1069149, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.473919 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069149:1069221, ack 84598, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.475462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84598:84674, ack 1069221, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.476324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069221:1069309, ack 84674, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.477986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84674:84808, ack 1069309, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.478066 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069309:1069413, ack 84808, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:35.480380 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84808:84896, ack 1069413, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:35.480467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069413:1069681, ack 84896, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:35.482177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84896:84941, ack 1069681, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.482854 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069681:1069720, ack 84941, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.485205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 84941:85075, ack 1069720, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:35.486107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069720:1069859, ack 85075, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:35.487657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85075:85151, ack 1069859, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.488513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069859:1069931, ack 85151, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:35.490076 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85151:85227, ack 1069931, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.490902 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1069931:1070019, ack 85227, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:35.492517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85227:85361, ack 1070019, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:35.495089 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1070019:1070959, ack 85361, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:35.497072 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85361:85406, ack 1070959, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:35.497769 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1070959:1070998, ack 85406, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:35.697367 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1070998, win 4370, length 0 15:01:36.492456 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2308:2367, ack 2144, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:36.493130 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2144:2203, ack 2367, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:36.517016 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 2203, win 8192, length 0 15:01:37.016240 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85406:85486, ack 1070998, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.017300 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1070998:1071102, ack 85486, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:37.019047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85486:85566, ack 1071102, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.019925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1071102:1071190, ack 85566, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.021536 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85566:85656, ack 1071190, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.022431 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1071190:1071329, ack 85656, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.024109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85656:85746, ack 1071329, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.024723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1071329:1071433, ack 85746, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.034005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1071433:1075813, ack 85746, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.036168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1072893, win 4380, length 0 15:01:37.036263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1075813:1075841, ack 85746, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:37.038261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1075813, win 4380, length 0 15:01:37.039441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85746:85834, ack 1075841, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.073720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 85834, win 3247, length 0 15:01:37.075579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85834:85879, ack 1075841, win 4373, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.075649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 85879, win 3247, length 0 15:01:37.076348 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1075841:1075880, ack 85879, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.078084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85879:85969, ack 1075880, win 4363, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.078965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1075880:1076019, ack 85969, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.083204 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 85969:86059, ack 1076019, win 4328, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.091645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1076019:1080399, ack 86059, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.091894 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1080399:1080427, ack 86059, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:37.094634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1078939, win 4380, length 0 15:01:37.096513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1080427, win 4380, length 0 15:01:37.097189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86059:86104, ack 1080427, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.097901 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1080427:1080466, ack 86104, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.104614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86104:86222, ack 1080466, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.105514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1080466:1080605, ack 86222, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.107152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86222:86298, ack 1080605, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.108000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1080605:1080677, ack 86298, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.109629 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86298:86374, ack 1080677, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.110462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1080677:1080765, ack 86374, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.112104 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86374:86492, ack 1080765, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.116699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1080765:1082225, ack 86492, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.117018 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1082225:1082965, ack 86492, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:37.119406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1082965, win 4380, length 0 15:01:37.119489 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1082965:1083069, ack 86492, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.119850 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86492:86537, ack 1082965, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.121095 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86537:86625, ack 1083069, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.121177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083069:1083108, ack 86625, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.123480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86625:86725, ack 1083108, win 4344, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.124403 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083108:1083247, ack 86725, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.126006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86725:86801, ack 1083247, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.126841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083247:1083319, ack 86801, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.128442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86801:86877, ack 1083319, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.129252 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083319:1083407, ack 86877, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.130886 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86877:86977, ack 1083407, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.132578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083407:1083987, ack 86977, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:37.134445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 86977:87022, ack 1083987, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.135140 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1083987:1084026, ack 87022, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.137419 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87022:87132, ack 1084026, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.138277 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084026:1084165, ack 87132, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.139893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87132:87208, ack 1084165, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.140727 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084165:1084237, ack 87208, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.142301 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87208:87284, ack 1084237, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.143147 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084237:1084325, ack 87284, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.144774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87284:87394, ack 1084325, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.146351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084325:1084821, ack 87394, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:37.148209 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87394:87439, ack 1084821, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.148900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084821:1084860, ack 87439, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.151175 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87439:87543, ack 1084860, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.151256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084860:1084964, ack 87543, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.152897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87543:87631, ack 1084964, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.152982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1084964:1085103, ack 87631, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.154553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87631:87707, ack 1085103, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.155579 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1085103:1085175, ack 87707, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.157151 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87707:87783, ack 1085175, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.157977 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1085175:1085263, ack 87783, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.159647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87783:87887, ack 1085263, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.179295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1085263:1096943, ack 87887, win 3247, length 11680WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.184365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1088183, win 4380, length 0 15:01:37.184463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1096943:1101323, ack 87887, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:37.184768 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1091103, win 4380, length 0 15:01:37.184835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101323:1101663, ack 87887, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:37.186179 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1094023, win 4380, length 0 15:01:37.188344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1096943, win 4380, length 0 15:01:37.190562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1099863, win 4380, length 0 15:01:37.192498 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1101663, win 4380, length 0 15:01:37.193019 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87887:87928, ack 1101663, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:37.193906 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101663:1101702, ack 87928, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:37.195521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87928:87973, ack 1101702, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.196211 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101702:1101741, ack 87973, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.198551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 87973:88083, ack 1101741, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.199433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101741:1101880, ack 88083, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.201036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88083:88159, ack 1101880, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.201873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101880:1101952, ack 88159, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.203450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88159:88235, ack 1101952, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.203872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1101952:1102056, ack 88235, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.206351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88235:88323, ack 1102056, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.206436 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1102056:1102144, ack 88323, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.208131 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88323:88433, ack 1102144, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.214401 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1102144:1105064, ack 88433, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.214639 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1105064:1105532, ack 88433, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:37.217269 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1105064, win 4380, length 0 15:01:37.218756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88433:88478, ack 1105532, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.224245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1105532:1105571, ack 88478, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.226579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88478:88580, ack 1105571, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.227370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1105571:1105710, ack 88580, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.228985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88580:88656, ack 1105710, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.229734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1105710:1105782, ack 88656, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.231334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88656:88732, ack 1105782, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.232058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1105782:1105870, ack 88732, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.233703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88732:88834, ack 1105870, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.239083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1105870:1108790, ack 88834, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.239312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1108790:1108882, ack 88834, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:37.241985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1108790, win 4380, length 0 15:01:37.243259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88834:88879, ack 1108882, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.243981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1108882:1108921, ack 88879, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.246289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88879:88975, ack 1108921, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.247165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1108921:1109060, ack 88975, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.248771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 88975:89051, ack 1109060, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.249603 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1109060:1109132, ack 89051, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.251201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89051:89127, ack 1109132, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.251571 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1109132:1109236, ack 89127, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.253185 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89127:89215, ack 1109236, win 4268, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.253267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1109236:1109324, ack 89215, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.254919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89215:89311, ack 1109324, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.257386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1109324:1110612, ack 89311, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:37.259638 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89311:89356, ack 1110612, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.260336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1110612:1110651, ack 89356, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.262632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89356:89464, ack 1110651, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.263496 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1110651:1110790, ack 89464, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.265088 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89464:89540, ack 1110790, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.265939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1110790:1110862, ack 89540, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.267513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89540:89616, ack 1110862, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.268340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1110862:1110950, ack 89616, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.270004 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89616:89724, ack 1110950, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.273015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1110950:1112410, ack 89724, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.273216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112410:1112418, ack 89724, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:37.275645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1112418, win 4380, length 0 15:01:37.276041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89724:89769, ack 1112418, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.276705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112418:1112457, ack 89769, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.279015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89769:89887, ack 1112457, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.279883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112457:1112596, ack 89887, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.281476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89887:89963, ack 1112596, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.282314 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112596:1112668, ack 89963, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.283887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 89963:90039, ack 1112668, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.284731 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112668:1112756, ack 90039, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.286370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90039:90157, ack 1112756, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.286733 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1112756:1112860, ack 90157, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.288392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90157:90245, ack 1112860, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.292459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1112860:1114320, ack 90245, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.292660 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1114320:1115628, ack 90245, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:37.295334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1115628, win 4380, length 0 15:01:37.308571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90245:90290, ack 1115628, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.309225 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1115628:1115667, ack 90290, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.311747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90290:90392, ack 1115667, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.312617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1115667:1115806, ack 90392, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.314468 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90392:90468, ack 1115806, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.315324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1115806:1115878, ack 90468, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.317147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90468:90544, ack 1115878, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.317956 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1115878:1115966, ack 90544, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.319730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90544:90646, ack 1115966, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.333346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1115966:1123266, ack 90646, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.333612 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123266:1123454, ack 90646, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:37.336976 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1118886, win 4380, length 0 15:01:37.339052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1121806, win 4380, length 0 15:01:37.340232 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1123454, win 4380, length 0 15:01:37.340730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90646:90691, ack 1123454, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.341404 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123454:1123493, ack 90691, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.343749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90691:90793, ack 1123493, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.344651 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123493:1123632, ack 90793, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.346899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90793:90869, ack 1123632, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.347738 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123632:1123704, ack 90869, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.349353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90869:90945, ack 1123704, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.350162 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123704:1123792, ack 90945, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.351810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 90945:91047, ack 1123792, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.351888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123792:1123896, ack 91047, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.353502 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91047:91135, ack 1123896, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.354207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1123896:1124616, ack 91135, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:37.356409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91135:91180, ack 1124616, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.357092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1124616:1124655, ack 91180, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.363429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91180:91306, ack 1124655, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.364351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1124655:1124794, ack 91306, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.365964 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91306:91382, ack 1124794, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.366805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1124794:1124866, ack 91382, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.368430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91382:91458, ack 1124866, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.369252 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1124866:1124954, ack 91458, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.371337 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91458:91584, ack 1124954, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.397597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1124954:1141014, ack 91584, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.400584 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1127874, win 4380, length 0 15:01:37.400674 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1141014:1141258, ack 91584, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:37.402717 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1130794, win 4380, length 0 15:01:37.404864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1133714, win 4380, length 0 15:01:37.407095 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1136634, win 4380, length 0 15:01:37.410988 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1139554, win 4380, length 0 15:01:37.412987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1141258, win 4380, length 0 15:01:37.413788 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91584:91744, ack 1141258, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.440066 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1141258:1157318, ack 91744, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.440409 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1157318:1157678, ack 91744, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:37.443043 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1144178, win 4380, length 0 15:01:37.445244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1147098, win 4380, length 0 15:01:37.447364 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1150018, win 4380, length 0 15:01:37.449581 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1152938, win 4380, length 0 15:01:37.453052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1155858, win 4380, length 0 15:01:37.453528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1157678, win 4380, length 0 15:01:37.453602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1157678:1157782, ack 91744, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.467997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91744:91860, ack 1157782, win 4354, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.468361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91860:91948, ack 1157782, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.493786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1157782:1173842, ack 91948, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.494132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1173842:1174126, ack 91948, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:37.496832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1160702, win 4380, length 0 15:01:37.498964 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1163622, win 4380, length 0 15:01:37.501865 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1166542, win 4380, length 0 15:01:37.503305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1169462, win 4380, length 0 15:01:37.506324 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1172382, win 4380, length 0 15:01:37.508358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1174126, win 4380, length 0 15:01:37.508862 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91948:91989, ack 1174126, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:37.509762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1174126:1174165, ack 91989, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:37.512840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 91989:92034, ack 1174165, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.513543 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1174165:1174204, ack 92034, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.516151 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92034:92162, ack 1174204, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.517079 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1174204:1174343, ack 92162, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.518688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92162:92238, ack 1174343, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.519533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1174343:1174415, ack 92238, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.521118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92238:92314, ack 1174415, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.521947 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1174415:1174503, ack 92314, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.523593 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92314:92442, ack 1174503, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.530158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1174503:1177423, ack 92442, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.530394 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1177423:1177923, ack 92442, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:37.533117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1177423, win 4380, length 0 15:01:37.534562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92442:92487, ack 1177923, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.535243 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1177923:1177962, ack 92487, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.537538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92487:92595, ack 1177962, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.537621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1177962:1178066, ack 92595, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.539300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92595:92683, ack 1178066, win 4219, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.539407 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1178066:1178205, ack 92683, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.540971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92683:92759, ack 1178205, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.541885 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1178205:1178277, ack 92759, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.543490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92759:92835, ack 1178277, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.544435 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1178277:1178365, ack 92835, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.546074 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92835:92943, ack 1178365, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.549896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1178365:1179825, ack 92943, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:37.550108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1179825:1180261, ack 92943, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:37.552580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1180261, win 4380, length 0 15:01:37.553071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92943:92988, ack 1180261, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.553791 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1180261:1180300, ack 92988, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.556206 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 92988:93114, ack 1180300, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.557107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1180300:1180439, ack 93114, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.558714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93114:93190, ack 1180439, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.559560 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1180439:1180511, ack 93190, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.561139 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93190:93266, ack 1180511, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.561960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1180511:1180599, ack 93266, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.563626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93266:93392, ack 1180599, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.565756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1180599:1181299, ack 93392, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:37.568090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93392:93437, ack 1181299, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.568786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181299:1181338, ack 93437, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.574943 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93437:93571, ack 1181338, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.575322 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181338:1181442, ack 93571, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:37.576984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93571:93659, ack 1181442, win 4084, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:37.577072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181442:1181581, ack 93659, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.578628 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93659:93735, ack 1181581, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.579471 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181581:1181653, ack 93735, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.581051 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93735:93811, ack 1181653, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.581868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181653:1181741, ack 93811, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.583504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93811:93945, ack 1181741, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.584797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1181741:1182009, ack 93945, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:37.586527 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93945:93990, ack 1182009, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.587208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1182009:1182048, ack 93990, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.589569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 93990:94124, ack 1182048, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:37.590443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1182048:1182187, ack 94124, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:37.592036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94124:94200, ack 1182187, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.592911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1182187:1182259, ack 94200, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:37.594834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94200:94276, ack 1182259, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.595671 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1182259:1182347, ack 94276, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:37.597311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94276:94410, ack 1182347, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:37.599758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1182347:1183287, ack 94410, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:37.601797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94410:94455, ack 1183287, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:37.602482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1183287:1183326, ack 94455, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:37.803348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1183326, win 4370, length 0 15:01:38.458343 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2367:2453, ack 2203, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:38.459510 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2203:2303, ack 2453, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:38.469072 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2453:2539, ack 2303, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:38.470150 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2303:2391, ack 2539, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:38.480608 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2539:2627, ack 2391, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:38.481677 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2391:2491, ack 2627, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:38.481967 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1183326:1183430, ack 94455, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:38.483121 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 2491, win 8192, length 0 15:01:38.483758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94455:94543, ack 1183430, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:38.491832 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2627:2715, ack 2491, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:38.492783 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2491:2579, ack 2715, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:38.502164 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2715:2820, ack 2579, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:38.502964 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2579:2618, ack 2820, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:38.523714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 94543, win 3247, length 0 15:01:38.646961 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 2618, win 8192, length 0 15:01:40.011349 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94543:94633, ack 1183430, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.011461 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 94633, win 3247, length 0 15:01:40.012507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1183430:1183569, ack 94633, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.014214 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94633:94713, ack 1183569, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.015115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1183569:1183673, ack 94713, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:40.016641 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94713:94793, ack 1183673, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.017513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1183673:1183761, ack 94793, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.019124 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94793:94883, ack 1183761, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.027658 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1183761:1188141, ack 94883, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.027910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1188141:1188169, ack 94883, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:40.033723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1186681, win 4380, length 0 15:01:40.034870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1188169, win 4380, length 0 15:01:40.036662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94883:94973, ack 1188169, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.037528 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1188169:1188308, ack 94973, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.039442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 94973:95018, ack 1188308, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.040136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1188308:1188347, ack 95018, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.041699 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95018:95108, ack 1188347, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.050136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1188347:1192727, ack 95108, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.050485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1192727:1192755, ack 95108, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:40.052920 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1191267, win 4380, length 0 15:01:40.055490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1192755, win 4380, length 0 15:01:40.055560 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1192755:1192859, ack 95108, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.056514 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95108:95153, ack 1192755, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.093750 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 95153, win 3247, length 0 15:01:40.252592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1192859, win 4354, length 0 15:01:40.252671 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1192859:1192898, ack 95153, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.270582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95153:95241, ack 1192898, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.270803 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 95241, win 3247, length 0 15:01:40.271412 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95241:95359, ack 1192898, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.271742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 95359, win 3247, length 0 15:01:40.272563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1192898:1193037, ack 95359, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.276966 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95359:95435, ack 1193037, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.277832 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1193037:1193109, ack 95435, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.279640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95435:95511, ack 1193109, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.280463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1193109:1193197, ack 95511, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.282264 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95511:95629, ack 1193197, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.286846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1193197:1194657, ack 95629, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.287053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1194657:1195397, ack 95629, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:40.290446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1195397, win 4380, length 0 15:01:40.290896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95629:95674, ack 1195397, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.291558 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195397:1195436, ack 95674, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.293908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95674:95774, ack 1195436, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.294797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195436:1195575, ack 95774, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.296362 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95774:95850, ack 1195575, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.297191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195575:1195647, ack 95850, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.298763 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95850:95926, ack 1195647, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.299137 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195647:1195751, ack 95926, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.300846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 95926:96014, ack 1195751, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.300930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195751:1195839, ack 96014, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.303103 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96014:96114, ack 1195839, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.304907 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1195839:1196419, ack 96114, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:40.306747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96114:96159, ack 1196419, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.307595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1196419:1196458, ack 96159, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.309929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96159:96269, ack 1196458, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.310806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1196458:1196597, ack 96269, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.312887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96269:96345, ack 1196597, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.313766 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1196597:1196669, ack 96345, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.316055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96345:96421, ack 1196669, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.316887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1196669:1196757, ack 96421, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.319030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96421:96531, ack 1196757, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.320564 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1196757:1197253, ack 96531, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:40.322337 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96531:96576, ack 1197253, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.323016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1197253:1197292, ack 96576, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.325341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96576:96680, ack 1197292, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.326216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1197292:1197431, ack 96680, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.327777 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96680:96756, ack 1197431, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.328647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1197431:1197503, ack 96756, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.330219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96756:96832, ack 1197503, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.331034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1197503:1197591, ack 96832, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.333343 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96832:96936, ack 1197591, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.352900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1197591:1207811, ack 96936, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.357507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1200511, win 4380, length 0 15:01:40.357611 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1207811:1212191, ack 96936, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:40.361256 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1203431, win 4380, length 0 15:01:40.361330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1212191:1213651, ack 96936, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:40.361371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1213651:1214095, ack 96936, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:01:40.365128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1206351, win 4380, length 0 15:01:40.368919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1209271, win 4380, length 0 15:01:40.372548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1212191, win 4380, length 0 15:01:40.376099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1214095, win 4380, length 0 15:01:40.376565 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96936:96977, ack 1214095, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:40.377072 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 96977:97065, ack 1214095, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.377601 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1214095:1214134, ack 97065, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:40.380066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97065:97110, ack 1214134, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.380752 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1214134:1214173, ack 97110, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.383100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97110:97220, ack 1214173, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.384044 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1214173:1214312, ack 97220, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.385620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97220:97296, ack 1214312, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.386468 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1214312:1214384, ack 97296, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.388718 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97296:97372, ack 1214384, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.389576 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1214384:1214472, ack 97372, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.391751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97372:97482, ack 1214472, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.397975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1214472:1217392, ack 97482, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.398206 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1217392:1217860, ack 97482, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:40.402601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1217392, win 4380, length 0 15:01:40.404830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97482:97527, ack 1217860, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.405505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1217860:1217899, ack 97527, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.407833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97527:97629, ack 1217899, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.408737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1217899:1218038, ack 97629, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.428503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97629:97705, ack 1218038, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.428588 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1218038:1218142, ack 97705, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.432251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97705:97793, ack 1218142, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.432334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1218142:1218214, ack 97793, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.434678 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97793:97869, ack 1218214, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.435517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1218214:1218302, ack 97869, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.437796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97869:97971, ack 1218302, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.443196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1218302:1221222, ack 97971, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.443428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221222:1221314, ack 97971, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:40.448282 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1221222, win 4380, length 0 15:01:40.448660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 97971:98016, ack 1221314, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.449332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221314:1221353, ack 98016, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.451712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98016:98112, ack 1221353, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.452587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221353:1221492, ack 98112, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.456686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98112:98188, ack 1221492, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.457539 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221492:1221564, ack 98188, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.459861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98188:98264, ack 1221564, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.460678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221564:1221652, ack 98264, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.462299 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98264:98360, ack 1221652, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.464807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1221652:1222940, ack 98360, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:40.467819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98360:98405, ack 1222940, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.468517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1222940:1222979, ack 98405, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.471683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98405:98513, ack 1222979, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.472550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1222979:1223118, ack 98513, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.474109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98513:98589, ack 1223118, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.474992 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1223118:1223190, ack 98589, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.476532 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98589:98665, ack 1223190, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.476613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1223190:1223294, ack 98665, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.478809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98665:98753, ack 1223294, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.478890 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1223294:1223382, ack 98753, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.482035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98753:98861, ack 1223382, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.485088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1223382:1224842, ack 98861, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.485294 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1224842:1224850, ack 98861, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:40.489970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1224850, win 4380, length 0 15:01:40.490437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98861:98906, ack 1224850, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.491095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1224850:1224889, ack 98906, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.494123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 98906:99024, ack 1224889, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.495010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1224889:1225028, ack 99024, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.497083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99024:99100, ack 1225028, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.497909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1225028:1225100, ack 99100, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.499479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99100:99176, ack 1225100, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.500336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1225100:1225188, ack 99176, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.502553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99176:99294, ack 1225188, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.508028 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1225188:1226648, ack 99294, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.508235 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1226648:1227956, ack 99294, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:40.512162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1227956, win 4380, length 0 15:01:40.512591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99294:99339, ack 1227956, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.513245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1227956:1227995, ack 99339, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.515607 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99339:99441, ack 1227995, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.516496 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1227995:1228134, ack 99441, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.518765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99441:99517, ack 1228134, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.520187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1228134:1228206, ack 99517, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.522372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99517:99593, ack 1228206, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.522460 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1228206:1228310, ack 99593, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.524622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99593:99681, ack 1228310, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.524712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1228310:1228398, ack 99681, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.526372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99681:99783, ack 1228398, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.540105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1228398:1235698, ack 99783, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.540385 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1235698:1235886, ack 99783, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:40.545650 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1231318, win 4380, length 0 15:01:40.550812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1234238, win 4380, length 0 15:01:40.555718 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1235886, win 4380, length 0 15:01:40.556108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99783:99828, ack 1235886, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.556909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1235886:1235925, ack 99828, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.559330 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99828:99930, ack 1235925, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.560266 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1235925:1236064, ack 99930, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.562529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 99930:100006, ack 1236064, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.563375 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1236064:1236136, ack 100006, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.565528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100006:100082, ack 1236136, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.566359 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1236136:1236224, ack 100082, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.567986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100082:100184, ack 1236224, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.569957 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1236224:1236944, ack 100184, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:40.578863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100184:100229, ack 1236944, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.579865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1236944:1236983, ack 100229, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.582221 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100229:100355, ack 1236983, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.583151 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1236983:1237122, ack 100355, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.585682 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100355:100431, ack 1237122, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.586557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1237122:1237194, ack 100431, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.589344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100431:100507, ack 1237194, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.589424 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1237194:1237298, ack 100507, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.591621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100507:100595, ack 1237298, win 4027, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.591706 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1237298:1237386, ack 100595, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.593871 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100595:100721, ack 1237386, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.620284 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1237386:1251986, ack 100721, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.625592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1240306, win 4380, length 0 15:01:40.630359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1243226, win 4380, length 0 15:01:40.630433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1251986:1253446, ack 100721, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:40.630476 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1253446:1253690, ack 100721, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:40.634250 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1246146, win 4380, length 0 15:01:40.638059 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1249066, win 4380, length 0 15:01:40.642903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1251986, win 4380, length 0 15:01:40.646356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1253690, win 4380, length 0 15:01:40.646965 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100721:100881, ack 1253690, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.673320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1253690:1269750, ack 100881, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.673720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1269750:1270110, ack 100881, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:40.677750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1256610, win 4380, length 0 15:01:40.681577 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1259530, win 4380, length 0 15:01:40.687888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1262450, win 4380, length 0 15:01:40.692526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1265370, win 4380, length 0 15:01:40.695425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1268290, win 4380, length 0 15:01:40.699899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1270110, win 4380, length 0 15:01:40.700432 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100881:100997, ack 1270110, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.726044 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1270110:1286170, ack 100997, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.726391 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286170:1286454, ack 100997, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:40.730547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1273030, win 4380, length 0 15:01:40.733440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1275950, win 4380, length 0 15:01:40.738571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1278870, win 4380, length 0 15:01:40.742259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1281790, win 4380, length 0 15:01:40.746113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1284710, win 4380, length 0 15:01:40.753031 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1286454, win 4380, length 0 15:01:40.753105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286454:1286558, ack 100997, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.753894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 100997:101038, ack 1286454, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:40.755138 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101038:101126, ack 1286558, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.755228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286558:1286597, ack 101126, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:40.756758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101126:101171, ack 1286597, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.757443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286597:1286636, ack 101171, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.759868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101171:101299, ack 1286636, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.760770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286636:1286775, ack 101299, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.762324 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101299:101375, ack 1286775, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.763161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286775:1286847, ack 101375, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.764700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101375:101451, ack 1286847, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.765538 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1286847:1286935, ack 101451, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.767148 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101451:101579, ack 1286935, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.773624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1286935:1289855, ack 101579, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.773903 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1289855:1290355, ack 101579, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:40.779552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1289855, win 4380, length 0 15:01:40.780976 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101579:101624, ack 1290355, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.781652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1290355:1290394, ack 101624, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.783988 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101624:101732, ack 1290394, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.784887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1290394:1290533, ack 101732, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.786440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101732:101808, ack 1290533, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.787278 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1290533:1290605, ack 101808, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.789632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101808:101884, ack 1290605, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.790442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1290605:1290693, ack 101884, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.792070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101884:101992, ack 1290693, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.792444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1290693:1290797, ack 101992, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.794541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 101992:102080, ack 1290797, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.796619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1290797:1292257, ack 102080, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:40.796818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1292257:1292693, ack 102080, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:40.800025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1292693, win 4380, length 0 15:01:40.800410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102080:102125, ack 1292693, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.801048 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1292693:1292732, ack 102125, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.803384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102125:102251, ack 1292732, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.804320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1292732:1292871, ack 102251, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.805869 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102251:102327, ack 1292871, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.806723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1292871:1292943, ack 102327, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.808870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102327:102403, ack 1292943, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.809695 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1292943:1293031, ack 102403, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.811310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102403:102529, ack 1293031, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.813322 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1293031:1293731, ack 102529, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:40.821198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102529:102574, ack 1293731, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.821901 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1293731:1293770, ack 102574, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.824235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102574:102708, ack 1293770, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.825169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1293770:1293909, ack 102708, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.826721 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102708:102784, ack 1293909, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.827560 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1293909:1293981, ack 102784, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.829117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102784:102860, ack 1293981, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.829930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1293981:1294069, ack 102860, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.831563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102860:102994, ack 1294069, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.832796 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294069:1294337, ack 102994, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:40.834464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 102994:103039, ack 1294337, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.834547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294337:1294441, ack 103039, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:40.836118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103039:103127, ack 1294441, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:40.836198 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294441:1294480, ack 103127, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:40.838621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103127:103261, ack 1294480, win 4344, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:40.839500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294480:1294619, ack 103261, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:40.841051 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103261:103337, ack 1294619, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.841888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294619:1294691, ack 103337, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:40.843430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103337:103413, ack 1294691, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.844312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294691:1294779, ack 103413, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:40.845929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103413:103547, ack 1294779, win 4269, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:40.848417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1294779:1295719, ack 103547, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:40.851197 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103547:103592, ack 1295719, win 4034, length 45SMB PACKET: SMBclose (REQUEST) 15:01:40.851896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1295719:1295758, ack 103592, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:41.048131 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1295758, win 4024, length 0 15:01:41.512337 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2820:2879, ack 2618, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:41.513005 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2618:2677, ack 2879, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:41.596133 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 2677, win 8192, length 0 15:01:42.367002 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103592:103682, ack 1295758, win 4024, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.368047 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1295758:1295897, ack 103682, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.369921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103682:103762, ack 1295897, win 4380, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.370798 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1295897:1296001, ack 103762, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:42.372945 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103762:103842, ack 1296001, win 4354, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.373834 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1296001:1296089, ack 103842, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.375439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103842:103932, ack 1296089, win 4332, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.383874 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1296089:1300469, ack 103932, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.384110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1300469:1300497, ack 103932, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:42.386784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1299009, win 4380, length 0 15:01:42.389025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1300497, win 4380, length 0 15:01:42.389101 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1300497:1300601, ack 103932, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.391219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 103932:104022, ack 1300497, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.423706 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 104022, win 3247, length 0 15:01:42.592589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1300601, win 4354, length 0 15:01:42.592690 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1300601:1300740, ack 104022, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.594409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104022:104110, ack 1300740, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.594485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 104110, win 3247, length 0 15:01:42.596051 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104110:104200, ack 1300740, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.596125 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 104200, win 3247, length 0 15:01:42.604633 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1300740:1305120, ack 104200, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.604876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305120:1305148, ack 104200, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:42.607492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1303660, win 4380, length 0 15:01:42.609416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1305148, win 4380, length 0 15:01:42.609793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104200:104245, ack 1305148, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.610464 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305148:1305187, ack 104245, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.612208 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104245:104290, ack 1305187, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.612887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305187:1305226, ack 104290, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.615202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104290:104408, ack 1305226, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.616118 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305226:1305365, ack 104408, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.617804 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104408:104484, ack 1305365, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.618654 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305365:1305437, ack 104484, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.620741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104484:104560, ack 1305437, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.621563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1305437:1305525, ack 104560, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.623416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104560:104678, ack 1305525, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.628746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1305525:1306985, ack 104678, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.629079 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1306985:1307725, ack 104678, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:42.633174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1307725, win 4380, length 0 15:01:42.633263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1307725:1307829, ack 104678, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.633611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104678:104723, ack 1307725, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.634891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104723:104811, ack 1307829, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.634980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1307829:1307868, ack 104811, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.637294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104811:104911, ack 1307868, win 4344, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.638177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1307868:1308007, ack 104911, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.639808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104911:104987, ack 1308007, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.640648 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308007:1308079, ack 104987, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.642220 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 104987:105063, ack 1308079, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.643070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308079:1308167, ack 105063, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.644703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105063:105163, ack 1308167, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.646447 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308167:1308747, ack 105163, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:42.648319 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105163:105208, ack 1308747, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.649014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308747:1308786, ack 105208, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.651866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105208:105318, ack 1308786, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.652742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308786:1308925, ack 105318, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.654326 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105318:105394, ack 1308925, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.655177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308925:1308997, ack 105394, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.656760 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105394:105470, ack 1308997, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.657585 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1308997:1309085, ack 105470, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.659233 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105470:105580, ack 1309085, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.660779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309085:1309581, ack 105580, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:42.663220 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105580:105625, ack 1309581, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.664004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309581:1309620, ack 105625, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.666271 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105625:105729, ack 1309620, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.666654 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309620:1309724, ack 105729, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.668335 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105729:105817, ack 1309724, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.668422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309724:1309863, ack 105817, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.669975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105817:105893, ack 1309863, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.670810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309863:1309935, ack 105893, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.672386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105893:105969, ack 1309935, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.673194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1309935:1310023, ack 105969, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.674834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 105969:106073, ack 1310023, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.694507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1310023:1320243, ack 106073, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.697526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1312943, win 4380, length 0 15:01:42.697621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1320243:1324623, ack 106073, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:42.699638 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1315863, win 4380, length 0 15:01:42.699711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1324623:1326083, ack 106073, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:42.699753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326083:1326423, ack 106073, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:42.701824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1318783, win 4380, length 0 15:01:42.703983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1321703, win 4380, length 0 15:01:42.706184 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1324623, win 4380, length 0 15:01:42.708194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1326423, win 4380, length 0 15:01:42.708675 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106073:106114, ack 1326423, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:42.709516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326423:1326462, ack 106114, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:42.711057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106114:106159, ack 1326462, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.711751 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326462:1326501, ack 106159, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.714032 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106159:106269, ack 1326501, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.714944 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326501:1326640, ack 106269, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.716537 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106269:106345, ack 1326640, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.717421 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326640:1326712, ack 106345, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.719181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106345:106421, ack 1326712, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.719564 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326712:1326816, ack 106421, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.738512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106421:106509, ack 1326816, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.738597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1326816:1326904, ack 106509, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.742859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106509:106619, ack 1326904, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.749078 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1326904:1329824, ack 106619, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.749315 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1329824:1330292, ack 106619, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:42.752054 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1329824, win 4380, length 0 15:01:42.753535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106619:106664, ack 1330292, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.754247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1330292:1330331, ack 106664, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.756883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106664:106766, ack 1330331, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.757766 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1330331:1330470, ack 106766, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.759381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106766:106842, ack 1330470, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.760214 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1330470:1330542, ack 106842, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.761794 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106842:106918, ack 1330542, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.762601 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1330542:1330630, ack 106918, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.764254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 106918:107020, ack 1330630, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.769649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1330630:1333550, ack 107020, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.769881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333550:1333642, ack 107020, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:42.772589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1333550, win 4380, length 0 15:01:42.773919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107020:107065, ack 1333642, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.774591 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333642:1333681, ack 107065, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.776864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107065:107161, ack 1333681, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.777727 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333681:1333820, ack 107161, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.779408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107161:107237, ack 1333820, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.780245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333820:1333892, ack 107237, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.781846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107237:107313, ack 1333892, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.781926 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333892:1333996, ack 107313, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.783529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107313:107401, ack 1333996, win 4268, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.783612 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1333996:1334084, ack 107401, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.785270 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107401:107497, ack 1334084, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.787736 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1334084:1335372, ack 107497, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:42.789935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107497:107542, ack 1335372, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.790662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1335372:1335411, ack 107542, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.792959 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107542:107650, ack 1335411, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.793885 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1335411:1335550, ack 107650, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.795491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107650:107726, ack 1335550, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.796335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1335550:1335622, ack 107726, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.798405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107726:107802, ack 1335622, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.799216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1335622:1335710, ack 107802, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.800861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107802:107910, ack 1335710, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.803891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1335710:1337170, ack 107910, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.804095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337170:1337178, ack 107910, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:42.806545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1337178, win 4380, length 0 15:01:42.806995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107910:107955, ack 1337178, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.807655 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337178:1337217, ack 107955, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.809975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 107955:108073, ack 1337217, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.810849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337217:1337356, ack 108073, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.812448 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108073:108149, ack 1337356, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.813335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337356:1337428, ack 108149, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.814912 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108149:108225, ack 1337428, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.815749 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337428:1337516, ack 108225, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.817383 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108225:108343, ack 1337516, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.817464 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1337516:1337620, ack 108343, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.819074 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108343:108431, ack 1337620, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.823187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1337620:1339080, ack 108431, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.823386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1339080:1340388, ack 108431, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:42.825992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1340388, win 4380, length 0 15:01:42.826441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108431:108476, ack 1340388, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.827125 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1340388:1340427, ack 108476, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.829448 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108476:108578, ack 1340427, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.830330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1340427:1340566, ack 108578, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.832528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108578:108654, ack 1340566, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.833363 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1340566:1340638, ack 108654, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.834970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108654:108730, ack 1340638, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.835979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1340638:1340726, ack 108730, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.837823 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108730:108832, ack 1340726, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.851505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1340726:1348026, ack 108832, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.851853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348026:1348214, ack 108832, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:42.855594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1343646, win 4380, length 0 15:01:42.859178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1346566, win 4380, length 0 15:01:42.859597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1348214, win 4380, length 0 15:01:42.863694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108832:108877, ack 1348214, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.864384 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348214:1348253, ack 108877, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.866866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108877:108979, ack 1348253, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.867762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348253:1348392, ack 108979, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.869537 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 108979:109055, ack 1348392, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.870378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348392:1348464, ack 109055, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.872093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109055:109131, ack 1348464, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.872464 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348464:1348568, ack 109131, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.874772 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109131:109219, ack 1348568, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.874857 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348568:1348656, ack 109219, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.876561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109219:109321, ack 1348656, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.878529 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1348656:1349376, ack 109321, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:42.881550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109321:109366, ack 1349376, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:42.882242 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1349376:1349415, ack 109366, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:42.884578 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109366:109492, ack 1349415, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:42.885504 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1349415:1349554, ack 109492, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:42.887186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109492:109568, ack 1349554, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.888032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1349554:1349626, ack 109568, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:42.889806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109568:109644, ack 1349626, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.890627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1349626:1349714, ack 109644, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:42.892298 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109644:109770, ack 1349714, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.918727 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1349714:1364314, ack 109770, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.921761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1352634, win 4380, length 0 15:01:42.923928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1355554, win 4380, length 0 15:01:42.924034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1364314:1365774, ack 109770, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:42.924082 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1365774:1366018, ack 109770, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:42.926093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1358474, win 4380, length 0 15:01:42.928373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1361394, win 4380, length 0 15:01:42.930493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1364314, win 4380, length 0 15:01:42.932400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1366018, win 4380, length 0 15:01:42.932982 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109770:109930, ack 1366018, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.959319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1366018:1382078, ack 109930, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.959683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1382078:1382438, ack 109930, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:42.962460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1368938, win 4380, length 0 15:01:42.964524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1371858, win 4380, length 0 15:01:42.966695 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1374778, win 4380, length 0 15:01:42.968855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1377698, win 4380, length 0 15:01:42.970986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1380618, win 4380, length 0 15:01:42.972967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1382438, win 4380, length 0 15:01:42.973033 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1382438:1382542, ack 109930, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:42.973553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 109930:110046, ack 1382438, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:42.975058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110046:110134, ack 1382542, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:42.999405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1382542:1398602, ack 110134, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:42.999744 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1398602:1398886, ack 110134, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:43.004020 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1385462, win 4380, length 0 15:01:43.014296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1388382, win 4380, length 0 15:01:43.014712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1391302, win 4380, length 0 15:01:43.015183 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1394222, win 4380, length 0 15:01:43.015621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1397142, win 4380, length 0 15:01:43.016013 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1398886, win 4380, length 0 15:01:43.016534 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110134:110175, ack 1398886, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:43.017397 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1398886:1398925, ack 110175, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:43.018973 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110175:110220, ack 1398925, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.019661 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1398925:1398964, ack 110220, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.022021 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110220:110348, ack 1398964, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.022927 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1398964:1399103, ack 110348, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:43.024544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110348:110424, ack 1399103, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.025446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1399103:1399175, ack 110424, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:43.027017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110424:110500, ack 1399175, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.027840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1399175:1399263, ack 110500, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.029526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110500:110628, ack 1399263, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.036035 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1399263:1402183, ack 110628, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:43.036265 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1402183:1402683, ack 110628, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:43.039754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1402183, win 4380, length 0 15:01:43.042668 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110628:110673, ack 1402683, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.042740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1402683:1402787, ack 110673, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:43.044792 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110673:110761, ack 1402787, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:43.044877 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1402787:1402826, ack 110761, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.047203 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110761:110869, ack 1402826, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.048087 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1402826:1402965, ack 110869, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:43.049712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110869:110945, ack 1402965, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.050555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1402965:1403037, ack 110945, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:43.052154 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 110945:111021, ack 1403037, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.052963 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1403037:1403125, ack 111021, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.054596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111021:111129, ack 1403125, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.058357 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1403125:1404585, ack 111129, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:43.058563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1404585:1405021, ack 111129, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:43.061958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1405021, win 4380, length 0 15:01:43.062356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111129:111174, ack 1405021, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.063050 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1405021:1405060, ack 111174, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.065859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111174:111300, ack 1405060, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.066781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1405060:1405199, ack 111300, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:43.068403 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111300:111376, ack 1405199, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.069252 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1405199:1405271, ack 111376, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:43.070834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111376:111452, ack 1405271, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.071655 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1405271:1405359, ack 111452, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.073291 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111452:111578, ack 1405359, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.075364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1405359:1406059, ack 111578, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:43.077530 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111578:111623, ack 1406059, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.077911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406059:1406163, ack 111623, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:43.083781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111623:111711, ack 1406163, win 4094, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:43.083867 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406163:1406202, ack 111711, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.086253 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111711:111845, ack 1406202, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.087142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406202:1406341, ack 111845, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:43.088753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111845:111921, ack 1406341, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.089625 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406341:1406413, ack 111921, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:43.091247 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111921:111997, ack 1406413, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.092069 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406413:1406501, ack 111997, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.093715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 111997:112131, ack 1406501, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.094975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406501:1406769, ack 112131, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:43.096677 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112131:112176, ack 1406769, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.097350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406769:1406808, ack 112176, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.099690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112176:112310, ack 1406808, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.100561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406808:1406947, ack 112310, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:43.102163 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112310:112386, ack 1406947, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.103000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1406947:1407019, ack 112386, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:43.104568 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112386:112462, ack 1407019, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.105411 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1407019:1407107, ack 112462, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.107045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112462:112596, ack 1407107, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.109536 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1407107:1408047, ack 112596, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:43.111584 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112596:112641, ack 1408047, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:43.112279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1408047:1408086, ack 112641, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:43.310143 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1408086, win 4370, length 0 15:01:43.480584 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2879:2965, ack 2677, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.481692 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2677:2777, ack 2965, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:43.482594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1408086:1408190, ack 112641, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:43.484443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112641:112729, ack 1408190, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:43.491450 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 2965:3051, ack 2777, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.492478 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2777:2865, ack 3051, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.501761 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3051:3139, ack 2865, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.502701 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2865:2965, ack 3139, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:43.512153 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3139:3227, ack 2965, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:43.513150 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 2965:3053, ack 3227, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:43.522506 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3227:3332, ack 3053, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:43.523295 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3053:3092, ack 3332, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:43.523713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 112729, win 3247, length 0 15:01:43.562248 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 3092, win 8192, length 0 15:01:45.002645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112729:112809, ack 1408190, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.002761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 112809, win 3247, length 0 15:01:45.003821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1408190:1408294, ack 112809, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:45.005569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112809:112889, ack 1408294, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.006442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1408294:1408382, ack 112889, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.008063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112889:112979, ack 1408382, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.008988 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1408382:1408521, ack 112979, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.010994 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 112979:113069, ack 1408521, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.019473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1408521:1412901, ack 113069, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.019735 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1412901:1412929, ack 113069, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:45.022403 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1411441, win 4380, length 0 15:01:45.025248 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1412929, win 4380, length 0 15:01:45.027345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113069:113159, ack 1412929, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.028495 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1412929:1413068, ack 113159, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.030426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113159:113204, ack 1413068, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.030831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1413068:1413172, ack 113204, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.228921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1413172, win 4319, length 0 15:01:45.229010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1413172:1413211, ack 113204, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.231092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113204:113294, ack 1413211, win 4309, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.239549 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1413211:1417591, ack 113294, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.239801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1417591:1417619, ack 113294, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:45.242559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1416131, win 4380, length 0 15:01:45.244481 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1417619, win 4380, length 0 15:01:45.244972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113294:113382, ack 1417619, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.283719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 113382, win 3247, length 0 15:01:45.285457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113382:113427, ack 1417619, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.285665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 113427, win 3247, length 0 15:01:45.286286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1417619:1417658, ack 113427, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.288690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113427:113545, ack 1417658, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.289650 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1417658:1417797, ack 113545, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.291377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113545:113621, ack 1417797, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.292218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1417797:1417869, ack 113621, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.295482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113621:113697, ack 1417869, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.296325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1417869:1417957, ack 113697, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.297993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113697:113815, ack 1417957, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.302502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1417957:1419417, ack 113815, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.302709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1419417:1420157, ack 113815, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:45.305239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1420157, win 4380, length 0 15:01:45.305669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113815:113860, ack 1420157, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.306336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420157:1420196, ack 113860, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.308750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113860:113960, ack 1420196, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.309623 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420196:1420335, ack 113960, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.311331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 113960:114036, ack 1420335, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.311416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420335:1420439, ack 114036, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.313066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114036:114124, ack 1420439, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.313147 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420439:1420511, ack 114124, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.315108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114124:114200, ack 1420511, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.315945 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420511:1420599, ack 114200, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.317592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114200:114300, ack 1420599, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.319344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1420599:1421179, ack 114300, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:45.321229 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114300:114345, ack 1421179, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.321914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1421179:1421218, ack 114345, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.324197 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114345:114455, ack 1421218, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.325141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1421218:1421357, ack 114455, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.326738 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114455:114531, ack 1421357, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.327573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1421357:1421429, ack 114531, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.329162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114531:114607, ack 1421429, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.329973 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1421429:1421517, ack 114607, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.331607 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114607:114717, ack 1421517, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.333138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1421517:1422013, ack 114717, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:45.334971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114717:114762, ack 1422013, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.335671 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1422013:1422052, ack 114762, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.338732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114762:114866, ack 1422052, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.339587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1422052:1422191, ack 114866, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.341311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114866:114942, ack 1422191, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.342135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1422191:1422263, ack 114942, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.343733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 114942:115018, ack 1422263, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.344598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1422263:1422351, ack 115018, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.346239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115018:115122, ack 1422351, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.346319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1422351:1422455, ack 115122, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.347955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115122:115210, ack 1422455, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.366188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1422455:1432675, ack 115210, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.370095 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1425375, win 4380, length 0 15:01:45.370199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1432675:1437055, ack 115210, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:45.372117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1428295, win 4380, length 0 15:01:45.372187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1437055:1438515, ack 115210, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:45.372229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1438515:1438855, ack 115210, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:45.375084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1431215, win 4380, length 0 15:01:45.376439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1434135, win 4380, length 0 15:01:45.378633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1437055, win 4380, length 0 15:01:45.380540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1438855, win 4380, length 0 15:01:45.381055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115210:115251, ack 1438855, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:45.381875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1438855:1438894, ack 115251, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:45.383408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115251:115296, ack 1438894, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.384147 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1438894:1438933, ack 115296, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.386461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115296:115406, ack 1438933, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.387356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1438933:1439072, ack 115406, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.388958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115406:115482, ack 1439072, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.389800 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1439072:1439144, ack 115482, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.391383 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115482:115558, ack 1439144, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.392196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1439144:1439232, ack 115558, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.394499 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115558:115668, ack 1439232, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.400631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1439232:1442152, ack 115668, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.400864 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442152:1442620, ack 115668, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:45.403485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1442152, win 4380, length 0 15:01:45.405009 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115668:115713, ack 1442620, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.405090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442620:1442724, ack 115713, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.406725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115713:115801, ack 1442724, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.406808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442724:1442763, ack 115801, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.409144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115801:115903, ack 1442763, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.410061 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442763:1442902, ack 115903, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.411664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115903:115979, ack 1442902, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.412521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442902:1442974, ack 115979, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.414092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 115979:116055, ack 1442974, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.414934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1442974:1443062, ack 116055, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.416573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116055:116157, ack 1443062, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.421932 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1443062:1445982, ack 116157, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.422167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1445982:1446074, ack 116157, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:45.425365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1445982, win 4380, length 0 15:01:45.425812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116157:116202, ack 1446074, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.426527 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1446074:1446113, ack 116202, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.428825 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116202:116298, ack 1446113, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.429703 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1446113:1446252, ack 116298, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.431300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116298:116374, ack 1446252, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.432141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1446252:1446324, ack 116374, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.433751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116374:116450, ack 1446324, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.434587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1446324:1446412, ack 116450, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.436923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116450:116546, ack 1446412, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.439366 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1446412:1447700, ack 116546, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:45.441580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116546:116591, ack 1447700, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.442263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1447700:1447739, ack 116591, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.444561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116591:116699, ack 1447739, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.444644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1447739:1447843, ack 116699, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.446292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116699:116787, ack 1447843, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.446378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1447843:1447982, ack 116787, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.448057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116787:116863, ack 1447982, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.448925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1447982:1448054, ack 116863, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.450648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116863:116939, ack 1448054, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.451465 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1448054:1448142, ack 116939, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.453236 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 116939:117047, ack 1448142, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.456258 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1448142:1449602, ack 117047, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.456461 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1449602:1449610, ack 117047, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:45.459761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1449610, win 4380, length 0 15:01:45.467652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117047:117092, ack 1449610, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.468324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1449610:1449649, ack 117092, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.471210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117092:117210, ack 1449649, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.472259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1449649:1449788, ack 117210, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.474014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117210:117286, ack 1449788, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.474879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1449788:1449860, ack 117286, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.476643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117286:117362, ack 1449860, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.477462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1449860:1449948, ack 117362, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.479993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117362:117480, ack 1449948, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.485542 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1449948:1451408, ack 117480, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.485753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1451408:1452716, ack 117480, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:45.488399 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1452716, win 4380, length 0 15:01:45.488811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117480:117525, ack 1452716, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.489462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1452716:1452755, ack 117525, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.491824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117525:117627, ack 1452755, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.491904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1452755:1452859, ack 117627, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.493558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117627:117715, ack 1452859, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.493643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1452859:1452998, ack 117715, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.495325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117715:117791, ack 1452998, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.496202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1452998:1453070, ack 117791, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.497846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117791:117867, ack 1453070, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.498668 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1453070:1453158, ack 117867, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.500780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117867:117969, ack 1453158, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.514547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1453158:1460458, ack 117969, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.514818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460458:1460646, ack 117969, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:45.517444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1456078, win 4380, length 0 15:01:45.519554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1458998, win 4380, length 0 15:01:45.521483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1460646, win 4380, length 0 15:01:45.522379 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 117969:118014, ack 1460646, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.523045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460646:1460685, ack 118014, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.525465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118014:118116, ack 1460685, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.526524 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460685:1460824, ack 118116, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.528162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118116:118192, ack 1460824, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.529015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460824:1460896, ack 118192, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.530620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118192:118268, ack 1460896, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.531444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460896:1460984, ack 118268, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.533076 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118268:118370, ack 1460984, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.535472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1460984:1461704, ack 118370, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:45.543720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118370:118415, ack 1461704, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.544465 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1461704:1461743, ack 118415, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.546848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118415:118541, ack 1461743, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.546931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1461743:1461847, ack 118541, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.548631 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118541:118629, ack 1461847, win 4079, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.548719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1461847:1461986, ack 118629, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.550310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118629:118705, ack 1461986, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.551158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1461986:1462058, ack 118705, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.552728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118705:118781, ack 1462058, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.553583 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1462058:1462146, ack 118781, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.555234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118781:118907, ack 1462146, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.582580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1462146:1476746, ack 118907, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.585620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1465066, win 4380, length 0 15:01:45.587783 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1467986, win 4380, length 0 15:01:45.587861 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1476746:1478206, ack 118907, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:45.587905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1478206:1478450, ack 118907, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:45.589987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1470906, win 4380, length 0 15:01:45.592085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1473826, win 4380, length 0 15:01:45.594123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1476746, win 4380, length 0 15:01:45.595973 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1478450, win 4380, length 0 15:01:45.596682 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 118907:119067, ack 1478450, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.622998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1478450:1494510, ack 119067, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.623358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1494510:1494870, ack 119067, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:45.627882 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1481370, win 4380, length 0 15:01:45.629284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1484290, win 4380, length 0 15:01:45.631397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1487210, win 4380, length 0 15:01:45.633476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1490130, win 4380, length 0 15:01:45.635520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1493050, win 4380, length 0 15:01:45.637503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1494870, win 4380, length 0 15:01:45.638191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119067:119183, ack 1494870, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.663760 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1494870:1510930, ack 119183, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.664219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1510930:1511214, ack 119183, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:45.666809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1497790, win 4380, length 0 15:01:45.668902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1500710, win 4380, length 0 15:01:45.671061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1503630, win 4380, length 0 15:01:45.675720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1506550, win 4380, length 0 15:01:45.676090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1509470, win 4380, length 0 15:01:45.678099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1511214, win 4380, length 0 15:01:45.678167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511214:1511318, ack 119183, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.678563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119183:119224, ack 1511214, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:45.679809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119224:119312, ack 1511318, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.679897 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511318:1511357, ack 119312, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:45.681488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119312:119357, ack 1511357, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.682161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511357:1511396, ack 119357, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.684590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119357:119485, ack 1511396, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.685510 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511396:1511535, ack 119485, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.687093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119485:119561, ack 1511535, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.687941 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511535:1511607, ack 119561, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.689541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119561:119637, ack 1511607, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.690354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1511607:1511695, ack 119637, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.691994 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119637:119765, ack 1511695, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.698543 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1511695:1514615, ack 119765, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.698786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1514615:1515115, ack 119765, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:45.702467 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1514615, win 4380, length 0 15:01:45.705278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119765:119810, ack 1515115, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.705965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1515115:1515154, ack 119810, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.708385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119810:119918, ack 1515154, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.709272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1515154:1515293, ack 119918, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.710867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119918:119994, ack 1515293, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.710952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1515293:1515397, ack 119994, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.712614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 119994:120082, ack 1515397, win 4184, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.712696 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1515397:1515469, ack 120082, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.714320 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120082:120158, ack 1515469, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.715174 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1515469:1515557, ack 120158, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.716812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120158:120266, ack 1515557, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.720576 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1515557:1517017, ack 120266, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:45.720782 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517017:1517453, ack 120266, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:45.723279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1517453, win 4380, length 0 15:01:45.723642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120266:120311, ack 1517453, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.724417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517453:1517492, ack 120311, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.726807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120311:120437, ack 1517492, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.727693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517492:1517631, ack 120437, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.729292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120437:120513, ack 1517631, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.730123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517631:1517703, ack 120513, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.731700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120513:120589, ack 1517703, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.732548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517703:1517791, ack 120589, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.734178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120589:120715, ack 1517791, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.736221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1517791:1518491, ack 120715, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:45.744252 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120715:120760, ack 1518491, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.744954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518491:1518530, ack 120760, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.747469 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120760:120894, ack 1518530, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.748350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518530:1518669, ack 120894, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.749970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120894:120970, ack 1518669, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.750806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518669:1518741, ack 120970, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.753041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 120970:121046, ack 1518741, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.753122 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518741:1518845, ack 121046, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:45.754725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121046:121134, ack 1518845, win 4032, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:45.754809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518845:1518933, ack 121134, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.756479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121134:121268, ack 1518933, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.757784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1518933:1519201, ack 121268, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:45.759512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121268:121313, ack 1519201, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.760202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1519201:1519240, ack 121313, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.762664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121313:121447, ack 1519240, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:45.763551 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1519240:1519379, ack 121447, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:45.765765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121447:121523, ack 1519379, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.766627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1519379:1519451, ack 121523, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:45.768228 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121523:121599, ack 1519451, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.769337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1519451:1519539, ack 121599, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:45.770988 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121599:121733, ack 1519539, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:45.773477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1519539:1520479, ack 121733, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:45.775485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121733:121778, ack 1520479, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:45.776222 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1520479:1520518, ack 121778, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:45.977690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1520518, win 4370, length 0 15:01:46.532670 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3332:3391, ack 3092, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:01:46.533328 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3092:3151, ack 3391, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:01:46.675261 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 3151, win 8192, length 0 15:01:47.280836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121778:121858, ack 1520518, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.281873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1520518:1520622, ack 121858, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:47.283626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121858:121938, ack 1520622, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.284514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1520622:1520710, ack 121938, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.286120 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 121938:122028, ack 1520710, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.286506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1520710:1520814, ack 122028, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.475368 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1520814, win 4296, length 0 15:01:47.475457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1520814:1520953, ack 122028, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.477301 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122028:122116, ack 1520953, win 4261, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.513710 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 122116, win 3247, length 0 15:01:47.515312 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122116:122206, ack 1520953, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.515372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 122206, win 3247, length 0 15:01:47.523814 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1520953:1525333, ack 122206, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.524061 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1525333:1525361, ack 122206, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:47.527753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1523873, win 4380, length 0 15:01:47.529665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1525361, win 4380, length 0 15:01:47.531497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122206:122296, ack 1525361, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.532360 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1525361:1525500, ack 122296, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.534281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122296:122341, ack 1525500, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.534996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1525500:1525539, ack 122341, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.536573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122341:122431, ack 1525539, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.544996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1525539:1529919, ack 122431, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.545234 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1529919:1529947, ack 122431, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:47.550815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1528459, win 4380, length 0 15:01:47.551144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1529947, win 4380, length 0 15:01:47.551636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122431:122476, ack 1529947, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.552299 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1529947:1529986, ack 122476, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.558790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122476:122594, ack 1529986, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.560779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1529986:1530125, ack 122594, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.562402 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122594:122670, ack 1530125, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.563290 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1530125:1530197, ack 122670, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.564858 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122670:122746, ack 1530197, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.565248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1530197:1530301, ack 122746, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.566874 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122746:122834, ack 1530301, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.566959 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1530301:1530389, ack 122834, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.568649 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122834:122952, ack 1530389, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.573185 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1530389:1531849, ack 122952, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.573395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1531849:1532589, ack 122952, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:47.575941 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1532589, win 4380, length 0 15:01:47.576307 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122952:122997, ack 1532589, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.576984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1532589:1532628, ack 122997, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.579331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 122997:123097, ack 1532628, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.580209 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1532628:1532767, ack 123097, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.581806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123097:123173, ack 1532767, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.582638 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1532767:1532839, ack 123173, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.584771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123173:123249, ack 1532839, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.585607 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1532839:1532927, ack 123249, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.587240 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123249:123349, ack 1532927, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.588939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1532927:1533507, ack 123349, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:47.591049 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123349:123394, ack 1533507, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.591778 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533507:1533546, ack 123394, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.594041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123394:123504, ack 1533546, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.594936 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533546:1533685, ack 123504, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.596517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123504:123580, ack 1533685, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.597358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533685:1533757, ack 123580, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.598936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123580:123656, ack 1533757, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.599753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533757:1533845, ack 123656, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.601393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123656:123766, ack 1533845, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.601759 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533845:1533949, ack 123766, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.603376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123766:123854, ack 1533949, win 4040, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.603466 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1533949:1534445, ack 123854, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:47.605300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123854:123899, ack 1534445, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.605983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1534445:1534484, ack 123899, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.608304 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 123899:124003, ack 1534484, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.609164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1534484:1534623, ack 124003, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.611782 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124003:124079, ack 1534623, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.612610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1534623:1534695, ack 124079, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.614176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124079:124155, ack 1534695, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.615043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1534695:1534783, ack 124155, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.616974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124155:124259, ack 1534783, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.636592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1534783:1545003, ack 124259, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.644552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1537703, win 4380, length 0 15:01:47.644651 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1545003:1549383, ack 124259, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:47.644984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1540623, win 4380, length 0 15:01:47.645058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1549383:1550843, ack 124259, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:47.645099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1550843:1551183, ack 124259, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:47.645591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1543543, win 4380, length 0 15:01:47.647705 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1546463, win 4380, length 0 15:01:47.651535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1549383, win 4380, length 0 15:01:47.653476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1551183, win 4380, length 0 15:01:47.653968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124259:124300, ack 1551183, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:47.654831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551183:1551222, ack 124300, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:47.656397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124300:124345, ack 1551222, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.657091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551222:1551261, ack 124345, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.659408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124345:124455, ack 1551261, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.660085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551261:1551365, ack 124455, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.661751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124455:124543, ack 1551365, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.661864 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551365:1551504, ack 124543, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.663412 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124543:124619, ack 1551504, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.664358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551504:1551576, ack 124619, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.665938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124619:124695, ack 1551576, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.666770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1551576:1551664, ack 124695, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.668429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124695:124805, ack 1551664, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.674718 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1551664:1554584, ack 124805, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.674951 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1554584:1555052, ack 124805, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:47.677573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1554584, win 4380, length 0 15:01:47.679706 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124805:124850, ack 1555052, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.680375 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1555052:1555091, ack 124850, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.682667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124850:124952, ack 1555091, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.683546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1555091:1555230, ack 124952, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.685136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 124952:125028, ack 1555230, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.686028 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1555230:1555302, ack 125028, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.687602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125028:125104, ack 1555302, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.688423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1555302:1555390, ack 125104, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.690080 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125104:125206, ack 1555390, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.695560 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1555390:1558310, ack 125206, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.695792 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558310:1558402, ack 125206, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:47.698390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1558310, win 4380, length 0 15:01:47.699670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125206:125251, ack 1558402, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.700337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558402:1558441, ack 125251, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.702608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125251:125347, ack 1558441, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.702999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558441:1558545, ack 125347, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.704648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125347:125435, ack 1558545, win 4321, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.704740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558545:1558684, ack 125435, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.706289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125435:125511, ack 1558684, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.707135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558684:1558756, ack 125511, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.708729 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125511:125587, ack 1558756, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.709550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558756:1558844, ack 125587, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.711186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125587:125683, ack 1558844, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.713850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1558844:1560132, ack 125683, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:47.716031 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125683:125728, ack 1560132, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.716737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1560132:1560171, ack 125728, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.719060 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125728:125836, ack 1560171, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.719927 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1560171:1560310, ack 125836, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.721528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125836:125912, ack 1560310, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.722361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1560310:1560382, ack 125912, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.723928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125912:125988, ack 1560382, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.724809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1560382:1560470, ack 125988, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.726467 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 125988:126096, ack 1560470, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.729458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1560470:1561930, ack 126096, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.729664 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1561930:1561938, ack 126096, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:47.732128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1561938, win 4380, length 0 15:01:47.732555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126096:126141, ack 1561938, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.733213 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1561938:1561977, ack 126141, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.735538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126141:126259, ack 1561977, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.736436 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1561977:1562116, ack 126259, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.738584 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126259:126335, ack 1562116, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.738965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1562116:1562220, ack 126335, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.740662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126335:126423, ack 1562220, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.740744 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1562220:1562292, ack 126423, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.742352 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126423:126499, ack 1562292, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.743164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1562292:1562380, ack 126499, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.744806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126499:126617, ack 1562380, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.750293 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1562380:1563840, ack 126617, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.750502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1563840:1565148, ack 126617, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:47.754548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1565148, win 4380, length 0 15:01:47.755008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126617:126662, ack 1565148, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.755683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1565148:1565187, ack 126662, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.774754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126662:126764, ack 1565187, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.775665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1565187:1565326, ack 126764, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.779066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126764:126840, ack 1565326, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.779900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1565326:1565398, ack 126840, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.781721 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126840:126916, ack 1565398, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.782572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1565398:1565486, ack 126916, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.784446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 126916:127018, ack 1565486, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.798020 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1565486:1572786, ack 127018, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.798290 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1572786:1572974, ack 127018, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:47.801025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1568406, win 4380, length 0 15:01:47.803090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1571326, win 4380, length 0 15:01:47.805011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1572974, win 4380, length 0 15:01:47.805430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127018:127063, ack 1572974, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.806109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1572974:1573013, ack 127063, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.808461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127063:127165, ack 1573013, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.808844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1573013:1573117, ack 127165, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.810497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127165:127253, ack 1573117, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.810584 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1573117:1573256, ack 127253, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.812136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127253:127329, ack 1573256, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.812969 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1573256:1573328, ack 127329, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.814540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127329:127405, ack 1573328, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.815379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1573328:1573416, ack 127405, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.818035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127405:127507, ack 1573416, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.819973 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1573416:1574136, ack 127507, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:47.822190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127507:127552, ack 1574136, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.822879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1574136:1574175, ack 127552, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.829255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127552:127678, ack 1574175, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.830151 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1574175:1574314, ack 127678, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.831753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127678:127754, ack 1574314, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.832597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1574314:1574386, ack 127754, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.834222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127754:127830, ack 1574386, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.835056 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1574386:1574474, ack 127830, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.836723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127830:127956, ack 1574474, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.863154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1574474:1589074, ack 127956, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.868113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1577394, win 4380, length 0 15:01:47.870189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1580314, win 4380, length 0 15:01:47.870265 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1589074:1590534, ack 127956, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:47.870308 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1590534:1590778, ack 127956, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:47.872341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1583234, win 4380, length 0 15:01:47.875406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1586154, win 4380, length 0 15:01:47.877543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1589074, win 4380, length 0 15:01:47.879594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1590778, win 4380, length 0 15:01:47.879960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1590778:1590882, ack 127956, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.880168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 127956:128116, ack 1590778, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.881707 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128116:128204, ack 1590882, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.906768 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1590882:1606942, ack 128204, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.907112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1606942:1607302, ack 128204, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:47.909845 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1593802, win 4380, length 0 15:01:47.912791 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1596722, win 4380, length 0 15:01:47.918813 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1599642, win 4380, length 0 15:01:47.919246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1602562, win 4380, length 0 15:01:47.921522 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1605482, win 4380, length 0 15:01:47.922812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1607302, win 4380, length 0 15:01:47.924142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128204:128320, ack 1607302, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.949852 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1607302:1623362, ack 128320, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.950183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623362:1623646, ack 128320, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:47.952872 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1610222, win 4380, length 0 15:01:47.955828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1613142, win 4380, length 0 15:01:47.960322 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1616062, win 4380, length 0 15:01:47.964030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1618982, win 4380, length 0 15:01:47.964411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1621902, win 4380, length 0 15:01:47.966445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1623646, win 4380, length 0 15:01:47.966931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128320:128361, ack 1623646, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:47.967812 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623646:1623685, ack 128361, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:47.969388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128361:128406, ack 1623685, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.970075 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623685:1623724, ack 128406, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.972435 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128406:128534, ack 1623724, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.973335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623724:1623863, ack 128534, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.974923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128534:128610, ack 1623863, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.975781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623863:1623935, ack 128610, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:47.977356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128610:128686, ack 1623935, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.977734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1623935:1624039, ack 128686, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:47.979359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128686:128774, ack 1624039, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:47.979443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1624039:1624127, ack 128774, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:47.981117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128774:128902, ack 1624127, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.987675 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1624127:1627047, ack 128902, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:47.987905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1627047:1627547, ack 128902, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:47.990576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1627047, win 4380, length 0 15:01:47.991982 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128902:128947, ack 1627547, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:47.992657 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1627547:1627586, ack 128947, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:47.994970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 128947:129055, ack 1627586, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:47.995862 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1627586:1627725, ack 129055, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:47.997465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129055:129131, ack 1627725, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:47.998347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1627725:1627797, ack 129131, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:48.000604 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129131:129207, ack 1627797, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.001421 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1627797:1627885, ack 129207, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.003060 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129207:129315, ack 1627885, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.008094 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1627885:1629345, ack 129315, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:48.008315 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1629345:1629781, ack 129315, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:48.010812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1629781, win 4380, length 0 15:01:48.011205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129315:129360, ack 1629781, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:48.011879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1629781:1629820, ack 129360, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:48.014171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129360:129486, ack 1629820, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:48.015086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1629820:1629959, ack 129486, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:48.016686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129486:129562, ack 1629959, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.017533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1629959:1630031, ack 129562, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:48.019134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129562:129638, ack 1630031, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.019521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1630031:1630135, ack 129638, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:48.021148 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129638:129726, ack 1630135, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:48.021232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1630135:1630223, ack 129726, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.022952 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129726:129852, ack 1630223, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.025080 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1630223:1630923, ack 129852, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:48.027265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129852:129897, ack 1630923, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:48.027954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1630923:1630962, ack 129897, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:48.034311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 129897:130031, ack 1630962, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:48.035528 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1630962:1631101, ack 130031, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:48.037133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130031:130107, ack 1631101, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.038196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631101:1631173, ack 130107, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:48.039807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130107:130183, ack 1631173, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.040647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631173:1631261, ack 130183, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.042306 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130183:130317, ack 1631261, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.043584 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631261:1631529, ack 130317, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:48.045289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130317:130362, ack 1631529, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:48.045997 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631529:1631568, ack 130362, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:48.048359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130362:130496, ack 1631568, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:48.049248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631568:1631707, ack 130496, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:48.050855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130496:130572, ack 1631707, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.051702 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631707:1631779, ack 130572, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:48.053331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130572:130648, ack 1631779, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.054259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631779:1631867, ack 130648, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.055899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130648:130782, ack 1631867, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.058414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1631867:1632807, ack 130782, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:48.060575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130782:130827, ack 1632807, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:48.060981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1632807:1632911, ack 130827, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:48.062591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130827:130915, ack 1632911, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:48.062675 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1632911:1632950, ack 130915, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:48.255316 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1632950, win 4344, length 0 15:01:48.501426 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3391:3477, ack 3151, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.502542 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3151:3251, ack 3477, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:48.512376 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3477:3563, ack 3251, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.513410 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3251:3339, ack 3563, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.522656 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3563:3651, ack 3339, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.523605 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3339:3439, ack 3651, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:01:48.533545 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3651:3739, ack 3439, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:01:48.534520 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3439:3527, ack 3739, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:48.543867 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [P.], seq 3739:3844, ack 3527, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:01:48.544692 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [P.], seq 3527:3566, ack 3844, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:01:48.641375 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [.], ack 3566, win 8192, length 0 15:01:49.590053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 130915:131005, ack 1632950, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.591144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1632950:1633089, ack 131005, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.593007 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131005:131085, ack 1633089, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.593948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1633089:1633193, ack 131085, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:49.595989 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131085:131165, ack 1633193, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.596839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1633193:1633281, ack 131165, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.598444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131165:131255, ack 1633281, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.606886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1633281:1637661, ack 131255, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:49.607136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1637661:1637689, ack 131255, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:49.609748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1636201, win 4380, length 0 15:01:49.611700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1637689, win 4380, length 0 15:01:49.613820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131255:131345, ack 1637689, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.614192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1637689:1637793, ack 131345, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:49.815305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1637793, win 4354, length 0 15:01:49.815399 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1637793:1637932, ack 131345, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.817152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131345:131433, ack 1637932, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:49.853722 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 131433, win 3247, length 0 15:01:49.855330 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131433:131523, ack 1637932, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.855391 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 131523, win 3247, length 0 15:01:49.863959 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1637932:1642312, ack 131523, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:49.864212 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642312:1642340, ack 131523, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:49.867915 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1640852, win 4380, length 0 15:01:49.869775 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1642340, win 4380, length 0 15:01:49.870267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131523:131568, ack 1642340, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.870943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642340:1642379, ack 131568, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.872660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131568:131613, ack 1642379, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.873332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642379:1642418, ack 131613, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.875631 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131613:131731, ack 1642418, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.876529 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642418:1642557, ack 131731, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.878273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131731:131807, ack 1642557, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.879106 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642557:1642629, ack 131807, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:49.880818 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131807:131883, ack 1642629, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.881627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1642629:1642717, ack 131883, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.883460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 131883:132001, ack 1642717, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.887996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1642717:1644177, ack 132001, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:49.888202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1644177:1644917, ack 132001, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:49.891579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1644917, win 4380, length 0 15:01:49.892064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132001:132046, ack 1644917, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.892723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1644917:1644956, ack 132046, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.895121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132046:132146, ack 1644956, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.895204 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1644956:1645060, ack 132146, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:49.896863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132146:132234, ack 1645060, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:49.896948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645060:1645199, ack 132234, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.898521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132234:132310, ack 1645199, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.899361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645199:1645271, ack 132310, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:49.900944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132310:132386, ack 1645271, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.901770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645271:1645359, ack 132386, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.903812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132386:132486, ack 1645359, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.905555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645359:1645939, ack 132486, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:49.907394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132486:132531, ack 1645939, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.908076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645939:1645978, ack 132531, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.911050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132531:132641, ack 1645978, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.911952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1645978:1646117, ack 132641, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.913536 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132641:132717, ack 1646117, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.914421 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646117:1646189, ack 132717, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:49.915995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132717:132793, ack 1646189, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.916811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646189:1646277, ack 132793, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.918463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132793:132903, ack 1646277, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.919986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646277:1646773, ack 132903, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:49.921799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132903:132948, ack 1646773, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.922479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646773:1646812, ack 132948, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.924849 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 132948:133052, ack 1646812, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.925720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646812:1646951, ack 133052, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.927372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133052:133128, ack 1646951, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.928206 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1646951:1647023, ack 133128, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:49.929832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133128:133204, ack 1647023, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.929911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1647023:1647127, ack 133204, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:49.931516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133204:133292, ack 1647127, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:49.931596 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1647127:1647215, ack 133292, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.933319 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133292:133396, ack 1647215, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.953070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1647215:1657435, ack 133396, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:49.957061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1650135, win 4380, length 0 15:01:49.957164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1657435:1661815, ack 133396, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:49.959289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1653055, win 4380, length 0 15:01:49.959359 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1661815:1663275, ack 133396, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:49.959401 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663275:1663615, ack 133396, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:49.962102 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1655975, win 4380, length 0 15:01:49.967010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1658895, win 4380, length 0 15:01:49.967460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1661815, win 4380, length 0 15:01:49.969492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1663615, win 4380, length 0 15:01:49.969921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133396:133437, ack 1663615, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:49.970766 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663615:1663654, ack 133437, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:49.972310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133437:133482, ack 1663654, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.972999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663654:1663693, ack 133482, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.975370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133482:133592, ack 1663693, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.976282 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663693:1663832, ack 133592, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:49.977876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133592:133668, ack 1663832, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.978715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663832:1663904, ack 133668, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:49.981338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133668:133744, ack 1663904, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.982149 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1663904:1663992, ack 133744, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:49.983780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133744:133854, ack 1663992, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:49.989928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1663992:1666912, ack 133854, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:49.990271 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1666912:1667380, ack 133854, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:49.992883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1666912, win 4380, length 0 15:01:49.994425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133854:133899, ack 1667380, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:49.994500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1667380:1667484, ack 133899, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:49.996109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133899:133987, ack 1667484, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:49.996192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1667484:1667523, ack 133987, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:49.998489 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 133987:134089, ack 1667523, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:49.999372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1667523:1667662, ack 134089, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.000981 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134089:134165, ack 1667662, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.002029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1667662:1667734, ack 134165, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.003613 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134165:134241, ack 1667734, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.005073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1667734:1667822, ack 134241, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.006718 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134241:134343, ack 1667822, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.012193 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1667822:1670742, ack 134343, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.012441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1670742:1670834, ack 134343, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:50.015701 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1670742, win 4380, length 0 15:01:50.016182 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134343:134388, ack 1670834, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.016875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1670834:1670873, ack 134388, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.019212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134388:134484, ack 1670873, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.020103 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1670873:1671012, ack 134484, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.021710 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134484:134560, ack 1671012, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.022605 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1671012:1671084, ack 134560, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.024202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134560:134636, ack 1671084, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.025043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1671084:1671172, ack 134636, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.026676 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134636:134732, ack 1671172, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.029135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1671172:1672460, ack 134732, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:50.032365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134732:134777, ack 1672460, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.032451 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1672460:1672564, ack 134777, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.034065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134777:134865, ack 1672564, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.034149 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1672564:1672603, ack 134865, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.036425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134865:134973, ack 1672603, win 4344, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.037302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1672603:1672742, ack 134973, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.038921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 134973:135049, ack 1672742, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.039758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1672742:1672814, ack 135049, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.041346 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135049:135125, ack 1672814, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.042196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1672814:1672902, ack 135125, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.043828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135125:135233, ack 1672902, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.046845 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1672902:1674362, ack 135233, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.047052 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1674362:1674370, ack 135233, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:50.050338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1674370, win 4380, length 0 15:01:50.050800 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135233:135278, ack 1674370, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.051460 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1674370:1674409, ack 135278, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.053766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135278:135396, ack 1674409, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.054659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1674409:1674548, ack 135396, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.056259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135396:135472, ack 1674548, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.057102 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1674548:1674620, ack 135472, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.058690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135472:135548, ack 1674620, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.059510 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1674620:1674708, ack 135548, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.061146 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135548:135666, ack 1674708, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.066822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1674708:1676168, ack 135666, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.067033 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1676168:1677476, ack 135666, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:50.070489 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1677476, win 4380, length 0 15:01:50.070576 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1677476:1677580, ack 135666, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.070943 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135666:135711, ack 1677476, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.072246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135711:135799, ack 1677580, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.072332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1677580:1677619, ack 135799, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.074616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135799:135901, ack 1677619, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.075508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1677619:1677758, ack 135901, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.077110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135901:135977, ack 1677758, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.077948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1677758:1677830, ack 135977, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.079570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 135977:136053, ack 1677830, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.080386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1677830:1677918, ack 136053, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.082019 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136053:136155, ack 1677918, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.095806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1677918:1685218, ack 136155, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.096075 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685218:1685406, ack 136155, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:50.099870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1680838, win 4380, length 0 15:01:50.102050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1683758, win 4380, length 0 15:01:50.104116 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1685406, win 4380, length 0 15:01:50.115622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136155:136200, ack 1685406, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.116317 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685406:1685445, ack 136200, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.118815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136200:136302, ack 1685445, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.119712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685445:1685584, ack 136302, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.121492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136302:136378, ack 1685584, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.122336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685584:1685656, ack 136378, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.124060 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [F.], seq 3844, ack 3566, win 8192, length 0 15:01:50.124325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136378:136454, ack 1685656, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.130321 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:50.131592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685656:1685744, ack 136454, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.133437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136454:136556, ack 1685744, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.133896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685744:1685848, ack 136556, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.135514 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136556:136644, ack 1685848, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.135976 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1685848:1686568, ack 136644, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:50.138195 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136644:136689, ack 1686568, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.138875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1686568:1686607, ack 136689, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.146463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136689:136815, ack 1686607, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.147383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1686607:1686746, ack 136815, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.148996 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136815:136891, ack 1686746, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.149840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1686746:1686818, ack 136891, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.151455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136891:136967, ack 1686818, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.152267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1686818:1686906, ack 136967, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.153912 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 136967:137093, ack 1686906, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.180225 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1686906:1701506, ack 137093, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.183155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1689826, win 4380, length 0 15:01:50.185265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1692746, win 4380, length 0 15:01:50.185345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1701506:1702966, ack 137093, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:50.185389 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1702966:1703210, ack 137093, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:50.187408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1695666, win 4380, length 0 15:01:50.190564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1698586, win 4380, length 0 15:01:50.193427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1701506, win 4380, length 0 15:01:50.196404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1703210, win 4380, length 0 15:01:50.196999 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137093:137253, ack 1703210, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.223235 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1703210:1719270, ack 137253, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.223580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1719270:1719630, ack 137253, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:50.227018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1706130, win 4380, length 0 15:01:50.230010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1709050, win 4380, length 0 15:01:50.231392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1711970, win 4380, length 0 15:01:50.233572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1714890, win 4380, length 0 15:01:50.235764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1717810, win 4380, length 0 15:01:50.237774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1719630, win 4380, length 0 15:01:50.237841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1719630:1719734, ack 137253, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.238411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137253:137369, ack 1719630, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.239639 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137369:137457, ack 1719734, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.264258 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1719734:1735794, ack 137457, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.264598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1735794:1736078, ack 137457, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:50.267328 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1722654, win 4380, length 0 15:01:50.269599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1725574, win 4380, length 0 15:01:50.282488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1728494, win 4380, length 0 15:01:50.282932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1731414, win 4380, length 0 15:01:50.283353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1734334, win 4380, length 0 15:01:50.283788 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1736078, win 4380, length 0 15:01:50.284294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137457:137498, ack 1736078, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:50.285153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1736078:1736117, ack 137498, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:50.286728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137498:137543, ack 1736117, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.287412 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1736117:1736156, ack 137543, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.289851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137543:137671, ack 1736156, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.290760 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1736156:1736295, ack 137671, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.292353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137671:137747, ack 1736295, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.293207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1736295:1736367, ack 137747, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.294770 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137747:137823, ack 1736367, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.295617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1736367:1736455, ack 137823, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.297898 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137823:137951, ack 1736455, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.304454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1736455:1739375, ack 137951, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.304690 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1739375:1739875, ack 137951, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:50.307370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1739375, win 4380, length 0 15:01:50.308805 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137951:137996, ack 1739875, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.309168 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1739875:1739979, ack 137996, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.310781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 137996:138084, ack 1739979, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.310865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1739979:1740018, ack 138084, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.314610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138084:138192, ack 1740018, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.315512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1740018:1740157, ack 138192, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.317104 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138192:138268, ack 1740157, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.317948 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1740157:1740229, ack 138268, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.319586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138268:138344, ack 1740229, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.320450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1740229:1740317, ack 138344, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.322093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138344:138452, ack 1740317, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.326509 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1740317:1741777, ack 138452, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:50.326729 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1741777:1742213, ack 138452, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:50.329142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1742213, win 4380, length 0 15:01:50.329571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138452:138497, ack 1742213, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.330264 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1742213:1742252, ack 138497, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.332637 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138497:138623, ack 1742252, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.333537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1742252:1742391, ack 138623, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.335121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138623:138699, ack 1742391, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.335981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1742391:1742463, ack 138699, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.337552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138699:138775, ack 1742463, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.338376 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1742463:1742551, ack 138775, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.340039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138775:138901, ack 1742551, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.342115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1742551:1743251, ack 138901, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:50.350169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138901:138946, ack 1743251, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.350880 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743251:1743290, ack 138946, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.353281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 138946:139080, ack 1743290, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.353659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743290:1743394, ack 139080, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:50.355337 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139080:139168, ack 1743394, win 4084, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:50.355427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743394:1743533, ack 139168, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.357011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139168:139244, ack 1743533, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.357867 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743533:1743605, ack 139244, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.359486 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139244:139320, ack 1743605, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.360312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743605:1743693, ack 139320, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.362411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139320:139454, ack 1743693, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.363745 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743693:1743961, ack 139454, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:50.365457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139454:139499, ack 1743961, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.366167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1743961:1744000, ack 139499, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.368580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139499:139633, ack 1744000, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:50.369488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1744000:1744139, ack 139633, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:50.371082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139633:139709, ack 1744139, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.371931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1744139:1744211, ack 139709, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:50.373501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139709:139785, ack 1744211, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.374368 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1744211:1744299, ack 139785, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:50.376006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139785:139919, ack 1744299, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:50.378459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1744299:1745239, ack 139919, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:50.380555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139919:139964, ack 1745239, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:50.381241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1745239:1745278, ack 139964, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:50.383723 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:50.579671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1745278, win 4370, length 0 15:01:50.903718 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:51.883037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 139964:140044, ack 1745278, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:51.884131 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1745278:1745382, ack 140044, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:51.885961 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140044:140124, ack 1745382, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:51.886051 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1745382:1745486, ack 140124, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:51.943720 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:52.077285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1745486, win 4318, length 0 15:01:52.077382 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1745486:1745574, ack 140124, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.079100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140124:140214, ack 1745574, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.080032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1745574:1745713, ack 140214, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.081704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140214:140302, ack 1745713, win 4261, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.113709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 140302, win 3247, length 0 15:01:52.115284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140302:140392, ack 1745713, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.115346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 140392, win 3247, length 0 15:01:52.123772 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1745713:1750093, ack 140392, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.124019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1750093:1750121, ack 140392, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:52.126791 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1748633, win 4380, length 0 15:01:52.128715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1750121, win 4380, length 0 15:01:52.130540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140392:140482, ack 1750121, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.131413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1750121:1750260, ack 140482, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.133333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140482:140527, ack 1750260, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.134083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1750260:1750299, ack 140527, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.135669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140527:140617, ack 1750299, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.144155 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1750299:1754679, ack 140617, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.144400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1754679:1754707, ack 140617, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:52.147078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1753219, win 4380, length 0 15:01:52.149048 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1754707, win 4380, length 0 15:01:52.149885 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140617:140662, ack 1754707, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.150559 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1754707:1754746, ack 140662, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.157253 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140662:140780, ack 1754746, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.158156 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1754746:1754885, ack 140780, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.159896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140780:140856, ack 1754885, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.159979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1754885:1754989, ack 140856, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.161597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140856:140944, ack 1754989, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.161682 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1754989:1755061, ack 140944, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.163301 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 140944:141020, ack 1755061, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.164182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1755061:1755149, ack 141020, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.165832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141020:141138, ack 1755149, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.170331 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1755149:1756609, ack 141138, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.170537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1756609:1757349, ack 141138, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:52.173127 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1757349, win 4380, length 0 15:01:52.173577 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141138:141183, ack 1757349, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.174295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1757349:1757388, ack 141183, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.176583 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141183:141283, ack 1757388, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.177461 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1757388:1757527, ack 141283, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.179071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141283:141359, ack 1757527, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.179906 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1757527:1757599, ack 141359, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.181484 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141359:141435, ack 1757599, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.182300 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1757599:1757687, ack 141435, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.183944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141435:141535, ack 1757687, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.185694 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1757687:1758267, ack 141535, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:52.188445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141535:141580, ack 1758267, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.189133 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758267:1758306, ack 141580, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.191416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141580:141690, ack 1758306, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.192273 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758306:1758445, ack 141690, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.193860 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141690:141766, ack 1758445, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.194707 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758445:1758517, ack 141766, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.197308 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141766:141842, ack 1758517, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.197390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758517:1758621, ack 141842, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.199008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141842:141930, ack 1758621, win 4062, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.199089 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758621:1758709, ack 141930, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.200749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 141930:142040, ack 1758709, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.202288 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1758709:1759205, ack 142040, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:52.204099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142040:142085, ack 1759205, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.204797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1759205:1759244, ack 142085, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.207078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142085:142189, ack 1759244, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.207937 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1759244:1759383, ack 142189, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.209570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142189:142265, ack 1759383, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.210435 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1759383:1759455, ack 142265, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.213021 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142265:142341, ack 1759455, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.213893 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1759455:1759543, ack 142341, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.215517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142341:142445, ack 1759543, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.235110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1759543:1769763, ack 142445, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.238172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1762463, win 4380, length 0 15:01:52.238275 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1769763:1774143, ack 142445, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:52.240336 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1765383, win 4380, length 0 15:01:52.240406 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1774143:1775603, ack 142445, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:52.240448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1775603:1775943, ack 142445, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:52.245181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1768303, win 4380, length 0 15:01:52.246559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1771223, win 4380, length 0 15:01:52.251639 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1774143, win 4380, length 0 15:01:52.252019 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1775943, win 4380, length 0 15:01:52.254971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142445:142486, ack 1775943, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:52.255834 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1775943:1775982, ack 142486, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:52.259751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142486:142531, ack 1775982, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.259832 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1775982:1776086, ack 142531, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.263446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142531:142619, ack 1776086, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.263530 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1776086:1776125, ack 142619, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.266058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142619:142729, ack 1776125, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.266956 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1776125:1776264, ack 142729, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.268634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142729:142805, ack 1776264, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.269506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1776264:1776336, ack 142805, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.271105 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142805:142881, ack 1776336, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.271922 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1776336:1776424, ack 142881, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.273595 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142881:142991, ack 1776424, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.279721 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1776424:1779344, ack 142991, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.279957 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1779344:1779812, ack 142991, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:52.282659 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1779344, win 4380, length 0 15:01:52.284832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 142991:143036, ack 1779812, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.285567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1779812:1779851, ack 143036, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.287892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143036:143138, ack 1779851, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.288771 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1779851:1779990, ack 143138, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.290390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143138:143214, ack 1779990, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.291227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1779990:1780062, ack 143214, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.292803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143214:143290, ack 1780062, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.293614 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1780062:1780150, ack 143290, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.295236 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143290:143392, ack 1780150, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.300619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1780150:1783070, ack 143392, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.300846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783070:1783162, ack 143392, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:52.303461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1783070, win 4380, length 0 15:01:52.304767 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143392:143437, ack 1783162, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.304840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783162:1783266, ack 143437, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.306440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143437:143525, ack 1783266, win 4331, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.306522 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783266:1783305, ack 143525, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.309372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143525:143621, ack 1783305, win 4321, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.310239 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783305:1783444, ack 143621, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.311846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143621:143697, ack 1783444, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.312674 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783444:1783516, ack 143697, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.314240 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143697:143773, ack 1783516, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.315065 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783516:1783604, ack 143773, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.316715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143773:143869, ack 1783604, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.319151 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1783604:1784892, ack 143869, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:52.321831 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143869:143914, ack 1784892, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.322521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1784892:1784931, ack 143914, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.324784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 143914:144022, ack 1784931, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.325662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1784931:1785070, ack 144022, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.327272 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144022:144098, ack 1785070, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.328138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1785070:1785142, ack 144098, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.329731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144098:144174, ack 1785142, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.330537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1785142:1785230, ack 144174, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.332170 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144174:144282, ack 1785230, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.335214 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1785230:1786690, ack 144282, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.335418 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1786690:1786698, ack 144282, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:52.338751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1786698, win 4380, length 0 15:01:52.339133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144282:144327, ack 1786698, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.339479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1786698:1786802, ack 144327, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.341098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144327:144415, ack 1786802, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.341181 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1786802:1786841, ack 144415, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.343520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144415:144533, ack 1786841, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.344442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1786841:1786980, ack 144533, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.346032 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144533:144609, ack 1786980, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.346876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1786980:1787052, ack 144609, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.348474 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144609:144685, ack 1787052, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.349327 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1787052:1787140, ack 144685, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.350966 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144685:144803, ack 1787140, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.356444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1787140:1788600, ack 144803, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.356649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1788600:1789908, ack 144803, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:52.359284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1789908, win 4380, length 0 15:01:52.376284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144803:144848, ack 1789908, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.376953 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1789908:1789947, ack 144848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.379828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144848:144950, ack 1789947, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.380705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1789947:1790086, ack 144950, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.382459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 144950:145026, ack 1790086, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.383330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1790086:1790158, ack 145026, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.385152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145026:145102, ack 1790158, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.385980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1790158:1790246, ack 145102, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.387725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145102:145204, ack 1790246, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.401380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1790246:1797546, ack 145204, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.401652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1797546:1797734, ack 145204, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:52.404339 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1793166, win 4380, length 0 15:01:52.406483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1796086, win 4380, length 0 15:01:52.409399 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1797734, win 4380, length 0 15:01:52.409479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1797734:1797838, ack 145204, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.409861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145204:145249, ack 1797734, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.411141 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145249:145337, ack 1797838, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.411226 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1797838:1797877, ack 145337, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.413538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145337:145439, ack 1797877, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.414472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1797877:1798016, ack 145439, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.416074 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145439:145515, ack 1798016, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.416915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1798016:1798088, ack 145515, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.418516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145515:145591, ack 1798088, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.419334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1798088:1798176, ack 145591, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.421018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145591:145693, ack 1798176, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.422965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1798176:1798896, ack 145693, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:52.425142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145693:145738, ack 1798896, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.425848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1798896:1798935, ack 145738, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.432235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145738:145864, ack 1798935, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.433105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1798935:1799074, ack 145864, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.434700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145864:145940, ack 1799074, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.435547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1799074:1799146, ack 145940, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.437133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 145940:146016, ack 1799146, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.437984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1799146:1799234, ack 146016, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.440081 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146016:146142, ack 1799234, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.466384 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1799234:1813834, ack 146142, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.470296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1802154, win 4380, length 0 15:01:52.473369 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1805074, win 4380, length 0 15:01:52.473443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1813834:1815294, ack 146142, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:52.473485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1815294:1815538, ack 146142, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:52.475485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1807994, win 4380, length 0 15:01:52.477574 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1810914, win 4380, length 0 15:01:52.479733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1813834, win 4380, length 0 15:01:52.481633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1815538, win 4380, length 0 15:01:52.481697 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1815538:1815642, ack 146142, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.482245 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146142:146302, ack 1815538, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.484239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146302:146390, ack 1815642, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.508839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1815642:1831702, ack 146390, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.509185 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1831702:1832062, ack 146390, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:52.513769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1818562, win 4380, length 0 15:01:52.515873 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1821482, win 4380, length 0 15:01:52.521188 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1824402, win 4380, length 0 15:01:52.521643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1827322, win 4380, length 0 15:01:52.523146 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1830242, win 4380, length 0 15:01:52.525193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1832062, win 4380, length 0 15:01:52.528547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146390:146506, ack 1832062, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.554131 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1832062:1848122, ack 146506, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.554473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848122:1848406, ack 146506, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:52.557089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1834982, win 4380, length 0 15:01:52.559908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1837902, win 4380, length 0 15:01:52.561289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1840822, win 4380, length 0 15:01:52.566098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1843742, win 4380, length 0 15:01:52.569496 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1846662, win 4380, length 0 15:01:52.569868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1848406, win 4380, length 0 15:01:52.570332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146506:146547, ack 1848406, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:52.571276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848406:1848445, ack 146547, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:52.572828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146547:146592, ack 1848445, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.573533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848445:1848484, ack 146592, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.575921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146592:146720, ack 1848484, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.576846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848484:1848623, ack 146720, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.578470 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146720:146796, ack 1848623, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.578554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848623:1848727, ack 146796, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.580172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146796:146884, ack 1848727, win 4299, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.580268 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848727:1848799, ack 146884, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.581876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146884:146960, ack 1848799, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.582755 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1848799:1848887, ack 146960, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.584405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 146960:147088, ack 1848887, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.590998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1848887:1851807, ack 147088, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.591240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1851807:1852307, ack 147088, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:52.593973 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1851807, win 4380, length 0 15:01:52.595330 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147088:147133, ack 1852307, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.596020 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1852307:1852346, ack 147133, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.598355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147133:147241, ack 1852346, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.599256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1852346:1852485, ack 147241, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.601647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147241:147317, ack 1852485, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.602499 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1852485:1852557, ack 147317, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.604064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147317:147393, ack 1852557, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.604917 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1852557:1852645, ack 147393, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.606557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147393:147501, ack 1852645, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.610321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1852645:1854105, ack 147501, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:52.610530 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854105:1854541, ack 147501, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:52.613439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1854541, win 4380, length 0 15:01:52.613876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147501:147546, ack 1854541, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.614597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854541:1854580, ack 147546, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.616898 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147546:147672, ack 1854580, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.618072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854580:1854719, ack 147672, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.619696 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147672:147748, ack 1854719, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.619782 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854719:1854823, ack 147748, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.621390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147748:147836, ack 1854823, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.621473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854823:1854895, ack 147836, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.623075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147836:147912, ack 1854895, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.623971 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854895:1854983, ack 147912, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.625642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 147912:148038, ack 1854983, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.627679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1854983:1855683, ack 148038, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:52.629880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148038:148083, ack 1855683, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.630568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1855683:1855722, ack 148083, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.636728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148083:148217, ack 1855722, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.637643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1855722:1855861, ack 148217, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.639249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148217:148293, ack 1855861, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.640132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1855861:1855933, ack 148293, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.641714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148293:148369, ack 1855933, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.642545 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1855933:1856021, ack 148369, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.644187 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148369:148503, ack 1856021, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.645457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856021:1856289, ack 148503, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:52.647178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148503:148548, ack 1856289, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.647865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856289:1856328, ack 148548, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.650203 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148548:148682, ack 1856328, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:52.651079 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856328:1856467, ack 148682, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:52.652675 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148682:148758, ack 1856467, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.653515 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856467:1856539, ack 148758, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:52.655088 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148758:148834, ack 1856539, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.655943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856539:1856627, ack 148834, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:52.657606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148834:148968, ack 1856627, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:52.657688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856627:1856731, ack 148968, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:52.659314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 148968:149056, ack 1856731, win 4202, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:52.660473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1856731:1857671, ack 149056, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:52.662519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149056:149101, ack 1857671, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:52.663201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1857671:1857710, ack 149101, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:52.857263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1857710, win 4370, length 0 15:01:54.023732 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:54.175509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149101:149181, ack 1857710, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.176531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1857710:1857814, ack 149181, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:54.178704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149181:149261, ack 1857814, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.179587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1857814:1857902, ack 149261, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.181199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149261:149351, ack 1857902, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.182070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1857902:1858041, ack 149351, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.184041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149351:149441, ack 1858041, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.192452 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1858041:1862421, ack 149441, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.192699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1862421:1862449, ack 149441, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:54.197553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1860961, win 4380, length 0 15:01:54.197993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1862449, win 4380, length 0 15:01:54.199432 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149441:149531, ack 1862449, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.200301 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1862449:1862588, ack 149531, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.203636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149531:149576, ack 1862588, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.204380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1862588:1862627, ack 149576, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.206047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149576:149666, ack 1862627, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.214453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1862627:1867007, ack 149666, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.214691 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867007:1867035, ack 149666, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:54.219481 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1865547, win 4380, length 0 15:01:54.219956 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1867035, win 4380, length 0 15:01:54.220028 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867035:1867139, ack 149666, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.220424 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149666:149711, ack 1867035, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.253709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 149711, win 3247, length 0 15:01:54.417562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1867139, win 4354, length 0 15:01:54.417638 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867139:1867178, ack 149711, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.436895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149711:149799, ack 1867178, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.437103 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 149799, win 3247, length 0 15:01:54.439110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149799:149917, ack 1867178, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.439340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 149917, win 3247, length 0 15:01:54.440158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867178:1867317, ack 149917, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.442774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149917:149993, ack 1867317, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.443611 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867317:1867389, ack 149993, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.445372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 149993:150069, ack 1867389, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.446201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1867389:1867477, ack 150069, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.447851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150069:150187, ack 1867477, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.452326 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1867477:1868937, ack 150187, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.452528 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1868937:1869677, ack 150187, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:54.456665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1869677, win 4380, length 0 15:01:54.457044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150187:150232, ack 1869677, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.457752 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1869677:1869716, ack 150232, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.460182 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150232:150332, ack 1869716, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.461064 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1869716:1869855, ack 150332, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.462657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150332:150408, ack 1869855, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.463494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1869855:1869927, ack 150408, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.466107 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150408:150484, ack 1869927, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.466939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1869927:1870015, ack 150484, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.468617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150484:150584, ack 1870015, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.468695 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870015:1870119, ack 150584, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.470310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150584:150672, ack 1870119, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.470659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870119:1870699, ack 150672, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:54.472535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150672:150717, ack 1870699, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.473212 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870699:1870738, ack 150717, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.475577 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150717:150827, ack 1870738, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.476467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870738:1870877, ack 150827, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.478066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150827:150903, ack 1870877, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.478901 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870877:1870949, ack 150903, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.480520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150903:150979, ack 1870949, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.481369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1870949:1871037, ack 150979, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.483005 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 150979:151089, ack 1871037, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.484605 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1871037:1871533, ack 151089, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:54.486417 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151089:151134, ack 1871533, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.487278 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1871533:1871572, ack 151134, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.489904 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151134:151238, ack 1871572, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.490773 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1871572:1871711, ack 151238, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.492368 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151238:151314, ack 1871711, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.493199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1871711:1871783, ack 151314, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.494762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151314:151390, ack 1871783, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.495595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1871783:1871871, ack 151390, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.497968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151390:151494, ack 1871871, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.517617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1871871:1882091, ack 151494, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.521654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1874791, win 4380, length 0 15:01:54.521747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1882091:1886471, ack 151494, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:54.523798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1877711, win 4380, length 0 15:01:54.523886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1886471:1887931, ack 151494, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:54.523930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1887931:1888375, ack 151494, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:01:54.525884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1880631, win 4380, length 0 15:01:54.528032 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1883551, win 4380, length 0 15:01:54.530244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1886471, win 4380, length 0 15:01:54.532225 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1888375, win 4380, length 0 15:01:54.532602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151494:151535, ack 1888375, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:54.533040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151535:151623, ack 1888375, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.533664 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1888375:1888414, ack 151623, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:54.535298 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151623:151668, ack 1888414, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.535993 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1888414:1888453, ack 151668, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.538364 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151668:151778, ack 1888453, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.539251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1888453:1888592, ack 151778, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.540838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151778:151854, ack 1888592, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.541673 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1888592:1888664, ack 151854, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.543270 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151854:151930, ack 1888664, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.544144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1888664:1888752, ack 151930, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.545778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 151930:152040, ack 1888752, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.551903 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1888752:1891672, ack 152040, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.552145 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1891672:1892140, ack 152040, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:54.555813 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1891672, win 4380, length 0 15:01:54.557269 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152040:152085, ack 1892140, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.557938 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1892140:1892179, ack 152085, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.560333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152085:152187, ack 1892179, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.561195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1892179:1892318, ack 152187, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.562790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152187:152263, ack 1892318, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.563167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1892318:1892422, ack 152263, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.565149 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152263:152351, ack 1892422, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.565236 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1892422:1892494, ack 152351, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.566836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152351:152427, ack 1892494, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.567661 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1892494:1892582, ack 152427, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.569307 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152427:152529, ack 1892582, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.575960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1892582:1895502, ack 152529, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.576233 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895502:1895594, ack 152529, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:54.579813 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1895502, win 4380, length 0 15:01:54.592559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152529:152574, ack 1895594, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.593261 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895594:1895633, ack 152574, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.595796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152574:152670, ack 1895633, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.596716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895633:1895772, ack 152670, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.599223 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152670:152746, ack 1895772, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.600070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895772:1895844, ack 152746, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.601843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152746:152822, ack 1895844, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.602660 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895844:1895932, ack 152822, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.604343 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152822:152918, ack 1895932, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.606851 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1895932:1897220, ack 152918, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:54.609848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152918:152963, ack 1897220, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.610533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1897220:1897259, ack 152963, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.613722 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 152963:153071, ack 1897259, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.614598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1897259:1897398, ack 153071, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.616238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153071:153147, ack 1897398, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.617076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1897398:1897470, ack 153147, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.618671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153147:153223, ack 1897470, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.618752 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1897470:1897574, ack 153223, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.620393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153223:153311, ack 1897574, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.620477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1897574:1897662, ack 153311, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.622146 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153311:153419, ack 1897662, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.625248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1897662:1899122, ack 153419, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.625453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1899122:1899130, ack 153419, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:54.627880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1899130, win 4380, length 0 15:01:54.628295 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153419:153464, ack 1899130, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.628951 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1899130:1899169, ack 153464, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.631321 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153464:153582, ack 1899169, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.632203 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1899169:1899308, ack 153582, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.633781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153582:153658, ack 1899308, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.634626 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1899308:1899380, ack 153658, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.636209 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153658:153734, ack 1899380, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.637029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1899380:1899468, ack 153734, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.638971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153734:153852, ack 1899468, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.644521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1899468:1900928, ack 153852, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.644730 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1900928:1902236, ack 153852, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:54.647388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1902236, win 4380, length 0 15:01:54.647834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153852:153897, ack 1902236, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.648497 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1902236:1902275, ack 153897, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.650921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153897:153999, ack 1902275, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.651783 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1902275:1902414, ack 153999, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.653437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 153999:154075, ack 1902414, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.654315 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1902414:1902486, ack 154075, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.655910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154075:154151, ack 1902486, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.655991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1902486:1902590, ack 154151, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.657604 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154151:154239, ack 1902590, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.657684 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1902590:1902678, ack 154239, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.659374 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154239:154341, ack 1902678, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.673020 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1902678:1909978, ack 154341, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.673286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1909978:1910166, ack 154341, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:54.676807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1905598, win 4380, length 0 15:01:54.680611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1908518, win 4380, length 0 15:01:54.681727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1910166, win 4380, length 0 15:01:54.682169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154341:154386, ack 1910166, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.682846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1910166:1910205, ack 154386, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.685295 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154386:154488, ack 1910205, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.686203 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1910205:1910344, ack 154488, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.687796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154488:154564, ack 1910344, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.688634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1910344:1910416, ack 154564, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.690756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154564:154640, ack 1910416, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.691580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1910416:1910504, ack 154640, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.693213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154640:154742, ack 1910504, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.695338 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1910504:1911224, ack 154742, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:54.703449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154742:154787, ack 1911224, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.704195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1911224:1911263, ack 154787, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.706572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154787:154913, ack 1911263, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.707459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1911263:1911402, ack 154913, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.709062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154913:154989, ack 1911402, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.709904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1911402:1911474, ack 154989, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.711487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 154989:155065, ack 1911474, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.711858 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1911474:1911578, ack 155065, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.715651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155065:155153, ack 1911578, win 4027, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.715734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1911578:1911666, ack 155153, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.717544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155153:155279, ack 1911666, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.744811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1911666:1926266, ack 155279, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.747841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1914586, win 4380, length 0 15:01:54.749963 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1917506, win 4380, length 0 15:01:54.750041 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1926266:1927726, ack 155279, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:54.750085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1927726:1927970, ack 155279, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:54.752035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1920426, win 4380, length 0 15:01:54.754195 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1923346, win 4380, length 0 15:01:54.757335 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1926266, win 4380, length 0 15:01:54.759258 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1927970, win 4380, length 0 15:01:54.760423 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155279:155439, ack 1927970, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.786808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1927970:1944030, ack 155439, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.787161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1944030:1944390, ack 155439, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:54.790684 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1930890, win 4380, length 0 15:01:54.793796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1933810, win 4380, length 0 15:01:54.796878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1936730, win 4380, length 0 15:01:54.799965 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1939650, win 4380, length 0 15:01:54.803110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1942570, win 4380, length 0 15:01:54.805014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1944390, win 4380, length 0 15:01:54.805595 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155439:155555, ack 1944390, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.831053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1944390:1960450, ack 155555, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.831408 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1960450:1960734, ack 155555, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:54.834891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1947310, win 4380, length 0 15:01:54.836940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1950230, win 4380, length 0 15:01:54.839986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1953150, win 4380, length 0 15:01:54.842140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1956070, win 4380, length 0 15:01:54.844255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1958990, win 4380, length 0 15:01:54.847106 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1960734, win 4380, length 0 15:01:54.847176 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1960734:1960838, ack 155555, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.847570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155555:155596, ack 1960734, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:54.848879 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155596:155684, ack 1960838, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.848966 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1960838:1960877, ack 155684, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:54.850540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155684:155729, ack 1960877, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.851223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1960877:1960916, ack 155729, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.853644 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155729:155857, ack 1960916, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.854594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1960916:1961055, ack 155857, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.856192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155857:155933, ack 1961055, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.857032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1961055:1961127, ack 155933, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.858652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 155933:156009, ack 1961127, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.859466 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1961127:1961215, ack 156009, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.861149 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156009:156137, ack 1961215, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.867736 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1961215:1964135, ack 156137, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.867968 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964135:1964635, ack 156137, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:54.870587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1964135, win 4380, length 0 15:01:54.871987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156137:156182, ack 1964635, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.872648 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964635:1964674, ack 156182, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.875028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156182:156290, ack 1964674, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.875930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964674:1964813, ack 156290, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.878322 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156290:156366, ack 1964813, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.879166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964813:1964885, ack 156366, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.883396 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156366:156442, ack 1964885, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.884306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964885:1964973, ack 156442, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.885968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156442:156550, ack 1964973, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.886345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1964973:1965077, ack 156550, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.887967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156550:156638, ack 1965077, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.890388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1965077:1966537, ack 156638, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:54.890583 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1966537:1966973, ack 156638, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:54.893012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1966973, win 4380, length 0 15:01:54.893863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156638:156683, ack 1966973, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.894521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1966973:1967012, ack 156683, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.896884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156683:156809, ack 1967012, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.897761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1967012:1967151, ack 156809, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.899358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156809:156885, ack 1967151, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.900192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1967151:1967223, ack 156885, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.901771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156885:156961, ack 1967223, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.902628 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1967223:1967311, ack 156961, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.904268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 156961:157087, ack 1967311, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.906296 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1967311:1968011, ack 157087, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:54.914179 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157087:157132, ack 1968011, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.914872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968011:1968050, ack 157132, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.917846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157132:157266, ack 1968050, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.918714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968050:1968189, ack 157266, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.920900 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157266:157342, ack 1968189, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.921741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968189:1968261, ack 157342, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.923313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157342:157418, ack 1968261, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.924199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968261:1968349, ack 157418, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.925841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157418:157552, ack 1968349, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.927088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968349:1968617, ack 157552, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:54.928807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157552:157597, ack 1968617, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.929179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968617:1968721, ack 157597, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:54.930822 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157597:157685, ack 1968721, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:54.930904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968721:1968760, ack 157685, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:54.933377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157685:157819, ack 1968760, win 4344, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:54.934325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968760:1968899, ack 157819, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:54.935911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157819:157895, ack 1968899, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.936759 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968899:1968971, ack 157895, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:54.938353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157895:157971, ack 1968971, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.939177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1968971:1969059, ack 157971, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:54.940828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 157971:158105, ack 1969059, win 4269, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:54.945027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1969059:1969999, ack 158105, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:54.948047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158105:158150, ack 1969999, win 4034, length 45SMB PACKET: SMBclose (REQUEST) 15:01:54.948780 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1969999:1970038, ack 158150, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:55.150466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1970038, win 4024, length 0 15:01:56.453378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158150:158230, ack 1970038, win 4024, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.454413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1970038:1970142, ack 158230, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:56.456959 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158230:158310, ack 1970142, win 4380, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.457866 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1970142:1970230, ack 158310, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.459499 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158310:158400, ack 1970230, win 4358, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.460374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1970230:1970369, ack 158400, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.462137 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158400:158490, ack 1970369, win 4323, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.470567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1970369:1974749, ack 158490, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.470818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1974749:1974777, ack 158490, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:56.474563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1973289, win 4380, length 0 15:01:56.476551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1974777, win 4380, length 0 15:01:56.478440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158490:158580, ack 1974777, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.478800 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1974777:1974881, ack 158580, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.679265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1974881, win 4354, length 0 15:01:56.679376 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1974881:1975020, ack 158580, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.681092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158580:158668, ack 1975020, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.713715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 158668, win 3247, length 0 15:01:56.715314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158668:158758, ack 1975020, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.715377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 158758, win 3247, length 0 15:01:56.723819 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1975020:1979400, ack 158758, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.724068 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979400:1979428, ack 158758, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:56.726700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1977940, win 4380, length 0 15:01:56.729528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1979428, win 4380, length 0 15:01:56.729927 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158758:158803, ack 1979428, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.730617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979428:1979467, ack 158803, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.732365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158803:158848, ack 1979467, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.733052 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979467:1979506, ack 158848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.739726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158848:158966, ack 1979506, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.740631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979506:1979645, ack 158966, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.744491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 158966:159042, ack 1979645, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.745339 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979645:1979717, ack 159042, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.749896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159042:159118, ack 1979717, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.750711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1979717:1979805, ack 159118, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.752416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159118:159236, ack 1979805, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.756984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1979805:1981265, ack 159236, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.757192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1981265:1982005, ack 159236, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:56.759689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1982005, win 4380, length 0 15:01:56.760094 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159236:159281, ack 1982005, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.760769 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982005:1982044, ack 159281, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.763887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159281:159381, ack 1982044, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.763969 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982044:1982148, ack 159381, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.766282 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159381:159469, ack 1982148, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.766369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982148:1982287, ack 159469, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.767915 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159469:159545, ack 1982287, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.768745 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982287:1982359, ack 159545, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.770355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159545:159621, ack 1982359, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.771450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982359:1982447, ack 159621, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.773089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159621:159721, ack 1982447, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.775196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1982447:1983027, ack 159721, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:56.777035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159721:159766, ack 1983027, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.777772 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983027:1983066, ack 159766, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.780070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159766:159876, ack 1983066, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.780965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983066:1983205, ack 159876, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.782562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159876:159952, ack 1983205, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.783412 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983205:1983277, ack 159952, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.784980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 159952:160028, ack 1983277, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.785828 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983277:1983365, ack 160028, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.787455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160028:160138, ack 1983365, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.789013 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983365:1983861, ack 160138, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:56.790865 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160138:160183, ack 1983861, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.791592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983861:1983900, ack 160183, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.793903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160183:160287, ack 1983900, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.794797 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1983900:1984039, ack 160287, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.800740 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160287:160363, ack 1984039, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.801578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1984039:1984111, ack 160363, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.803201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160363:160439, ack 1984111, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.803282 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1984111:1984215, ack 160439, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.804890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160439:160527, ack 1984215, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.804973 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 1984215:1984303, ack 160527, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.806648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160527:160631, ack 1984303, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.826367 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1984303:1994523, ack 160631, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.830349 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1987223, win 4380, length 0 15:01:56.830448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1994523:1998903, ack 160631, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:56.834039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1990143, win 4380, length 0 15:01:56.834115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 1998903:2000363, ack 160631, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:56.834157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000363:2000703, ack 160631, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:56.836364 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1993063, win 4380, length 0 15:01:56.839486 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1995983, win 4380, length 0 15:01:56.842585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 1998903, win 4380, length 0 15:01:56.844514 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2000703, win 4380, length 0 15:01:56.844990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160631:160672, ack 2000703, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:56.845836 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000703:2000742, ack 160672, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:56.847377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160672:160717, ack 2000742, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.848075 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000742:2000781, ack 160717, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.850419 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160717:160827, ack 2000781, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.851312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000781:2000920, ack 160827, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.853267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160827:160903, ack 2000920, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.854215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000920:2000992, ack 160903, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.856090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160903:160979, ack 2000992, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.856921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2000992:2001080, ack 160979, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.858603 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 160979:161089, ack 2001080, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.864856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2001080:2004000, ack 161089, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.865184 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004000:2004468, ack 161089, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:56.867764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2004000, win 4380, length 0 15:01:56.869569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161089:161134, ack 2004468, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.869639 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004468:2004572, ack 161134, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.871643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161134:161222, ack 2004572, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.871724 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004572:2004611, ack 161222, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.874009 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161222:161324, ack 2004611, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.874896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004611:2004750, ack 161324, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.876497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161324:161400, ack 2004750, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.877328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004750:2004822, ack 161400, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.878939 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161400:161476, ack 2004822, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.879746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2004822:2004910, ack 161476, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.881378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161476:161578, ack 2004910, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.886837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2004910:2007830, ack 161578, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.887062 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2007830:2007922, ack 161578, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:56.890736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2007830, win 4380, length 0 15:01:56.891994 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161578:161623, ack 2007922, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.892655 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2007922:2007961, ack 161623, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.894923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161623:161719, ack 2007961, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.895807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2007961:2008100, ack 161719, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.897400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161719:161795, ack 2008100, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.898240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2008100:2008172, ack 161795, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.899895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161795:161871, ack 2008172, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.900709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2008172:2008260, ack 161871, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.902344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161871:161967, ack 2008260, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.904853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2008260:2009548, ack 161967, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:56.907036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 161967:162012, ack 2009548, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.907121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2009548:2009652, ack 162012, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.908750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162012:162100, ack 2009652, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.908832 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2009652:2009691, ack 162100, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.911136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162100:162208, ack 2009691, win 4344, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.912004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2009691:2009830, ack 162208, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.913637 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162208:162284, ack 2009830, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.914516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2009830:2009902, ack 162284, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.916097 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162284:162360, ack 2009902, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.916904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2009902:2009990, ack 162360, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.918571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162360:162468, ack 2009990, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.921537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2009990:2011450, ack 162468, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.921740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2011450:2011458, ack 162468, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:56.924153 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2011458, win 4380, length 0 15:01:56.924929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162468:162513, ack 2011458, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.925598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2011458:2011497, ack 162513, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.928254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162513:162631, ack 2011497, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.929123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2011497:2011636, ack 162631, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.930740 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162631:162707, ack 2011636, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.931607 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2011636:2011708, ack 162707, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.933176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162707:162783, ack 2011708, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.934055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2011708:2011796, ack 162783, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.935691 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162783:162901, ack 2011796, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.941096 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2011796:2013256, ack 162901, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.941304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2013256:2014564, ack 162901, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:56.943971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2014564, win 4380, length 0 15:01:56.944074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2014564:2014668, ack 162901, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:56.944445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162901:162946, ack 2014564, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.946368 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 162946:163034, ack 2014668, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:56.946477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2014668:2014707, ack 163034, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.948779 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163034:163136, ack 2014707, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.949696 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2014707:2014846, ack 163136, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.951304 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163136:163212, ack 2014846, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.952163 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2014846:2014918, ack 163212, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.953737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163212:163288, ack 2014918, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.954589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2014918:2015006, ack 163288, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.956219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163288:163390, ack 2015006, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.969909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2015006:2022306, ack 163390, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:56.970182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022306:2022494, ack 163390, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:56.972848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2017926, win 4380, length 0 15:01:56.976097 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2020846, win 4380, length 0 15:01:56.978725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2022494, win 4380, length 0 15:01:56.979528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163390:163435, ack 2022494, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.980201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022494:2022533, ack 163435, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:56.982669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163435:163537, ack 2022533, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:56.983552 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022533:2022672, ack 163537, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:56.985264 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163537:163613, ack 2022672, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.986115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022672:2022744, ack 163613, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:56.987887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163613:163689, ack 2022744, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.988877 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022744:2022832, ack 163689, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:56.990727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163689:163791, ack 2022832, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:56.992686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2022832:2023552, ack 163791, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:56.994909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163791:163836, ack 2023552, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:01:56.994996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2023552:2023656, ack 163836, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:57.001464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163836:163924, ack 2023656, win 4089, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:57.001546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2023656:2023695, ack 163924, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.003929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 163924:164050, ack 2023695, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.004861 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2023695:2023834, ack 164050, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.006456 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164050:164126, ack 2023834, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.007304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2023834:2023906, ack 164126, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.009042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164126:164202, ack 2023906, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.009860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2023906:2023994, ack 164202, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.011545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164202:164328, ack 2023994, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.037863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2023994:2038594, ack 164328, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:57.040828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2026914, win 4380, length 0 15:01:57.043905 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2029834, win 4380, length 0 15:01:57.043981 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2038594:2040054, ack 164328, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:57.044025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2040054:2040298, ack 164328, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:57.046060 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2032754, win 4380, length 0 15:01:57.049924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2035674, win 4380, length 0 15:01:57.052281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2038594, win 4380, length 0 15:01:57.054242 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2040298, win 4380, length 0 15:01:57.054856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164328:164488, ack 2040298, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.081501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2040298:2056358, ack 164488, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:57.081848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2056358:2056718, ack 164488, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:57.084465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2043218, win 4380, length 0 15:01:57.086548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2046138, win 4380, length 0 15:01:57.088811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2049058, win 4380, length 0 15:01:57.090970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2051978, win 4380, length 0 15:01:57.093061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2054898, win 4380, length 0 15:01:57.095111 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2056718, win 4380, length 0 15:01:57.095481 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2056718:2056822, ack 164488, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:57.095664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164488:164604, ack 2056718, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.097203 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164604:164692, ack 2056822, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:57.121423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2056822:2072882, ack 164692, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:57.121769 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2072882:2073166, ack 164692, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:57.125293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2059742, win 4380, length 0 15:01:57.139838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2062662, win 4380, length 0 15:01:57.140231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2065582, win 6935, length 0 15:01:57.140738 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2068502, win 6935, length 0 15:01:57.141245 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2071422, win 6935, length 0 15:01:57.141694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2073166, win 6935, length 0 15:01:57.142140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164692:164733, ack 2073166, win 6935, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:57.142988 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2073166:2073205, ack 164733, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:57.144711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164733:164778, ack 2073205, win 6925, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.145440 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2073205:2073244, ack 164778, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.147841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164778:164906, ack 2073244, win 6915, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.148746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2073244:2073383, ack 164906, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.150366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164906:164982, ack 2073383, win 6880, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.151250 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2073383:2073455, ack 164982, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.152819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 164982:165058, ack 2073455, win 6862, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.153635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2073455:2073543, ack 165058, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.155300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165058:165186, ack 2073543, win 6840, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.161741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2073543:2076463, ack 165186, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:57.161980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2076463:2076963, ack 165186, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:57.164672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2076463, win 6110, length 0 15:01:57.166086 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165186:165231, ack 2076963, win 5985, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.166799 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2076963:2077002, ack 165231, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.169130 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165231:165339, ack 2077002, win 5976, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.169211 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2077002:2077106, ack 165339, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:57.170869 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165339:165427, ack 2077106, win 5950, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:57.170955 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2077106:2077245, ack 165427, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.173660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165427:165503, ack 2077245, win 5915, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.174554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2077245:2077317, ack 165503, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.176136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165503:165579, ack 2077317, win 5897, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.176971 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2077317:2077405, ack 165579, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.179075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165579:165687, ack 2077405, win 5875, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.182819 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2077405:2078865, ack 165687, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:57.183022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2078865:2079301, ack 165687, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:57.185534 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2079301, win 5401, length 0 15:01:57.185999 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165687:165732, ack 2079301, win 5401, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.186704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2079301:2079340, ack 165732, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.189025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165732:165858, ack 2079340, win 5391, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.189915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2079340:2079479, ack 165858, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.191515 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165858:165934, ack 2079479, win 5356, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.192357 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2079479:2079551, ack 165934, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.193927 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 165934:166010, ack 2079551, win 5338, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.194767 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2079551:2079639, ack 166010, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.196438 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166010:166136, ack 2079639, win 5316, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.198452 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2079639:2080339, ack 166136, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:57.200642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166136:166181, ack 2080339, win 5141, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.201327 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080339:2080378, ack 166181, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.207543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166181:166315, ack 2080378, win 5132, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.208426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080378:2080517, ack 166315, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.210047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166315:166391, ack 2080517, win 5097, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.210128 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080517:2080621, ack 166391, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:57.211764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166391:166479, ack 2080621, win 5071, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:57.211847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080621:2080693, ack 166479, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.213450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166479:166555, ack 2080693, win 5053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.214330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080693:2080781, ack 166555, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.215989 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166555:166689, ack 2080781, win 5031, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.217240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2080781:2081049, ack 166689, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:57.218971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166689:166734, ack 2081049, win 4964, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.219647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2081049:2081088, ack 166734, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.222008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166734:166868, ack 2081088, win 4954, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:57.222884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2081088:2081227, ack 166868, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:57.224478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166868:166944, ack 2081227, win 4919, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.225335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2081227:2081299, ack 166944, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:57.226923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 166944:167020, ack 2081299, win 4901, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.227748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2081299:2081387, ack 167020, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:57.229410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167020:167154, ack 2081387, win 4879, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:57.231889 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2081387:2082327, ack 167154, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:57.233905 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167154:167199, ack 2082327, win 4644, length 45SMB PACKET: SMBclose (REQUEST) 15:01:57.234609 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2082327:2082366, ack 167199, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:57.428025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2082366, win 4635, length 0 15:01:58.193731 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:01:58.746728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167199:167279, ack 2082366, win 4635, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:58.747778 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2082366:2082470, ack 167279, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:01:58.749497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167279:167359, ack 2082470, win 4609, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:01:58.750371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2082470:2082558, ack 167359, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:58.751975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167359:167449, ack 2082558, win 4587, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:58.752058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2082558:2082662, ack 167449, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:58.941254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2082662, win 4561, length 0 15:01:58.941343 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2082662:2082801, ack 167449, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:58.943204 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167449:167537, ack 2082801, win 4526, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:58.973741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 167537, win 3247, length 0 15:01:58.975325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167537:167627, ack 2082801, win 4526, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:58.975396 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 167627, win 3247, length 0 15:01:58.983963 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2082801:2087181, ack 167627, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:58.984205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2087181:2087209, ack 167627, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:58.986900 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2085721, win 4380, length 0 15:01:58.988750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2087209, win 4380, length 0 15:01:58.990535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167627:167717, ack 2087209, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:01:58.991415 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2087209:2087348, ack 167717, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:58.993293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167717:167762, ack 2087348, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:01:58.994120 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2087348:2087387, ack 167762, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:58.995728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167762:167852, ack 2087387, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.004157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2087387:2091767, ack 167852, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.004395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2091767:2091795, ack 167852, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:01:59.007078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2090307, win 4380, length 0 15:01:59.008932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2091795, win 4380, length 0 15:01:59.009551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167852:167897, ack 2091795, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.010213 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2091795:2091834, ack 167897, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.016889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 167897:168015, ack 2091834, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.017834 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2091834:2091973, ack 168015, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.019560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168015:168091, ack 2091973, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.020683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2091973:2092045, ack 168091, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.022268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168091:168167, ack 2092045, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.022662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2092045:2092149, ack 168167, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.024279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168167:168255, ack 2092149, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.024370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2092149:2092237, ack 168255, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.026046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168255:168373, ack 2092237, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.030861 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2092237:2093697, ack 168373, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.031074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2093697:2094437, ack 168373, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:01:59.033616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2094437, win 4380, length 0 15:01:59.033998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168373:168418, ack 2094437, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.034729 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2094437:2094476, ack 168418, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.037044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168418:168518, ack 2094476, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.037929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2094476:2094615, ack 168518, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.039560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168518:168594, ack 2094615, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.040400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2094615:2094687, ack 168594, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.041979 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168594:168670, ack 2094687, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.042789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2094687:2094775, ack 168670, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.044415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168670:168770, ack 2094775, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.046142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2094775:2095355, ack 168770, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:01:59.048008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168770:168815, ack 2095355, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.048698 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095355:2095394, ack 168815, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.051232 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168815:168925, ack 2095394, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.052091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095394:2095533, ack 168925, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.053709 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 168925:169001, ack 2095533, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.054570 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095533:2095605, ack 169001, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.056137 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169001:169077, ack 2095605, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.056950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095605:2095693, ack 169077, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.058611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169077:169187, ack 2095693, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.058980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095693:2095797, ack 169187, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.060605 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169187:169275, ack 2095797, win 4040, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.060694 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2095797:2096293, ack 169275, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:01:59.062537 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169275:169320, ack 2096293, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.063221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2096293:2096332, ack 169320, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.065493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169320:169424, ack 2096332, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.066405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2096332:2096471, ack 169424, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.068003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169424:169500, ack 2096471, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.068839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2096471:2096543, ack 169500, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.070446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169500:169576, ack 2096543, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.071256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2096543:2096631, ack 169576, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.073477 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169576:169680, ack 2096631, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.093099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2096631:2106851, ack 169680, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.096057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2099551, win 4380, length 0 15:01:59.096154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2106851:2111231, ack 169680, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:01:59.099287 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2102471, win 4380, length 0 15:01:59.099361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2111231:2112691, ack 169680, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:59.099403 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2112691:2113031, ack 169680, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:01:59.101311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2105391, win 4380, length 0 15:01:59.103443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2108311, win 4380, length 0 15:01:59.105533 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2111231, win 4380, length 0 15:01:59.108558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2113031, win 4380, length 0 15:01:59.108958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169680:169721, ack 2113031, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:59.109832 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113031:2113070, ack 169721, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:59.111386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169721:169766, ack 2113070, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.112088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113070:2113109, ack 169766, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.114362 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169766:169876, ack 2113109, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.114759 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113109:2113213, ack 169876, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.116662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169876:169964, ack 2113213, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.116752 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113213:2113352, ack 169964, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.119534 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 169964:170040, ack 2113352, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.120373 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113352:2113424, ack 170040, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.121993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170040:170116, ack 2113424, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.122809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2113424:2113512, ack 170116, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.124441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170116:170226, ack 2113512, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.130589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2113512:2116432, ack 170226, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.130825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2116432:2116900, ack 170226, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:01:59.133547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2116432, win 4380, length 0 15:01:59.135046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170226:170271, ack 2116900, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.135727 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2116900:2116939, ack 170271, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.138013 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170271:170373, ack 2116939, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.138884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2116939:2117078, ack 170373, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.140505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170373:170449, ack 2117078, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.141340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2117078:2117150, ack 170449, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.143437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170449:170525, ack 2117150, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.144350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2117150:2117238, ack 170525, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.146100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170525:170627, ack 2117238, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.151481 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2117238:2120158, ack 170627, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.151709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120158:2120250, ack 170627, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:01:59.155255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2120158, win 4380, length 0 15:01:59.156526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170627:170672, ack 2120250, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.157192 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120250:2120289, ack 170672, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.159522 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170672:170768, ack 2120289, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.159604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120289:2120393, ack 170768, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.161274 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170768:170856, ack 2120393, win 4321, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.161361 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120393:2120532, ack 170856, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.162914 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170856:170932, ack 2120532, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.163788 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120532:2120604, ack 170932, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.165366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 170932:171008, ack 2120604, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.166199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120604:2120692, ack 171008, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.167826 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171008:171104, ack 2120692, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.170307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2120692:2121980, ack 171104, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:01:59.172529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171104:171149, ack 2121980, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.173224 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2121980:2122019, ack 171149, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.175544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171149:171257, ack 2122019, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.179425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2122019:2122158, ack 171257, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.181040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171257:171333, ack 2122158, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.181916 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2122158:2122230, ack 171333, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.183492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171333:171409, ack 2122230, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.184374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2122230:2122318, ack 171409, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.186036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171409:171517, ack 2122318, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.189042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2122318:2123778, ack 171517, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.189250 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2123778:2123786, ack 171517, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:01:59.191736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2123786, win 4380, length 0 15:01:59.192111 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171517:171562, ack 2123786, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.192825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2123786:2123825, ack 171562, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.195100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171562:171680, ack 2123825, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.196000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2123825:2123964, ack 171680, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.197596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171680:171756, ack 2123964, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.197679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2123964:2124068, ack 171756, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.199302 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171756:171844, ack 2124068, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.199386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2124068:2124140, ack 171844, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.200993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171844:171920, ack 2124140, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.201809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2124140:2124228, ack 171920, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.203454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 171920:172038, ack 2124228, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.208967 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2124228:2125688, ack 172038, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.209179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2125688:2126996, ack 172038, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:01:59.211780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2126996, win 4380, length 0 15:01:59.225080 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172038:172083, ack 2126996, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.225757 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2126996:2127035, ack 172083, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.228165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172083:172185, ack 2127035, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.229210 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2127035:2127174, ack 172185, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.230968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172185:172261, ack 2127174, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.231819 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2127174:2127246, ack 172261, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.233600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172261:172337, ack 2127246, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.234477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2127246:2127334, ack 172337, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.236321 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172337:172439, ack 2127334, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.249974 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2127334:2134634, ack 172439, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.250248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2134634:2134822, ack 172439, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:01:59.253832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2130254, win 4380, length 0 15:01:59.255970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2133174, win 4380, length 0 15:01:59.258947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2134822, win 4380, length 0 15:01:59.259331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172439:172484, ack 2134822, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.260010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2134822:2134861, ack 172484, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.263082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172484:172586, ack 2134861, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.264005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2134861:2134965, ack 172586, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.265663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172586:172674, ack 2134965, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.265765 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2134965:2135104, ack 172674, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.267345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172674:172750, ack 2135104, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.268202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2135104:2135176, ack 172750, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.269808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172750:172826, ack 2135176, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.270624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2135176:2135264, ack 172826, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.272245 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172826:172928, ack 2135264, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.274521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2135264:2135984, ack 172928, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:01:59.277431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172928:172973, ack 2135984, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.278152 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2135984:2136023, ack 172973, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.285028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 172973:173099, ack 2136023, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.285947 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2136023:2136162, ack 173099, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.287543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173099:173175, ack 2136162, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.288395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2136162:2136234, ack 173175, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.290002 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173175:173251, ack 2136234, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.290821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2136234:2136322, ack 173251, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.292466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173251:173377, ack 2136322, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.318930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2136322:2150922, ack 173377, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.322042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2139242, win 4380, length 0 15:01:59.325608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2142162, win 4380, length 0 15:01:59.325686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2150922:2152382, ack 173377, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:01:59.325729 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2152382:2152626, ack 173377, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:01:59.327798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2145082, win 4380, length 0 15:01:59.331490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2148002, win 4380, length 0 15:01:59.332907 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2150922, win 4380, length 0 15:01:59.334931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2152626, win 4380, length 0 15:01:59.335307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2152626:2152730, ack 173377, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.335669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173377:173537, ack 2152626, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.336921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173537:173625, ack 2152730, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.362225 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2152730:2168790, ack 173625, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.362575 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2168790:2169150, ack 173625, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:01:59.366130 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2155650, win 4380, length 0 15:01:59.368356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2158570, win 4380, length 0 15:01:59.371551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2161490, win 4380, length 0 15:01:59.374735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2164410, win 4380, length 0 15:01:59.376914 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2167330, win 4380, length 0 15:01:59.378936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2169150, win 4380, length 0 15:01:59.382878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173625:173741, ack 2169150, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.408360 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2169150:2185210, ack 173741, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.408709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185210:2185494, ack 173741, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:01:59.412124 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2172070, win 4380, length 0 15:01:59.413434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2174990, win 4380, length 0 15:01:59.416456 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2177910, win 4380, length 0 15:01:59.418692 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2180830, win 4380, length 0 15:01:59.421554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2183750, win 4380, length 0 15:01:59.423599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2185494, win 4380, length 0 15:01:59.424074 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173741:173782, ack 2185494, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:01:59.424971 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185494:2185533, ack 173782, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:01:59.426871 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173782:173827, ack 2185533, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.427602 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185533:2185572, ack 173827, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.429970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173827:173955, ack 2185572, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.430877 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185572:2185711, ack 173955, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.432478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 173955:174031, ack 2185711, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.433325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185711:2185783, ack 174031, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.434895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174031:174107, ack 2185783, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.435286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185783:2185887, ack 174107, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.436898 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174107:174195, ack 2185887, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.436982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2185887:2185975, ack 174195, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.438681 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174195:174323, ack 2185975, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.445217 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2185975:2188895, ack 174323, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.445448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2188895:2189395, ack 174323, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:01:59.448140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2188895, win 4380, length 0 15:01:59.449851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174323:174368, ack 2189395, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.450517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2189395:2189434, ack 174368, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.452830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174368:174476, ack 2189434, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.453745 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2189434:2189573, ack 174476, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.455334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174476:174552, ack 2189573, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.456180 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2189573:2189645, ack 174552, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.457788 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174552:174628, ack 2189645, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.458600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2189645:2189733, ack 174628, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.460278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174628:174736, ack 2189733, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.464202 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2189733:2191193, ack 174736, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:01:59.464406 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191193:2191629, ack 174736, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:01:59.466889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2191629, win 4380, length 0 15:01:59.467299 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174736:174781, ack 2191629, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.467960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191629:2191668, ack 174781, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.470273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174781:174907, ack 2191668, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.471158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191668:2191807, ack 174907, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.472764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174907:174983, ack 2191807, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.473604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191807:2191879, ack 174983, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.475206 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 174983:175059, ack 2191879, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.475582 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191879:2191983, ack 175059, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.477190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175059:175147, ack 2191983, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.477272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2191983:2192071, ack 175147, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.478955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175147:175273, ack 2192071, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.480982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2192071:2192771, ack 175273, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:01:59.483152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175273:175318, ack 2192771, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.483923 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2192771:2192810, ack 175318, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.490187 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175318:175452, ack 2192810, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.491064 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2192810:2192949, ack 175452, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.492803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175452:175528, ack 2192949, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.493636 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2192949:2193021, ack 175528, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.495452 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175528:175604, ack 2193021, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.496288 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193021:2193109, ack 175604, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.498153 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175604:175738, ack 2193109, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.499397 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193109:2193377, ack 175738, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:01:59.501136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175738:175783, ack 2193377, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.501810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193377:2193416, ack 175783, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.504210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175783:175917, ack 2193416, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:01:59.505093 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193416:2193555, ack 175917, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:01:59.506691 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175917:175993, ack 2193555, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.507522 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193555:2193627, ack 175993, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:01:59.509115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 175993:176069, ack 2193627, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.509942 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193627:2193715, ack 176069, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:01:59.511591 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176069:176203, ack 2193715, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:01:59.514159 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2193715:2194655, ack 176203, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:01:59.516942 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176203:176248, ack 2194655, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:01:59.517027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2194655:2194759, ack 176248, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:01:59.518697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176248:176336, ack 2194759, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:01:59.518778 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2194759:2194798, ack 176336, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:01:59.721222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2194798, win 4344, length 0 15:02:01.040352 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176336:176426, ack 2194798, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.041442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2194798:2194937, ack 176426, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.043473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176426:176506, ack 2194937, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.044413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2194937:2195041, ack 176506, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:01.046541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176506:176586, ack 2195041, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.047672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2195041:2195129, ack 176586, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.049279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176586:176676, ack 2195129, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.058365 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2195129:2199509, ack 176676, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.058625 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2199509:2199537, ack 176676, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:01.061310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2198049, win 4380, length 0 15:02:01.063239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2199537, win 4380, length 0 15:02:01.065533 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176676:176766, ack 2199537, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.066451 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2199537:2199676, ack 176766, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.068429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176766:176811, ack 2199676, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.069135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2199676:2199715, ack 176811, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.070741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176811:176901, ack 2199715, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.079229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2199715:2204095, ack 176901, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.079478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204095:2204123, ack 176901, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:01.082196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2202635, win 4380, length 0 15:02:01.083992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2204123, win 4380, length 0 15:02:01.084623 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176901:176946, ack 2204123, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.085306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204123:2204162, ack 176946, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.087652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 176946:177064, ack 2204162, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.087734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204162:2204266, ack 177064, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.092511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177064:177152, ack 2204266, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.092597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204266:2204405, ack 177152, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.094217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177152:177228, ack 2204405, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.095076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204405:2204477, ack 177228, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.096685 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177228:177304, ack 2204477, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.097503 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2204477:2204565, ack 177304, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.099165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177304:177422, ack 2204565, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.103722 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2204565:2206025, ack 177422, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.103924 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2206025:2206765, ack 177422, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:01.106517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2206765, win 4380, length 0 15:02:01.106921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177422:177467, ack 2206765, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.107592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2206765:2206804, ack 177467, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.110025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177467:177567, ack 2206804, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.110900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2206804:2206943, ack 177567, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.112501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177567:177643, ack 2206943, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.113336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2206943:2207015, ack 177643, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.114924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177643:177719, ack 2207015, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.115748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207015:2207103, ack 177719, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.117370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177719:177819, ack 2207103, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.119113 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207103:2207683, ack 177819, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:01.121035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177819:177864, ack 2207683, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.121715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207683:2207722, ack 177864, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.124039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177864:177974, ack 2207722, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.124921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207722:2207861, ack 177974, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.126511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 177974:178050, ack 2207861, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.126593 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207861:2207965, ack 178050, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.128217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178050:178138, ack 2207965, win 4080, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.128298 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2207965:2208037, ack 178138, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.129949 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178138:178214, ack 2208037, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.130764 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208037:2208125, ack 178214, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.132404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178214:178324, ack 2208125, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.134007 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208125:2208621, ack 178324, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:01.135822 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178324:178369, ack 2208621, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.136517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208621:2208660, ack 178369, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.138844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178369:178473, ack 2208660, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.139739 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208660:2208799, ack 178473, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.141348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178473:178549, ack 2208799, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.142183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208799:2208871, ack 178549, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.143755 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178549:178625, ack 2208871, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.144634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2208871:2208959, ack 178625, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.146263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178625:178729, ack 2208959, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.166010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2208959:2219179, ack 178729, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.171204 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2211879, win 4380, length 0 15:02:01.171302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2219179:2223559, ack 178729, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:01.171664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2214799, win 4380, length 0 15:02:01.171733 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2223559:2225019, ack 178729, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:01.171774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225019:2225359, ack 178729, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:01.175461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2217719, win 4380, length 0 15:02:01.175813 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2220639, win 4380, length 0 15:02:01.179413 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2223559, win 4380, length 0 15:02:01.179770 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2225359, win 4380, length 0 15:02:01.180124 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225359:2225463, ack 178729, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.192883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178729:178770, ack 2225463, win 4354, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:01.193252 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178770:178858, ack 2225463, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.193983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225463:2225502, ack 178858, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:01.195710 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178858:178903, ack 2225502, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.196394 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225502:2225541, ack 178903, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.198824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 178903:179013, ack 2225541, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.199705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225541:2225680, ack 179013, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.201425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179013:179089, ack 2225680, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.202303 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225680:2225752, ack 179089, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.204015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179089:179165, ack 2225752, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.204854 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2225752:2225840, ack 179165, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.206508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179165:179275, ack 2225840, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.212571 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2225840:2228760, ack 179275, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.212804 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2228760:2229228, ack 179275, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:01.215409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2228760, win 4380, length 0 15:02:01.216916 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179275:179320, ack 2229228, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.217624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2229228:2229267, ack 179320, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.220136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179320:179422, ack 2229267, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.221014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2229267:2229406, ack 179422, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.222616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179422:179498, ack 2229406, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.223453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2229406:2229478, ack 179498, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.225592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179498:179574, ack 2229478, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.226428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2229478:2229566, ack 179574, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.228050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179574:179676, ack 2229566, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.233422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2229566:2232486, ack 179676, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.233796 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232486:2232578, ack 179676, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:01.238008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2232486, win 4380, length 0 15:02:01.238493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179676:179721, ack 2232578, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.238563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232578:2232682, ack 179721, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.240181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179721:179809, ack 2232682, win 4331, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.240262 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232682:2232721, ack 179809, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.242532 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179809:179905, ack 2232721, win 4321, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.243414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232721:2232860, ack 179905, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.245015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179905:179981, ack 2232860, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.245870 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232860:2232932, ack 179981, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.247494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 179981:180057, ack 2232932, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.248306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2232932:2233020, ack 180057, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.249977 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180057:180153, ack 2233020, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.252412 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2233020:2234308, ack 180153, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:01.254592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180153:180198, ack 2234308, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.255302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2234308:2234347, ack 180198, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.257617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180198:180306, ack 2234347, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.258477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2234347:2234486, ack 180306, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.260155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180306:180382, ack 2234486, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.261029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2234486:2234558, ack 180382, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.262614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180382:180458, ack 2234558, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.263425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2234558:2234646, ack 180458, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.265051 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180458:180566, ack 2234646, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.268045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2234646:2236106, ack 180566, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.268253 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236106:2236114, ack 180566, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:01.270785 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2236114, win 4380, length 0 15:02:01.270880 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236114:2236218, ack 180566, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.271268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180566:180611, ack 2236114, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.272547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180611:180699, ack 2236218, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.272632 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236218:2236257, ack 180699, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.274948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180699:180817, ack 2236257, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.275840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236257:2236396, ack 180817, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.277435 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180817:180893, ack 2236396, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.278309 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236396:2236468, ack 180893, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.279906 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180893:180969, ack 2236468, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.280720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2236468:2236556, ack 180969, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.282956 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 180969:181087, ack 2236556, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.288435 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2236556:2238016, ack 181087, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.288643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2238016:2239324, ack 181087, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:01.291265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2239324, win 4380, length 0 15:02:01.291722 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181087:181132, ack 2239324, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.292371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2239324:2239363, ack 181132, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.294674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181132:181234, ack 2239363, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.295599 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2239363:2239502, ack 181234, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.297192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181234:181310, ack 2239502, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.298034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2239502:2239574, ack 181310, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.299669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181310:181386, ack 2239574, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.300477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2239574:2239662, ack 181386, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.302107 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181386:181488, ack 2239662, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.315774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2239662:2246962, ack 181488, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.316036 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2246962:2247150, ack 181488, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:01.318712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2242582, win 4380, length 0 15:02:01.321498 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2245502, win 4380, length 0 15:02:01.322724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2247150, win 4380, length 0 15:02:01.322789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247150:2247254, ack 181488, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.323147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181488:181533, ack 2247150, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.324416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181533:181621, ack 2247254, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.324502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247254:2247293, ack 181621, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.326774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181621:181723, ack 2247293, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.327662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247293:2247432, ack 181723, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.329362 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181723:181799, ack 2247432, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.330199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247432:2247504, ack 181799, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.331798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181799:181875, ack 2247504, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.332612 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247504:2247592, ack 181875, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.334246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181875:181977, ack 2247592, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.336218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2247592:2248312, ack 181977, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:01.344397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 181977:182022, ack 2248312, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.345096 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2248312:2248351, ack 182022, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.347481 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182022:182148, ack 2248351, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.348352 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2248351:2248490, ack 182148, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.349960 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182148:182224, ack 2248490, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.350793 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2248490:2248562, ack 182224, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.352361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182224:182300, ack 2248562, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.353216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2248562:2248650, ack 182300, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.354852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182300:182426, ack 2248650, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.381185 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2248650:2263250, ack 182426, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.384165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2251570, win 4380, length 0 15:02:01.386201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2254490, win 4380, length 0 15:02:01.386278 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2263250:2264710, ack 182426, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:01.386322 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2264710:2264954, ack 182426, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:01.388386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2257410, win 4380, length 0 15:02:01.391667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2260330, win 4380, length 0 15:02:01.393697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2263250, win 4380, length 0 15:02:01.395727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2264954, win 4380, length 0 15:02:01.395794 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2264954:2265058, ack 182426, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.396385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182426:182586, ack 2264954, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.397587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182586:182674, ack 2265058, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.422958 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2265058:2281118, ack 182674, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.423308 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2281118:2281478, ack 182674, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:01.425955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2267978, win 4380, length 0 15:02:01.428071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2270898, win 4380, length 0 15:02:01.430213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2273818, win 4380, length 0 15:02:01.432349 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2276738, win 4380, length 0 15:02:01.438529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2279658, win 4380, length 0 15:02:01.438968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2281478, win 4380, length 0 15:02:01.457370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182674:182790, ack 2281478, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.482870 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2281478:2297538, ack 182790, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.483215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2297538:2297822, ack 182790, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:01.486073 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2284398, win 4380, length 0 15:02:01.488074 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2287318, win 4380, length 0 15:02:01.491120 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2290238, win 4380, length 0 15:02:01.493326 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2293158, win 4380, length 0 15:02:01.495508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2296078, win 4380, length 0 15:02:01.497514 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2297822, win 4380, length 0 15:02:01.497995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182790:182831, ack 2297822, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:01.498878 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2297822:2297861, ack 182831, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:01.500450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182831:182876, ack 2297861, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.501137 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2297861:2297900, ack 182876, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.503553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 182876:183004, ack 2297900, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.503634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2297900:2298004, ack 183004, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.505290 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183004:183092, ack 2298004, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.505379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2298004:2298143, ack 183092, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.507344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183092:183168, ack 2298143, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.508178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2298143:2298215, ack 183168, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.509796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183168:183244, ack 2298215, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.510654 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2298215:2298303, ack 183244, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.512294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183244:183372, ack 2298303, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.518812 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2298303:2301223, ack 183372, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.519051 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2301223:2301723, ack 183372, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:01.521760 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2301223, win 4380, length 0 15:02:01.523915 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183372:183417, ack 2301723, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.524590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2301723:2301762, ack 183417, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.527309 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183417:183525, ack 2301762, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.528224 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2301762:2301901, ack 183525, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.529842 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183525:183601, ack 2301901, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.530681 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2301901:2301973, ack 183601, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.532324 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183601:183677, ack 2301973, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.533141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2301973:2302061, ack 183677, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.534801 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183677:183785, ack 2302061, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.538554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2302061:2303521, ack 183785, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:01.538757 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2303521:2303957, ack 183785, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:01.541212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2303957, win 4380, length 0 15:02:01.541617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183785:183830, ack 2303957, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.542272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2303957:2303996, ack 183830, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.544653 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183830:183956, ack 2303996, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.544737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2303996:2304100, ack 183956, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.546434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 183956:184044, ack 2304100, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.546523 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2304100:2304239, ack 184044, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.548172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184044:184120, ack 2304239, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.549016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2304239:2304311, ack 184120, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.550624 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184120:184196, ack 2304311, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.551451 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2304311:2304399, ack 184196, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.553087 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184196:184322, ack 2304399, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.555194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2304399:2305099, ack 184322, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:01.563461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184322:184367, ack 2305099, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.564234 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305099:2305138, ack 184367, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.566642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184367:184501, ack 2305138, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.567526 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305138:2305277, ack 184501, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.569125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184501:184577, ack 2305277, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.569969 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305277:2305349, ack 184577, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.571550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184577:184653, ack 2305349, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.572371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305349:2305437, ack 184653, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.574013 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184653:184787, ack 2305437, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.575319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305437:2305705, ack 184787, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:01.577227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184787:184832, ack 2305705, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.577905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305705:2305744, ack 184832, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.580321 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184832:184966, ack 2305744, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:01.581191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305744:2305883, ack 184966, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:01.582782 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 184966:185042, ack 2305883, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.584241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305883:2305955, ack 185042, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:01.585836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185042:185118, ack 2305955, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.585937 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2305955:2306059, ack 185118, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:01.588227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185118:185206, ack 2306059, win 4224, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:01.588343 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2306059:2306147, ack 185206, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:01.590266 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185206:185340, ack 2306147, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:01.592800 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2306147:2307087, ack 185340, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:01.594828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185340:185385, ack 2307087, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:01.595548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2307087:2307126, ack 185385, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:01.796026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2307126, win 4370, length 0 15:02:03.114430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185385:185465, ack 2307126, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.115489 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2307126:2307230, ack 185465, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:03.117279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185465:185545, ack 2307230, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.118197 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2307230:2307318, ack 185545, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.119866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185545:185635, ack 2307318, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.120751 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2307318:2307457, ack 185635, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.122433 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185635:185725, ack 2307457, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.130903 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2307457:2311837, ack 185725, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.131158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2311837:2311865, ack 185725, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:03.134820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2310377, win 4380, length 0 15:02:03.136751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2311865, win 4380, length 0 15:02:03.138634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185725:185815, ack 2311865, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.139498 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2311865:2312004, ack 185815, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.141427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185815:185860, ack 2312004, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.142122 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2312004:2312043, ack 185860, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.143711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185860:185950, ack 2312043, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.152112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2312043:2316423, ack 185950, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.152454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316423:2316451, ack 185950, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:03.154998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2314963, win 4380, length 0 15:02:03.156877 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2316451, win 4380, length 0 15:02:03.156945 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316451:2316555, ack 185950, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.157559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185950:185995, ack 2316451, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.193781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 185995, win 3247, length 0 15:02:03.355999 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2316555, win 4354, length 0 15:02:03.356073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316555:2316594, ack 185995, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.375372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 185995:186083, ack 2316594, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.375580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 186083, win 3247, length 0 15:02:03.377090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186083:186201, ack 2316594, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.377316 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 186201, win 3247, length 0 15:02:03.378129 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316594:2316733, ack 186201, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.381365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186201:186277, ack 2316733, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.382204 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316733:2316805, ack 186277, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.384249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186277:186353, ack 2316805, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.385085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2316805:2316893, ack 186353, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.386800 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186353:186471, ack 2316893, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.391309 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2316893:2318353, ack 186471, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.391518 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2318353:2319093, ack 186471, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:03.394018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2319093, win 4380, length 0 15:02:03.394489 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186471:186516, ack 2319093, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.395164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319093:2319132, ack 186516, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.397541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186516:186616, ack 2319132, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.398416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319132:2319271, ack 186616, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.400033 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186616:186692, ack 2319271, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.400872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319271:2319343, ack 186692, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.402464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186692:186768, ack 2319343, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.402830 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319343:2319447, ack 186768, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.404579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186768:186856, ack 2319447, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.404662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319447:2319535, ack 186856, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.406350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186856:186956, ack 2319535, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.408076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2319535:2320115, ack 186956, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:03.409968 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 186956:187001, ack 2320115, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.410649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320115:2320154, ack 187001, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.413388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187001:187111, ack 2320154, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.414312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320154:2320293, ack 187111, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.415904 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187111:187187, ack 2320293, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.416738 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320293:2320365, ack 187187, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.419946 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187187:187263, ack 2320365, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.420757 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320365:2320453, ack 187263, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.422403 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187263:187373, ack 2320453, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.423995 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320453:2320949, ack 187373, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:03.425802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187373:187418, ack 2320949, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.426486 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320949:2320988, ack 187418, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.428848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187418:187522, ack 2320988, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.429709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2320988:2321127, ack 187522, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.431328 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187522:187598, ack 2321127, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.432201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2321127:2321199, ack 187598, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.433769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187598:187674, ack 2321199, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.434609 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2321199:2321287, ack 187674, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.436232 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187674:187778, ack 2321287, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.455850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2321287:2331507, ack 187778, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.459699 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2324207, win 4380, length 0 15:02:03.459801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2331507:2335887, ack 187778, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:03.461743 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2327127, win 4380, length 0 15:02:03.461815 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2335887:2337347, ack 187778, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:03.461856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2337347:2337791, ack 187778, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:02:03.464838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2330047, win 4380, length 0 15:02:03.467015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2332967, win 4380, length 0 15:02:03.469290 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2335887, win 4380, length 0 15:02:03.472401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2337791, win 4380, length 0 15:02:03.472887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187778:187819, ack 2337791, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:03.473314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187819:187907, ack 2337791, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.473955 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2337791:2337830, ack 187907, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:03.475558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187907:187952, ack 2337830, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.476245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2337830:2337869, ack 187952, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.478753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 187952:188062, ack 2337869, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.479635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2337869:2338008, ack 188062, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.481234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188062:188138, ack 2338008, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.482077 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2338008:2338080, ack 188138, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.483652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188138:188214, ack 2338080, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.484566 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2338080:2338168, ack 188214, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.486196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188214:188324, ack 2338168, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.492276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2338168:2341088, ack 188324, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.492506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341088:2341556, ack 188324, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:03.496784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2341088, win 4380, length 0 15:02:03.497611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188324:188369, ack 2341556, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.498285 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341556:2341595, ack 188369, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.501246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188369:188471, ack 2341595, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.502165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341595:2341734, ack 188471, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.504244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188471:188547, ack 2341734, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.504328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341734:2341838, ack 188547, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.506022 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188547:188635, ack 2341838, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.506107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341838:2341910, ack 188635, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.507725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188635:188711, ack 2341910, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.508550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2341910:2341998, ack 188711, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.510220 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188711:188813, ack 2341998, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.515709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2341998:2344918, ack 188813, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.515939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2344918:2345010, ack 188813, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:03.520563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2344918, win 4380, length 0 15:02:03.531611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188813:188858, ack 2345010, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.532299 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2345010:2345049, ack 188858, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.535550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188858:188954, ack 2345049, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.536438 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2345049:2345188, ack 188954, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.538540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 188954:189030, ack 2345188, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.539369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2345188:2345260, ack 189030, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.541162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189030:189106, ack 2345260, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.542143 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2345260:2345348, ack 189106, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.543793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189106:189202, ack 2345348, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.546270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2345348:2346636, ack 189202, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:03.548480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189202:189247, ack 2346636, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.549172 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2346636:2346675, ack 189247, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.551560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189247:189355, ack 2346675, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.552417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2346675:2346814, ack 189355, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.554004 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189355:189431, ack 2346814, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.554387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2346814:2346918, ack 189431, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.556009 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189431:189519, ack 2346918, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.556093 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2346918:2346990, ack 189519, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.557688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189519:189595, ack 2346990, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.558518 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2346990:2347078, ack 189595, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.560264 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189595:189703, ack 2347078, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.563245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2347078:2348538, ack 189703, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.563449 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2348538:2348546, ack 189703, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:03.565893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2348546, win 4380, length 0 15:02:03.566329 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189703:189748, ack 2348546, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.566993 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2348546:2348585, ack 189748, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.569394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189748:189866, ack 2348585, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.570273 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2348585:2348724, ack 189866, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.571862 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189866:189942, ack 2348724, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.572699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2348724:2348796, ack 189942, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.574268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 189942:190018, ack 2348796, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.575141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2348796:2348884, ack 190018, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.577050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190018:190136, ack 2348884, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.582450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2348884:2350344, ack 190136, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.582656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2350344:2351652, ack 190136, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:03.585662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2351652, win 4380, length 0 15:02:03.586057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190136:190181, ack 2351652, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.586717 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2351652:2351691, ack 190181, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.589133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190181:190283, ack 2351691, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.591103 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2351691:2351830, ack 190283, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.592715 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190283:190359, ack 2351830, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.593127 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2351830:2351934, ack 190359, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.594745 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190359:190447, ack 2351934, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.594837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2351934:2352006, ack 190447, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.596442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190447:190523, ack 2352006, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.597276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2352006:2352094, ack 190523, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.598930 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190523:190625, ack 2352094, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.612576 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2352094:2359394, ack 190625, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.612846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359394:2359582, ack 190625, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:03.615573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2355014, win 4380, length 0 15:02:03.617694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2357934, win 4380, length 0 15:02:03.619744 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2359582, win 4380, length 0 15:02:03.620155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190625:190670, ack 2359582, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.620836 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359582:2359621, ack 190670, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.624361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190670:190772, ack 2359621, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.625289 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359621:2359760, ack 190772, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.626895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190772:190848, ack 2359760, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.627741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359760:2359832, ack 190848, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.629331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190848:190924, ack 2359832, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.630157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359832:2359920, ack 190924, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.631792 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 190924:191026, ack 2359920, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.633816 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2359920:2360640, ack 191026, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:03.642098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191026:191071, ack 2360640, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.642799 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2360640:2360679, ack 191071, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.645178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191071:191197, ack 2360679, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.646065 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2360679:2360818, ack 191197, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.647717 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191197:191273, ack 2360818, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.648095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2360818:2360922, ack 191273, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.649789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191273:191361, ack 2360922, win 4045, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.649872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2360922:2360994, ack 191361, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.651508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191361:191437, ack 2360994, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.652335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2360994:2361082, ack 191437, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.654003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191437:191563, ack 2361082, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.680356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2361082:2375682, ack 191563, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.683368 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2364002, win 4380, length 0 15:02:03.687057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2366922, win 4380, length 0 15:02:03.687138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2375682:2377142, ack 191563, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:03.687182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2377142:2377386, ack 191563, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:03.688513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2369842, win 4380, length 0 15:02:03.691601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2372762, win 4380, length 0 15:02:03.693824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2375682, win 4380, length 0 15:02:03.695800 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2377386, win 4380, length 0 15:02:03.696671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191563:191723, ack 2377386, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.722904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2377386:2393446, ack 191723, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.723242 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2393446:2393806, ack 191723, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:03.725953 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2380306, win 4380, length 0 15:02:03.729693 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2383226, win 4380, length 0 15:02:03.731840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2386146, win 4380, length 0 15:02:03.734028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2389066, win 4380, length 0 15:02:03.736120 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2391986, win 4380, length 0 15:02:03.738003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2393806, win 4380, length 0 15:02:03.738646 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191723:191839, ack 2393806, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.764255 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2393806:2409866, ack 191839, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.764594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2409866:2410150, ack 191839, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:03.767235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2396726, win 4380, length 0 15:02:03.770117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2399646, win 4380, length 0 15:02:03.774643 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2402566, win 4380, length 0 15:02:03.776111 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2405486, win 4380, length 0 15:02:03.779253 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2408406, win 4380, length 0 15:02:03.781106 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2410150, win 4380, length 0 15:02:03.781174 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410150:2410254, ack 191839, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.781634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191839:191880, ack 2410150, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:03.782909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191880:191968, ack 2410254, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.782994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410254:2410293, ack 191968, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:03.784557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 191968:192013, ack 2410293, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.785244 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410293:2410332, ack 192013, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.787667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192013:192141, ack 2410332, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.788570 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410332:2410471, ack 192141, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.790676 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192141:192217, ack 2410471, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.791517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410471:2410543, ack 192217, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.793095 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192217:192293, ack 2410543, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.794078 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2410543:2410631, ack 192293, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.796326 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192293:192421, ack 2410631, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.802781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2410631:2413551, ack 192421, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.803007 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2413551:2414051, ack 192421, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:03.806635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2413551, win 4380, length 0 15:02:03.808033 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192421:192466, ack 2414051, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.808720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2414051:2414090, ack 192466, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.811138 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192466:192574, ack 2414090, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.812067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2414090:2414229, ack 192574, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.813659 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192574:192650, ack 2414229, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.814547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2414229:2414301, ack 192650, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.816118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192650:192726, ack 2414301, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.816939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2414301:2414389, ack 192726, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.818599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192726:192834, ack 2414389, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.818678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2414389:2414493, ack 192834, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.820285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192834:192922, ack 2414493, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.822717 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2414493:2415953, ack 192922, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:03.822913 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2415953:2416389, ack 192922, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:03.825387 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2416389, win 4380, length 0 15:02:03.825832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192922:192967, ack 2416389, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.826485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2416389:2416428, ack 192967, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.829596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 192967:193093, ack 2416428, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.830508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2416428:2416567, ack 193093, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.832184 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193093:193169, ack 2416567, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.833023 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2416567:2416639, ack 193169, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.834618 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193169:193245, ack 2416639, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.835451 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2416639:2416727, ack 193245, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.837094 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193245:193371, ack 2416727, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.839108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2416727:2417427, ack 193371, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:03.847319 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193371:193416, ack 2417427, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.848471 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417427:2417466, ack 193416, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.850920 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193416:193550, ack 2417466, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.851847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417466:2417605, ack 193550, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.853427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193550:193626, ack 2417605, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.854353 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417605:2417677, ack 193626, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.855932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193626:193702, ack 2417677, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.856763 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417677:2417765, ack 193702, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.858453 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193702:193836, ack 2417765, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.858822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417765:2417869, ack 193836, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:03.860463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193836:193924, ack 2417869, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:03.860553 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2417869:2418137, ack 193924, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:03.862284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193924:193969, ack 2418137, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.862971 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2418137:2418176, ack 193969, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:03.865357 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 193969:194103, ack 2418176, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:03.866274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2418176:2418315, ack 194103, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:03.867861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194103:194179, ack 2418315, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.868741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2418315:2418387, ack 194179, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:03.870344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194179:194255, ack 2418387, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.871167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2418387:2418475, ack 194255, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:03.872830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194255:194389, ack 2418475, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:03.875441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2418475:2419415, ack 194389, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:03.877449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194389:194434, ack 2419415, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:03.878141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2419415:2419454, ack 194434, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:04.073565 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2419454, win 4370, length 0 15:02:05.392408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194434:194524, ack 2419454, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.393480 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2419454:2419593, ack 194524, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.395232 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194524:194604, ack 2419593, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.396141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2419593:2419697, ack 194604, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:05.398187 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194604:194684, ack 2419697, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.399030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2419697:2419785, ack 194684, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.400658 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194684:194774, ack 2419785, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.409134 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2419785:2424165, ack 194774, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.409383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2424165:2424193, ack 194774, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:05.412096 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2422705, win 4380, length 0 15:02:05.414092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2424193, win 4380, length 0 15:02:05.414477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2424193:2424297, ack 194774, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.416181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194774:194864, ack 2424297, win 4354, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.417092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2424297:2424436, ack 194864, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.418837 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194864:194952, ack 2424436, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.453777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 194952, win 3247, length 0 15:02:05.455390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 194952:195042, ack 2424436, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.455458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 195042, win 3247, length 0 15:02:05.463837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2424436:2428816, ack 195042, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.464085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2428816:2428844, ack 195042, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:05.466730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2427356, win 4380, length 0 15:02:05.471234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2428844, win 4380, length 0 15:02:05.471599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195042:195087, ack 2428844, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.472279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2428844:2428883, ack 195087, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.474014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195087:195132, ack 2428883, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.474702 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2428883:2428922, ack 195132, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.477004 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195132:195250, ack 2428922, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.477884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2428922:2429061, ack 195250, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.479598 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195250:195326, ack 2429061, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.480429 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2429061:2429133, ack 195326, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.482150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195326:195402, ack 2429133, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.482960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2429133:2429221, ack 195402, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.485095 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195402:195520, ack 2429221, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.489596 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2429221:2430681, ack 195520, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.489806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2430681:2431421, ack 195520, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:05.492335 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2431421, win 4380, length 0 15:02:05.492756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195520:195565, ack 2431421, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.493413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431421:2431460, ack 195565, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.495689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195565:195665, ack 2431460, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.495773 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431460:2431564, ack 195665, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.497441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195665:195753, ack 2431564, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.497526 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431564:2431703, ack 195753, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.499097 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195753:195829, ack 2431703, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.499931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431703:2431775, ack 195829, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.501504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195829:195905, ack 2431775, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.502319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431775:2431863, ack 195905, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.503940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 195905:196005, ack 2431863, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.505663 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2431863:2432443, ack 196005, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:05.507504 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196005:196050, ack 2432443, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.508247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2432443:2432482, ack 196050, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.510596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196050:196160, ack 2432482, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.511468 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2432482:2432621, ack 196160, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.513059 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196160:196236, ack 2432621, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.513949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2432621:2432693, ack 196236, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.515519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196236:196312, ack 2432693, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.516331 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2432693:2432781, ack 196312, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.517969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196312:196422, ack 2432781, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.519494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2432781:2433277, ack 196422, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:05.521334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196422:196467, ack 2433277, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.522015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2433277:2433316, ack 196467, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.524280 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196467:196571, ack 2433316, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.525153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2433316:2433455, ack 196571, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.526855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196571:196647, ack 2433455, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.527227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2433455:2433559, ack 196647, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.529536 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196647:196735, ack 2433559, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.529620 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2433559:2433631, ack 196735, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.531239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196735:196811, ack 2433631, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.532092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2433631:2433719, ack 196811, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.533749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196811:196915, ack 2433719, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.554193 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2433719:2443939, ack 196915, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.557115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2436639, win 4380, length 0 15:02:05.557216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2443939:2448319, ack 196915, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:05.559267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2439559, win 4380, length 0 15:02:05.559338 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2448319:2449779, ack 196915, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:05.559381 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2449779:2450119, ack 196915, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:05.563209 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2442479, win 4380, length 0 15:02:05.565415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2445399, win 4380, length 0 15:02:05.567553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2448319, win 4380, length 0 15:02:05.571268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2450119, win 4380, length 0 15:02:05.571634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196915:196956, ack 2450119, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:05.572500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2450119:2450158, ack 196956, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:05.574042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 196956:197001, ack 2450158, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.574762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2450158:2450197, ack 197001, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.577136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197001:197111, ack 2450197, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.578029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2450197:2450336, ack 197111, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.579997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197111:197187, ack 2450336, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.580838 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2450336:2450408, ack 197187, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.582444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197187:197263, ack 2450408, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.583263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2450408:2450496, ack 197263, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.584888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197263:197373, ack 2450496, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.591047 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2450496:2453416, ack 197373, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.591391 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2453416:2453884, ack 197373, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:05.593949 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2453416, win 4380, length 0 15:02:05.595449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197373:197418, ack 2453884, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.595565 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2453884:2453988, ack 197418, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.597178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197418:197506, ack 2453988, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.597271 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2453988:2454027, ack 197506, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.599563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197506:197608, ack 2454027, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.600629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2454027:2454166, ack 197608, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.602531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197608:197684, ack 2454166, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.603433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2454166:2454238, ack 197684, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.605011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197684:197760, ack 2454238, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.605855 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2454238:2454326, ack 197760, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.607480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197760:197862, ack 2454326, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.612869 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2454326:2457246, ack 197862, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.613112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457246:2457338, ack 197862, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:05.615714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2457246, win 4380, length 0 15:02:05.616967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197862:197907, ack 2457338, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.617645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457338:2457377, ack 197907, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.619939 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 197907:198003, ack 2457377, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.620861 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457377:2457516, ack 198003, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.622455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198003:198079, ack 2457516, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.623304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457516:2457588, ack 198079, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.624889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198079:198155, ack 2457588, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.625728 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457588:2457676, ack 198155, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.627352 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198155:198251, ack 2457676, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.627730 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457676:2457780, ack 198251, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.629359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198251:198339, ack 2457780, win 4246, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.630461 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2457780:2459068, ack 198339, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:05.632678 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198339:198384, ack 2459068, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.633351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2459068:2459107, ack 198384, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.635622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198384:198492, ack 2459107, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.636507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2459107:2459246, ack 198492, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.638105 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198492:198568, ack 2459246, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.638942 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2459246:2459318, ack 198568, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.640541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198568:198644, ack 2459318, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.641399 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2459318:2459406, ack 198644, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.643055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198644:198752, ack 2459406, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.646119 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2459406:2460866, ack 198752, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.646327 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2460866:2460874, ack 198752, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:05.649590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2460874, win 4380, length 0 15:02:05.650024 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198752:198797, ack 2460874, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.650679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2460874:2460913, ack 198797, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.652969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198797:198915, ack 2460913, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.653890 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2460913:2461052, ack 198915, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.655482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198915:198991, ack 2461052, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.656321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2461052:2461124, ack 198991, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.657895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 198991:199067, ack 2461124, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.658716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2461124:2461212, ack 199067, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.660393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199067:199185, ack 2461212, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.665915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2461212:2462672, ack 199185, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.666124 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2462672:2463980, ack 199185, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:05.668704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2463980, win 4380, length 0 15:02:05.668789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2463980:2464084, ack 199185, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.669210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199185:199230, ack 2463980, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.670531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199230:199318, ack 2464084, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.670614 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2464084:2464123, ack 199318, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.674007 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199318:199420, ack 2464123, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.674900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2464123:2464262, ack 199420, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.676501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199420:199496, ack 2464262, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.677344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2464262:2464334, ack 199496, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.678932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199496:199572, ack 2464334, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.679784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2464334:2464422, ack 199572, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.682084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199572:199674, ack 2464422, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.695664 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2464422:2471722, ack 199674, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.695938 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2471722:2471910, ack 199674, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:05.699492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2467342, win 4380, length 0 15:02:05.701625 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2470262, win 4380, length 0 15:02:05.703645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2471910, win 4380, length 0 15:02:05.715485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199674:199719, ack 2471910, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.716179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2471910:2471949, ack 199719, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.718604 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199719:199821, ack 2471949, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.719501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2471949:2472088, ack 199821, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.721228 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199821:199897, ack 2472088, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.722100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2472088:2472160, ack 199897, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.723893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199897:199973, ack 2472160, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.724731 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2472160:2472248, ack 199973, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.726559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 199973:200075, ack 2472248, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.726928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2472248:2472352, ack 200075, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.728621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200075:200163, ack 2472352, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.729158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2472352:2473072, ack 200163, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:05.731365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200163:200208, ack 2473072, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.732056 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2473072:2473111, ack 200208, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.734397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200208:200334, ack 2473111, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.735307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2473111:2473250, ack 200334, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.736988 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200334:200410, ack 2473250, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.737835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2473250:2473322, ack 200410, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.739615 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200410:200486, ack 2473322, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.740426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2473322:2473410, ack 200486, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.742106 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200486:200612, ack 2473410, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.768499 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2473410:2488010, ack 200612, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.772472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2476330, win 4380, length 0 15:02:05.776217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2479250, win 4380, length 0 15:02:05.776296 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2488010:2489470, ack 200612, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:05.776341 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2489470:2489714, ack 200612, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:05.778510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2482170, win 4380, length 0 15:02:05.780699 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2485090, win 4380, length 0 15:02:05.782887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2488010, win 4380, length 0 15:02:05.784935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2489714, win 4380, length 0 15:02:05.785550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200612:200772, ack 2489714, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.811802 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2489714:2505774, ack 200772, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.812161 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2505774:2506134, ack 200772, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:05.814859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2492634, win 4380, length 0 15:02:05.816971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2495554, win 4380, length 0 15:02:05.819210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2498474, win 4380, length 0 15:02:05.822125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2501394, win 4380, length 0 15:02:05.823472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2504314, win 4380, length 0 15:02:05.825428 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2506134, win 4380, length 0 15:02:05.825509 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2506134:2506238, ack 200772, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.825983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200772:200888, ack 2506134, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.827239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200888:200976, ack 2506238, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.851795 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2506238:2522298, ack 200976, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.852142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522298:2522582, ack 200976, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:05.854874 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2509158, win 4380, length 0 15:02:05.857043 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2512078, win 4380, length 0 15:02:05.859283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2514998, win 7300, length 0 15:02:05.862261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2517918, win 7300, length 0 15:02:05.864426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2520838, win 7300, length 0 15:02:05.866495 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2522582, win 7300, length 0 15:02:05.877189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 200976:201017, ack 2522582, win 7300, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:05.878072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522582:2522621, ack 201017, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:05.879835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201017:201062, ack 2522621, win 7290, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.880517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522621:2522660, ack 201062, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.883004 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201062:201190, ack 2522660, win 7280, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.883951 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522660:2522799, ack 201190, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.885546 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201190:201266, ack 2522799, win 7245, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.886403 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522799:2522871, ack 201266, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.888598 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201266:201342, ack 2522871, win 7227, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.889413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2522871:2522959, ack 201342, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.891632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201342:201470, ack 2522959, win 7205, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.898149 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2522959:2525879, ack 201470, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.898380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2525879:2526379, ack 201470, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:05.901035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2525879, win 6475, length 0 15:02:05.902516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201470:201515, ack 2526379, win 6350, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.903182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2526379:2526418, ack 201515, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.905523 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201515:201623, ack 2526418, win 6341, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.905606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2526418:2526522, ack 201623, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.907254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201623:201711, ack 2526522, win 6315, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.907342 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2526522:2526661, ack 201711, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.908910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201711:201787, ack 2526661, win 6280, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.909738 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2526661:2526733, ack 201787, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.911367 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201787:201863, ack 2526733, win 6262, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.912485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2526733:2526821, ack 201863, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.914509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201863:201971, ack 2526821, win 6240, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.918669 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2526821:2528281, ack 201971, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:05.918883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2528281:2528717, ack 201971, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:05.921369 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2528717, win 5766, length 0 15:02:05.921778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 201971:202016, ack 2528717, win 5766, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.922446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2528717:2528756, ack 202016, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.924738 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202016:202142, ack 2528756, win 5756, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.925645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2528756:2528895, ack 202142, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.927237 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202142:202218, ack 2528895, win 5721, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.928080 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2528895:2528967, ack 202218, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.929685 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202218:202294, ack 2528967, win 5703, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.930542 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2528967:2529055, ack 202294, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.932195 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202294:202420, ack 2529055, win 5681, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.934325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2529055:2529755, ack 202420, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:05.936486 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202420:202465, ack 2529755, win 5506, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.937173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2529755:2529794, ack 202465, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.939545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202465:202599, ack 2529794, win 5497, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.939917 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2529794:2529898, ack 202599, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:05.944091 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202599:202687, ack 2529898, win 5471, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:05.944179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2529898:2530037, ack 202687, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.945780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202687:202763, ack 2530037, win 5436, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.946630 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530037:2530109, ack 202763, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.948238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202763:202839, ack 2530109, win 5418, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.949057 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530109:2530197, ack 202839, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.950736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202839:202973, ack 2530197, win 5396, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.951994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530197:2530465, ack 202973, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:05.953730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 202973:203018, ack 2530465, win 5329, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.954477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530465:2530504, ack 203018, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:05.956843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203018:203152, ack 2530504, win 5319, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:05.957728 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530504:2530643, ack 203152, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:05.959338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203152:203228, ack 2530643, win 5284, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.960189 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530643:2530715, ack 203228, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:05.961786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203228:203304, ack 2530715, win 5266, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.962605 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530715:2530803, ack 203304, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:05.964248 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203304:203438, ack 2530803, win 5244, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:05.966716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2530803:2531743, ack 203438, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:05.968748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203438:203483, ack 2531743, win 5009, length 45SMB PACKET: SMBclose (REQUEST) 15:02:05.969433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2531743:2531782, ack 203483, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:06.163984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2531782, win 5000, length 0 15:02:06.543729 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:02:07.466106 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203483:203563, ack 2531782, win 5000, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.467146 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2531782:2531886, ack 203563, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:07.468910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203563:203643, ack 2531886, win 4974, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.469816 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2531886:2531974, ack 203643, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.471451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203643:203733, ack 2531974, win 4952, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.471535 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2531974:2532078, ack 203733, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.661820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2532078, win 4926, length 0 15:02:07.661935 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2532078:2532217, ack 203733, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.663758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203733:203821, ack 2532217, win 4891, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.703710 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 203821, win 3247, length 0 15:02:07.705316 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203821:203911, ack 2532217, win 4891, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.705378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 203911, win 3247, length 0 15:02:07.713845 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2532217:2536597, ack 203911, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.714094 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2536597:2536625, ack 203911, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:07.716747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2535137, win 4161, length 0 15:02:07.721458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2536625, win 4380, length 0 15:02:07.723709 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 203911:204001, ack 2536625, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.724585 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2536625:2536764, ack 204001, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.726279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204001:204046, ack 2536764, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.726979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2536764:2536803, ack 204046, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.728575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204046:204136, ack 2536803, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.737011 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2536803:2541183, ack 204136, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.737257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541183:2541211, ack 204136, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:07.739908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2539723, win 4380, length 0 15:02:07.741797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2541211, win 4380, length 0 15:02:07.742427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204136:204181, ack 2541211, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.743088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541211:2541250, ack 204181, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.745439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204181:204299, ack 2541250, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.746340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541250:2541389, ack 204299, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.748014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204299:204375, ack 2541389, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.748847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541389:2541461, ack 204375, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.750613 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204375:204451, ack 2541461, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.750693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541461:2541565, ack 204451, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.752377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204451:204539, ack 2541565, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.752457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2541565:2541653, ack 204539, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.754150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204539:204657, ack 2541653, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.758629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2541653:2543113, ack 204657, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.758837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2543113:2543853, ack 204657, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:07.761423 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2543853, win 4380, length 0 15:02:07.761834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204657:204702, ack 2543853, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.762494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2543853:2543892, ack 204702, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.764827 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204702:204802, ack 2543892, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.765714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2543892:2544031, ack 204802, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.767310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204802:204878, ack 2544031, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.768149 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544031:2544103, ack 204878, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.769787 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204878:204954, ack 2544103, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.770631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544103:2544191, ack 204954, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.772294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 204954:205054, ack 2544191, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.774059 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544191:2544771, ack 205054, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:07.775907 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205054:205099, ack 2544771, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.776597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544771:2544810, ack 205099, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.778908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205099:205209, ack 2544810, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.779776 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544810:2544949, ack 205209, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.781381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205209:205285, ack 2544949, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.782221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2544949:2545021, ack 205285, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.785671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205285:205361, ack 2545021, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.786508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545021:2545109, ack 205361, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.788160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205361:205471, ack 2545109, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.788242 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545109:2545213, ack 205471, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.789888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205471:205559, ack 2545213, win 4040, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.789980 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545213:2545709, ack 205559, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:07.791818 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205559:205604, ack 2545709, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.792540 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545709:2545748, ack 205604, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.794827 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205604:205708, ack 2545748, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.795715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545748:2545887, ack 205708, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.797309 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205708:205784, ack 2545887, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.798142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545887:2545959, ack 205784, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.799769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205784:205860, ack 2545959, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.800582 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2545959:2546047, ack 205860, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.802230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205860:205964, ack 2546047, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.821798 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2546047:2556267, ack 205964, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.824768 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2548967, win 4380, length 0 15:02:07.824867 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2556267:2560647, ack 205964, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:07.826928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2551887, win 4380, length 0 15:02:07.827000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2560647:2562107, ack 205964, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:07.827042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562107:2562447, ack 205964, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:07.829902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2554807, win 4380, length 0 15:02:07.832028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2557727, win 4380, length 0 15:02:07.836854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2560647, win 4380, length 0 15:02:07.837230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2562447, win 4380, length 0 15:02:07.838154 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 205964:206005, ack 2562447, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:07.839002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562447:2562486, ack 206005, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:07.840583 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206005:206050, ack 2562486, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.841443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562486:2562525, ack 206050, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.843724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206050:206160, ack 2562525, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.843807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562525:2562629, ack 206160, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.845462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206160:206248, ack 2562629, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.845550 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562629:2562768, ack 206248, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.847089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206248:206324, ack 2562768, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.847937 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562768:2562840, ack 206324, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.849541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206324:206400, ack 2562840, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.850353 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2562840:2562928, ack 206400, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.851991 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206400:206510, ack 2562928, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.858187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2562928:2565848, ack 206510, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.858424 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2565848:2566316, ack 206510, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:07.861044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2565848, win 4380, length 0 15:02:07.862549 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206510:206555, ack 2566316, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.863222 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2566316:2566355, ack 206555, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.865507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206555:206657, ack 2566355, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.866390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2566355:2566494, ack 206657, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.867990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206657:206733, ack 2566494, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.868823 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2566494:2566566, ack 206733, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.870421 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206733:206809, ack 2566566, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.871231 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2566566:2566654, ack 206809, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.872859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206809:206911, ack 2566654, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.878396 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2566654:2569574, ack 206911, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.878627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2569574:2569666, ack 206911, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:07.881240 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2569574, win 4380, length 0 15:02:07.882553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206911:206956, ack 2569666, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.883218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2569666:2569705, ack 206956, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.885507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 206956:207052, ack 2569705, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.885591 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2569705:2569809, ack 207052, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.887239 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207052:207140, ack 2569809, win 4321, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.887325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2569809:2569948, ack 207140, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.888917 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207140:207216, ack 2569948, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.889755 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2569948:2570020, ack 207216, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.891336 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207216:207292, ack 2570020, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.892154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2570020:2570108, ack 207292, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.893780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207292:207388, ack 2570108, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.896245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2570108:2571396, ack 207388, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:07.898625 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207388:207433, ack 2571396, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.899350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2571396:2571435, ack 207433, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.901741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207433:207541, ack 2571435, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.902604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2571435:2571574, ack 207541, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.904616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207541:207617, ack 2571574, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.905462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2571574:2571646, ack 207617, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.907050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207617:207693, ack 2571646, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.907868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2571646:2571734, ack 207693, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.910191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207693:207801, ack 2571734, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.913166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2571734:2573194, ack 207801, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.913369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573194:2573202, ack 207801, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:07.916661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2573202, win 4380, length 0 15:02:07.917108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207801:207846, ack 2573202, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.917774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573202:2573241, ack 207846, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.920082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207846:207964, ack 2573241, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.920949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573241:2573380, ack 207964, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.922546 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 207964:208040, ack 2573380, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.922627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573380:2573484, ack 208040, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.925699 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208040:208128, ack 2573484, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.925785 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573484:2573556, ack 208128, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.927459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208128:208204, ack 2573556, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.928295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2573556:2573644, ack 208204, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.929966 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208204:208322, ack 2573644, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.935468 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2573644:2575104, ack 208322, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.935685 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2575104:2576412, ack 208322, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:07.939351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2576412, win 4380, length 0 15:02:07.939780 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208322:208367, ack 2576412, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.940468 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2576412:2576451, ack 208367, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.942810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208367:208469, ack 2576451, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.943730 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2576451:2576590, ack 208469, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.946287 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208469:208545, ack 2576590, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.947140 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2576590:2576662, ack 208545, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.948884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208545:208621, ack 2576662, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.949707 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2576662:2576750, ack 208621, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.951531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208621:208723, ack 2576750, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.965302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2576750:2584050, ack 208723, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:07.965572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584050:2584238, ack 208723, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:07.969226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2579670, win 4380, length 0 15:02:07.971325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2582590, win 4380, length 0 15:02:07.973207 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2584238, win 4380, length 0 15:02:07.974995 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208723:208768, ack 2584238, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.975681 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584238:2584277, ack 208768, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.978052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208768:208870, ack 2584277, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.978136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584277:2584381, ack 208870, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:07.979848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208870:208958, ack 2584381, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:07.979937 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584381:2584520, ack 208958, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.981487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 208958:209034, ack 2584520, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.982313 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584520:2584592, ack 209034, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.983887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209034:209110, ack 2584592, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.984718 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584592:2584680, ack 209110, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:07.986350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209110:209212, ack 2584680, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.988307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2584680:2585400, ack 209212, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:07.990523 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209212:209257, ack 2585400, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:07.991208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2585400:2585439, ack 209257, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:07.994138 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209257:209383, ack 2585439, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:07.995034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2585439:2585578, ack 209383, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:07.996711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209383:209459, ack 2585578, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:07.997601 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2585578:2585650, ack 209459, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:07.999344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209459:209535, ack 2585650, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.000164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2585650:2585738, ack 209535, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.001841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209535:209661, ack 2585738, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.029688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2585738:2600338, ack 209661, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:08.032656 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2588658, win 4380, length 0 15:02:08.040525 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2591578, win 4380, length 0 15:02:08.040601 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2600338:2601798, ack 209661, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:08.040645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2601798:2602042, ack 209661, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:08.041205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2594498, win 4380, length 0 15:02:08.041458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2597418, win 4380, length 0 15:02:08.044234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2600338, win 4380, length 0 15:02:08.045501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2602042, win 4380, length 0 15:02:08.045578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2602042:2602146, ack 209661, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:08.046097 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209661:209821, ack 2602042, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.048047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209821:209909, ack 2602146, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:08.072770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2602146:2618206, ack 209909, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:08.073121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2618206:2618566, ack 209909, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:08.079526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2605066, win 4380, length 0 15:02:08.079879 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2607986, win 4380, length 0 15:02:08.081226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2610906, win 4380, length 0 15:02:08.083386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2613826, win 4380, length 0 15:02:08.085550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2616746, win 4380, length 0 15:02:08.087660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2618566, win 4380, length 0 15:02:08.104103 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 209909:210025, ack 2618566, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.129548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2618566:2634626, ack 210025, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:08.129891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2634626:2634910, ack 210025, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:08.132512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2621486, win 4380, length 0 15:02:08.134552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2624406, win 4380, length 0 15:02:08.136828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2627326, win 4380, length 0 15:02:08.139086 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2630246, win 4380, length 0 15:02:08.141297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2633166, win 4380, length 0 15:02:08.143325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2634910, win 4380, length 0 15:02:08.143835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210025:210066, ack 2634910, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:08.144731 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2634910:2634949, ack 210066, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:08.146297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210066:210111, ack 2634949, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.146996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2634949:2634988, ack 210111, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.149409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210111:210239, ack 2634988, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:08.150304 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2634988:2635127, ack 210239, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:08.151915 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210239:210315, ack 2635127, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.153037 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2635127:2635199, ack 210315, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:08.154651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210315:210391, ack 2635199, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.154744 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2635199:2635303, ack 210391, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:08.156354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210391:210479, ack 2635303, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:08.156441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2635303:2635391, ack 210479, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.158114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210479:210607, ack 2635391, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.164784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2635391:2638311, ack 210607, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:08.165021 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2638311:2638811, ack 210607, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:08.167728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2638311, win 4380, length 0 15:02:08.169192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210607:210652, ack 2638811, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.169869 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2638811:2638850, ack 210652, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.172205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210652:210760, ack 2638850, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:08.173091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2638850:2638989, ack 210760, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:08.174683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210760:210836, ack 2638989, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.175552 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2638989:2639061, ack 210836, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:08.177156 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210836:210912, ack 2639061, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.177983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2639061:2639149, ack 210912, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.179630 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 210912:211020, ack 2639149, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.183426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2639149:2640609, ack 211020, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:08.183629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2640609:2641045, ack 211020, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:08.186171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2641045, win 4380, length 0 15:02:08.186588 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211020:211065, ack 2641045, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.187269 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641045:2641084, ack 211065, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.190114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211065:211191, ack 2641084, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:08.191004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641084:2641223, ack 211191, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:08.197343 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211191:211267, ack 2641223, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.198212 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641223:2641295, ack 211267, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:08.199835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211267:211343, ack 2641295, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.199916 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641295:2641399, ack 211343, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:08.201524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211343:211431, ack 2641399, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:08.201606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641399:2641487, ack 211431, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.203267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211431:211557, ack 2641487, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.205364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2641487:2642187, ack 211557, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:08.207723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211557:211602, ack 2642187, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.208410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642187:2642226, ack 211602, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.210817 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211602:211736, ack 2642226, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:08.211732 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642226:2642365, ack 211736, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:08.213416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211736:211812, ack 2642365, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.214308 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642365:2642437, ack 211812, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:08.216054 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211812:211888, ack 2642437, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.216875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642437:2642525, ack 211888, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.218593 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 211888:212022, ack 2642525, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.219839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642525:2642793, ack 212022, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:08.221547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212022:212067, ack 2642793, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.222228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642793:2642832, ack 212067, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.225014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212067:212201, ack 2642832, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:08.225910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642832:2642971, ack 212201, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:08.227505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212201:212277, ack 2642971, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.228347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2642971:2643043, ack 212277, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:08.229947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212277:212353, ack 2643043, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.230770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2643043:2643131, ack 212353, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:08.233022 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212353:212487, ack 2643131, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:08.235571 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2643131:2644071, ack 212487, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:08.237579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212487:212532, ack 2644071, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:08.237666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2644071:2644175, ack 212532, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:08.239287 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212532:212620, ack 2644175, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:08.239368 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2644175:2644214, ack 212620, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:08.441654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2644214, win 4344, length 0 15:02:09.775499 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212620:212700, ack 2644214, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.776559 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2644214:2644318, ack 212700, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:09.778314 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212700:212780, ack 2644318, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.779182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2644318:2644406, ack 212780, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.780807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212780:212870, ack 2644406, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.781681 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2644406:2644545, ack 212870, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.783348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212870:212960, ack 2644545, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.791803 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2644545:2648925, ack 212960, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.792048 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2648925:2648953, ack 212960, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:09.794749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2647465, win 4380, length 0 15:02:09.796640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2648953, win 4380, length 0 15:02:09.798564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 212960:213050, ack 2648953, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.799428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2648953:2649092, ack 213050, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.801363 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213050:213095, ack 2649092, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.802052 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2649092:2649131, ack 213095, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.803624 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213095:213185, ack 2649131, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.812005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2649131:2653511, ack 213185, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.812251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653511:2653539, ack 213185, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:09.814945 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2652051, win 4380, length 0 15:02:09.816818 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2653539, win 4380, length 0 15:02:09.817460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213185:213230, ack 2653539, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.818176 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653539:2653578, ack 213230, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.820581 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213230:213348, ack 2653578, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.820665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653578:2653682, ack 213348, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:09.825373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213348:213436, ack 2653682, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:09.825462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653682:2653821, ack 213436, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.827052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213436:213512, ack 2653821, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.827898 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653821:2653893, ack 213512, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.829509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213512:213588, ack 2653893, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.830328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2653893:2653981, ack 213588, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.832410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213588:213706, ack 2653981, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.837000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2653981:2655441, ack 213706, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.837208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2655441:2656181, ack 213706, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:09.839670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2656181, win 4380, length 0 15:02:09.840080 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213706:213751, ack 2656181, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.840754 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2656181:2656220, ack 213751, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.843070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213751:213851, ack 2656220, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.844011 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2656220:2656359, ack 213851, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.845609 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213851:213927, ack 2656359, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.846446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2656359:2656431, ack 213927, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.848050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 213927:214003, ack 2656431, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.848862 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2656431:2656519, ack 214003, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.850517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214003:214103, ack 2656519, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.852210 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2656519:2657099, ack 214103, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:09.854290 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214103:214148, ack 2657099, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.854990 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657099:2657138, ack 214148, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.857620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214148:214258, ack 2657138, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.857990 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657138:2657242, ack 214258, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:09.859982 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214258:214346, ack 2657242, win 4114, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:09.860073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657242:2657381, ack 214346, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.861634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214346:214422, ack 2657381, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.862512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657381:2657453, ack 214422, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.864084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214422:214498, ack 2657453, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.864920 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657453:2657541, ack 214498, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.866544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214498:214608, ack 2657541, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.868261 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2657541:2658037, ack 214608, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:09.871549 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214608:214653, ack 2658037, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.872245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2658037:2658076, ack 214653, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.874552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214653:214757, ack 2658076, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.875443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2658076:2658215, ack 214757, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.877064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214757:214833, ack 2658215, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.877901 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2658215:2658287, ack 214833, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.879499 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214833:214909, ack 2658287, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.880360 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2658287:2658375, ack 214909, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.881991 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 214909:215013, ack 2658375, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.901604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2658375:2668595, ack 215013, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.904616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2661295, win 4380, length 0 15:02:09.904714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2668595:2672975, ack 215013, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:09.906764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2664215, win 4380, length 0 15:02:09.906838 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2672975:2674435, ack 215013, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:09.906881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2674435:2674775, ack 215013, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:09.908989 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2667135, win 4380, length 0 15:02:09.911887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2670055, win 4380, length 0 15:02:09.913960 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2672975, win 4380, length 0 15:02:09.915186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2674775, win 4380, length 0 15:02:09.915265 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2674775:2674879, ack 215013, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:09.915629 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215013:215054, ack 2674775, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:09.916902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215054:215142, ack 2674879, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:09.916986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2674879:2674918, ack 215142, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:09.918547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215142:215187, ack 2674918, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.919236 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2674918:2674957, ack 215187, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.921545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215187:215297, ack 2674957, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.922438 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2674957:2675096, ack 215297, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.924467 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215297:215373, ack 2675096, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.925327 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2675096:2675168, ack 215373, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.926958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215373:215449, ack 2675168, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.927784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2675168:2675256, ack 215449, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.929455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215449:215559, ack 2675256, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.935673 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2675256:2678176, ack 215559, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.935917 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678176:2678644, ack 215559, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:09.938633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2678176, win 4380, length 0 15:02:09.940075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215559:215604, ack 2678644, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.940737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678644:2678683, ack 215604, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.943065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215604:215706, ack 2678683, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.943991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678683:2678822, ack 215706, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.945592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215706:215782, ack 2678822, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.946437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678822:2678894, ack 215782, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.948045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215782:215858, ack 2678894, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.948852 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678894:2678982, ack 215858, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.950506 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215858:215960, ack 2678982, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.950868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2678982:2679086, ack 215960, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:09.952472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 215960:216048, ack 2679086, win 4152, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:09.956609 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2679086:2682006, ack 216048, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.956838 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682006:2682098, ack 216048, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:09.959954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2682006, win 4380, length 0 15:02:09.960397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216048:216093, ack 2682098, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.961052 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682098:2682137, ack 216093, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.963333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216093:216189, ack 2682137, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.964328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682137:2682276, ack 216189, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.965924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216189:216265, ack 2682276, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.966781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682276:2682348, ack 216265, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.968384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216265:216341, ack 2682348, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.969238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682348:2682436, ack 216341, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.970897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216341:216437, ack 2682436, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.973357 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2682436:2683724, ack 216437, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:09.975562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216437:216482, ack 2683724, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.976277 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2683724:2683763, ack 216482, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.978570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216482:216590, ack 2683763, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.979450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2683763:2683902, ack 216590, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.981056 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216590:216666, ack 2683902, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.981893 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2683902:2683974, ack 216666, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:09.983464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216666:216742, ack 2683974, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.984328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2683974:2684062, ack 216742, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:09.985983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216742:216850, ack 2684062, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.989000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2684062:2685522, ack 216850, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:09.989203 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685522:2685530, ack 216850, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:09.991657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2685530, win 4380, length 0 15:02:09.991742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685530:2685634, ack 216850, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:09.992117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216850:216895, ack 2685530, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:09.993396 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216895:216983, ack 2685634, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:09.993478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685634:2685673, ack 216983, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:09.995755 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 216983:217101, ack 2685673, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:09.996643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685673:2685812, ack 217101, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:09.998233 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217101:217177, ack 2685812, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:09.999069 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685812:2685884, ack 217177, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.000669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217177:217253, ack 2685884, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.001480 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2685884:2685972, ack 217253, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.003142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217253:217371, ack 2685972, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.010018 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2685972:2687432, ack 217371, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.010240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2687432:2688740, ack 217371, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:10.014543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2688740, win 4380, length 0 15:02:10.014910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217371:217416, ack 2688740, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.015590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2688740:2688779, ack 217416, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.017974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217416:217518, ack 2688779, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.018868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2688779:2688918, ack 217518, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.020599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217518:217594, ack 2688918, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.021453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2688918:2688990, ack 217594, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.023168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217594:217670, ack 2688990, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.024080 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2688990:2689078, ack 217670, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.025866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217670:217772, ack 2689078, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.039569 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2689078:2696378, ack 217772, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.039841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696378:2696566, ack 217772, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:10.043241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2691998, win 4380, length 0 15:02:10.046165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2694918, win 4380, length 0 15:02:10.047381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2696566, win 4380, length 0 15:02:10.047446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696566:2696670, ack 217772, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:10.047914 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217772:217817, ack 2696566, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.049223 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217817:217905, ack 2696670, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:10.049306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696670:2696709, ack 217905, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.051626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 217905:218007, ack 2696709, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.052513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696709:2696848, ack 218007, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.054109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218007:218083, ack 2696848, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.054961 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696848:2696920, ack 218083, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.056536 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218083:218159, ack 2696920, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.057350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2696920:2697008, ack 218159, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.058997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218159:218261, ack 2697008, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.060999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2697008:2697728, ack 218261, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:10.070069 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218261:218306, ack 2697728, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.070790 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2697728:2697767, ack 218306, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.073147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218306:218432, ack 2697767, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.074080 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2697767:2697906, ack 218432, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.076206 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218432:218508, ack 2697906, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.077060 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2697906:2697978, ack 218508, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.078660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218508:218584, ack 2697978, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.079489 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2697978:2698066, ack 218584, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.081187 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218584:218710, ack 2698066, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.108488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2698066:2712666, ack 218710, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.112014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2700986, win 4380, length 0 15:02:10.114101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2703906, win 4380, length 0 15:02:10.114191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2712666:2714126, ack 218710, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:10.114237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2714126:2714474, ack 218710, win 3247, length 348SMB-over-TCP packet:(raw data or continuation?) 15:02:10.116283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2706826, win 4380, length 0 15:02:10.120246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2709746, win 4380, length 0 15:02:10.123903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2712666, win 4380, length 0 15:02:10.125137 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2714474, win 4380, length 0 15:02:10.125534 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218710:218798, ack 2714474, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:10.126044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218798:218958, ack 2714474, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.126557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 218958, win 3247, length 0 15:02:10.152831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2714474:2730534, ack 218958, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.153181 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2730534:2730894, ack 218958, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:10.155854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2717394, win 4380, length 0 15:02:10.158033 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2720314, win 4380, length 0 15:02:10.161200 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2723234, win 4380, length 0 15:02:10.165162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2726154, win 4380, length 0 15:02:10.167323 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2729074, win 4380, length 0 15:02:10.169431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2730894, win 4380, length 0 15:02:10.170016 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 218958:219074, ack 2730894, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.195539 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2730894:2746954, ack 219074, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.195900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2746954:2747238, ack 219074, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:10.198662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2733814, win 4380, length 0 15:02:10.202386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2736734, win 4380, length 0 15:02:10.207291 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2739654, win 4380, length 0 15:02:10.207713 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2742574, win 4380, length 0 15:02:10.213248 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2745494, win 4380, length 0 15:02:10.214431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2747238, win 4380, length 0 15:02:10.215204 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219074:219115, ack 2747238, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:10.216083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747238:2747277, ack 219115, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:10.217637 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219115:219160, ack 2747277, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.218337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747277:2747316, ack 219160, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.220849 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219160:219288, ack 2747316, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.220932 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747316:2747420, ack 219288, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:10.222597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219288:219376, ack 2747420, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:10.222683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747420:2747559, ack 219376, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.224262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219376:219452, ack 2747559, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.225120 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747559:2747631, ack 219452, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.226694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219452:219528, ack 2747631, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.227552 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2747631:2747719, ack 219528, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.229211 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219528:219656, ack 2747719, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.235717 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2747719:2750639, ack 219656, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.235950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2750639:2751139, ack 219656, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:10.239684 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2750639, win 4380, length 0 15:02:10.241776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219656:219701, ack 2751139, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.242434 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2751139:2751178, ack 219701, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.244810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219701:219809, ack 2751178, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.245698 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2751178:2751317, ack 219809, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.247926 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219809:219885, ack 2751317, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.248808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2751317:2751389, ack 219885, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.250409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219885:219961, ack 2751389, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.251230 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2751389:2751477, ack 219961, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.252893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 219961:220069, ack 2751477, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.256670 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2751477:2752937, ack 220069, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:10.256876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2752937:2753373, ack 220069, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:10.259441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2753373, win 4380, length 0 15:02:10.259839 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220069:220114, ack 2753373, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.260500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753373:2753412, ack 220114, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.262908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220114:220240, ack 2753412, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.262988 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753412:2753516, ack 220240, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:10.265157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220240:220328, ack 2753516, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:10.265244 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753516:2753655, ack 220328, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.266855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220328:220404, ack 2753655, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.267728 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753655:2753727, ack 220404, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.269347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220404:220480, ack 2753727, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.270172 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753727:2753815, ack 220480, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.271817 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220480:220606, ack 2753815, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.273957 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2753815:2754515, ack 220606, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:10.281954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220606:220651, ack 2754515, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.282643 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2754515:2754554, ack 220651, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.285075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220651:220785, ack 2754554, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.285964 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2754554:2754693, ack 220785, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.287544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220785:220861, ack 2754693, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.288379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2754693:2754765, ack 220861, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.289986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220861:220937, ack 2754765, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.290798 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2754765:2754853, ack 220937, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.292445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 220937:221071, ack 2754853, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.293762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2754853:2755121, ack 221071, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:10.296026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221071:221116, ack 2755121, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.296713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755121:2755160, ack 221116, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.299143 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221116:221250, ack 2755160, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:10.300014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755160:2755299, ack 221250, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:10.301610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221250:221326, ack 2755299, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.302438 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755299:2755371, ack 221326, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:10.304039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221326:221402, ack 2755371, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.304121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755371:2755475, ack 221402, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:10.305725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221402:221490, ack 2755475, win 4224, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:10.305808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755475:2755563, ack 221490, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:10.307485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221490:221624, ack 2755563, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:10.309953 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2755563:2756503, ack 221624, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:10.312707 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221624:221669, ack 2756503, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:10.313400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2756503:2756542, ack 221669, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:10.516346 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2756542, win 4370, length 0 15:02:11.835868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221669:221759, ack 2756542, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:11.837002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2756542:2756681, ack 221759, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:11.838843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221759:221839, ack 2756681, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:11.839733 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2756681:2756785, ack 221839, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:11.841289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221839:221919, ack 2756785, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:11.842125 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2756785:2756873, ack 221919, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:11.843706 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 221919:222009, ack 2756873, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:11.852082 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2756873:2761253, ack 222009, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:11.852333 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2761253:2761281, ack 222009, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:11.855969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2759793, win 4380, length 0 15:02:11.857929 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2761281, win 4380, length 0 15:02:11.859829 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222009:222099, ack 2761281, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:11.860689 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2761281:2761420, ack 222099, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:11.862610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222099:222144, ack 2761420, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:11.863299 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2761420:2761459, ack 222144, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:11.864870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222144:222234, ack 2761459, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:11.873211 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2761459:2765839, ack 222234, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:11.873573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2765839:2765867, ack 222234, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:11.877160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2764379, win 4380, length 0 15:02:11.880347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2765867, win 4380, length 0 15:02:11.880417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2765867:2765971, ack 222234, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:11.880845 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222234:222279, ack 2765867, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:11.913711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 222279, win 3247, length 0 15:02:12.076338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2765971, win 4354, length 0 15:02:12.076432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2765971:2766010, ack 222279, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.094318 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222279:222367, ack 2766010, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.094568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 222367, win 3247, length 0 15:02:12.096592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222367:222485, ack 2766010, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.096838 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 222485, win 3247, length 0 15:02:12.097672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2766010:2766149, ack 222485, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.100856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222485:222561, ack 2766149, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.101713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2766149:2766221, ack 222561, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.103597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222561:222637, ack 2766221, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.104505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2766221:2766309, ack 222637, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.106948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222637:222755, ack 2766309, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.111447 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2766309:2767769, ack 222755, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.111654 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2767769:2768509, ack 222755, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:12.114182 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2768509, win 4380, length 0 15:02:12.114619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222755:222800, ack 2768509, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.115288 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768509:2768548, ack 222800, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.117682 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222800:222900, ack 2768548, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.118548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768548:2768687, ack 222900, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.120987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222900:222976, ack 2768687, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.121816 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768687:2768759, ack 222976, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.124535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 222976:223052, ack 2768759, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.124640 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768759:2768863, ack 223052, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.126276 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223052:223140, ack 2768863, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.126369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768863:2768951, ack 223140, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.128047 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223140:223240, ack 2768951, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.129801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2768951:2769531, ack 223240, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:12.132350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223240:223285, ack 2769531, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.133049 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2769531:2769570, ack 223285, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.135393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223285:223395, ack 2769570, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.136291 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2769570:2769709, ack 223395, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.137881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223395:223471, ack 2769709, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.138719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2769709:2769781, ack 223471, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.140359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223471:223547, ack 2769781, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.141184 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2769781:2769869, ack 223547, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.142843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223547:223657, ack 2769869, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.144594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2769869:2770365, ack 223657, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:12.146410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223657:223702, ack 2770365, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.147112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2770365:2770404, ack 223702, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.149502 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223702:223806, ack 2770404, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.150374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2770404:2770543, ack 223806, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.151970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223806:223882, ack 2770543, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.152811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2770543:2770615, ack 223882, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.154491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223882:223958, ack 2770615, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.155331 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2770615:2770703, ack 223958, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.156972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 223958:224062, ack 2770703, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.176637 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2770703:2780923, ack 224062, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.179633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2773623, win 4380, length 0 15:02:12.179736 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2780923:2785303, ack 224062, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:12.182742 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2776543, win 4380, length 0 15:02:12.182816 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2785303:2786763, ack 224062, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:12.182858 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2786763:2787207, ack 224062, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:02:12.184943 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2779463, win 4380, length 0 15:02:12.187663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2782383, win 4380, length 0 15:02:12.191931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2785303, win 4380, length 0 15:02:12.192404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2787207, win 4380, length 0 15:02:12.192896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224062:224103, ack 2787207, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:12.193415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224103:224191, ack 2787207, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.193967 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2787207:2787246, ack 224191, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:12.196605 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224191:224236, ack 2787246, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.197324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2787246:2787285, ack 224236, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.200116 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224236:224346, ack 2787285, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.201010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2787285:2787424, ack 224346, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.202688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224346:224422, ack 2787424, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.203530 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2787424:2787496, ack 224422, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.205113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224422:224498, ack 2787496, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.205943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2787496:2787584, ack 224498, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.207581 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224498:224608, ack 2787584, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.213794 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2787584:2790504, ack 224608, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.214022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2790504:2790972, ack 224608, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:12.216731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2790504, win 4380, length 0 15:02:12.218189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224608:224653, ack 2790972, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.218874 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2790972:2791011, ack 224653, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.221277 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224653:224755, ack 2791011, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.221657 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2791011:2791115, ack 224755, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.223330 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224755:224843, ack 2791115, win 4227, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.223417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2791115:2791254, ack 224843, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.226582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224843:224919, ack 2791254, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.227424 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2791254:2791326, ack 224919, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.229040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224919:224995, ack 2791326, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.229850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2791326:2791414, ack 224995, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.231484 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 224995:225097, ack 2791414, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.236941 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2791414:2794334, ack 225097, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.237173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794334:2794426, ack 225097, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:12.240837 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2794334, win 4380, length 0 15:02:12.251752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225097:225142, ack 2794426, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.252444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794426:2794465, ack 225142, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.255663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225142:225238, ack 2794465, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.256553 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794465:2794604, ack 225238, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.258485 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225238:225314, ack 2794604, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.259324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794604:2794676, ack 225314, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.261129 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225314:225390, ack 2794676, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.261939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794676:2794764, ack 225390, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.263698 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225390:225486, ack 2794764, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.266195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2794764:2796052, ack 225486, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:12.268408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225486:225531, ack 2796052, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.269106 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2796052:2796091, ack 225531, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.271511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225531:225639, ack 2796091, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.272378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2796091:2796230, ack 225639, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.273961 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225639:225715, ack 2796230, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.274342 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2796230:2796334, ack 225715, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.275965 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225715:225803, ack 2796334, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.276047 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2796334:2796406, ack 225803, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.277674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225803:225879, ack 2796406, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.278504 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2796406:2796494, ack 225879, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.280198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225879:225987, ack 2796494, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.283176 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2796494:2797954, ack 225987, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.283379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2797954:2797962, ack 225987, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:12.286691 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2797962, win 4380, length 0 15:02:12.287098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 225987:226032, ack 2797962, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.287781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2797962:2798001, ack 226032, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.290157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226032:226150, ack 2798001, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.291064 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2798001:2798140, ack 226150, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.292655 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226150:226226, ack 2798140, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.293490 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2798140:2798212, ack 226226, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.295084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226226:226302, ack 2798212, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.295912 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2798212:2798300, ack 226302, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.297548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226302:226420, ack 2798300, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.302998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2798300:2799760, ack 226420, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.303205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2799760:2801068, ack 226420, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:12.307179 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2801068, win 4380, length 0 15:02:12.307644 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226420:226465, ack 2801068, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.308302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2801068:2801107, ack 226465, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.310709 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226465:226567, ack 2801107, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.311581 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2801107:2801246, ack 226567, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.313172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226567:226643, ack 2801246, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.313555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2801246:2801350, ack 226643, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.315180 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226643:226731, ack 2801350, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.315267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2801350:2801422, ack 226731, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.316871 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226731:226807, ack 2801422, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.317703 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2801422:2801510, ack 226807, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.319355 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226807:226909, ack 2801510, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.332989 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2801510:2808810, ack 226909, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.333262 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2808810:2808998, ack 226909, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:12.339365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2804430, win 4380, length 0 15:02:12.340663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2807350, win 4380, length 0 15:02:12.343404 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2808998, win 4380, length 0 15:02:12.343821 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226909:226954, ack 2808998, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.344497 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2808998:2809037, ack 226954, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.347510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 226954:227056, ack 2809037, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.348410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2809037:2809176, ack 227056, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.350037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227056:227132, ack 2809176, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.351037 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2809176:2809248, ack 227132, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.352623 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227132:227208, ack 2809248, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.353432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2809248:2809336, ack 227208, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.355065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227208:227310, ack 2809336, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.357034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2809336:2810056, ack 227310, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:12.365089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227310:227355, ack 2810056, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.365814 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2810056:2810095, ack 227355, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.368179 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227355:227481, ack 2810095, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.369055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2810095:2810234, ack 227481, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.370669 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227481:227557, ack 2810234, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.371042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2810234:2810338, ack 227557, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.372752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227557:227645, ack 2810338, win 4045, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.372834 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2810338:2810410, ack 227645, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.374451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227645:227721, ack 2810410, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.375287 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2810410:2810498, ack 227721, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.376934 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227721:227847, ack 2810498, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.403462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2810498:2825098, ack 227847, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.407553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2813418, win 4380, length 0 15:02:12.409680 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2816338, win 4380, length 0 15:02:12.409754 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2825098:2826558, ack 227847, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:12.409798 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2826558:2826802, ack 227847, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:12.414570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2819258, win 4380, length 0 15:02:12.415970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2822178, win 4380, length 0 15:02:12.419080 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2825098, win 4380, length 0 15:02:12.421672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2826802, win 4380, length 0 15:02:12.422284 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 227847:228007, ack 2826802, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.448525 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2826802:2842862, ack 228007, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.448873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2842862:2843222, ack 228007, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:12.452993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2829722, win 4380, length 0 15:02:12.454406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2832642, win 4380, length 0 15:02:12.457401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2835562, win 4380, length 0 15:02:12.459602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2838482, win 4380, length 0 15:02:12.461721 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2841402, win 4380, length 0 15:02:12.463611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2843222, win 4380, length 0 15:02:12.464191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228007:228123, ack 2843222, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.489666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2843222:2859282, ack 228123, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.490008 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859282:2859566, ack 228123, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:12.505176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2846142, win 4380, length 0 15:02:12.505540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2849062, win 4380, length 0 15:02:12.505937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2851982, win 4380, length 0 15:02:12.506426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2854902, win 4380, length 0 15:02:12.506875 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2857822, win 4380, length 0 15:02:12.507376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2859566, win 4380, length 0 15:02:12.507444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859566:2859670, ack 228123, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.507909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228123:228164, ack 2859566, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:12.509207 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228164:228252, ack 2859670, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.509293 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859670:2859709, ack 228252, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:12.510874 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228252:228297, ack 2859709, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.511560 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859709:2859748, ack 228297, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.514086 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228297:228425, ack 2859748, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.515049 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859748:2859887, ack 228425, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.516635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228425:228501, ack 2859887, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.517483 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859887:2859959, ack 228501, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.519100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228501:228577, ack 2859959, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.519921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2859959:2860047, ack 228577, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.521565 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228577:228705, ack 2860047, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.528109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2860047:2862967, ack 228705, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.528347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2862967:2863467, ack 228705, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:12.531928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2862967, win 4380, length 0 15:02:12.535027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228705:228750, ack 2863467, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.535704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2863467:2863506, ack 228750, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.538117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228750:228858, ack 2863506, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.538993 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2863506:2863645, ack 228858, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.540608 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228858:228934, ack 2863645, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.541440 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2863645:2863717, ack 228934, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.543045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 228934:229010, ack 2863717, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.543909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2863717:2863805, ack 229010, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.545555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229010:229118, ack 2863805, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.545634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2863805:2863909, ack 229118, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.547241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229118:229206, ack 2863909, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.549670 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2863909:2865369, ack 229206, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:12.549863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2865369:2865805, ack 229206, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:12.552373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2865805, win 4380, length 0 15:02:12.552724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229206:229251, ack 2865805, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.553362 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2865805:2865844, ack 229251, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.555720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229251:229377, ack 2865844, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.556611 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2865844:2865983, ack 229377, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.558188 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229377:229453, ack 2865983, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.559030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2865983:2866055, ack 229453, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.560636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229453:229529, ack 2866055, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.561462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2866055:2866143, ack 229529, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.563440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229529:229655, ack 2866143, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.565507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2866143:2866843, ack 229655, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:12.573700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229655:229700, ack 2866843, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.574403 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2866843:2866882, ack 229700, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.576821 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229700:229834, ack 2866882, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.577700 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2866882:2867021, ack 229834, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.579305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229834:229910, ack 2867021, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.580187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867021:2867093, ack 229910, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.581764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229910:229986, ack 2867093, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.582595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867093:2867181, ack 229986, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.584233 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 229986:230120, ack 2867181, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.584627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867181:2867285, ack 230120, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:12.586244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230120:230208, ack 2867285, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:12.586334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867285:2867553, ack 230208, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:12.588065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230208:230253, ack 2867553, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.588729 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867553:2867592, ack 230253, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.591181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230253:230387, ack 2867592, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:12.592051 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867592:2867731, ack 230387, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:12.593635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230387:230463, ack 2867731, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.594520 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867731:2867803, ack 230463, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:12.599522 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230463:230539, ack 2867803, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.600340 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867803:2867891, ack 230539, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:12.601986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230539:230673, ack 2867891, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:12.604537 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2867891:2868831, ack 230673, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:12.606571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230673:230718, ack 2868831, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:12.607259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2868831:2868870, ack 230718, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:12.809503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2868870, win 4370, length 0 15:02:14.112807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230718:230808, ack 2868870, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.113923 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2868870:2869009, ack 230808, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.115748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230808:230888, ack 2869009, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.116646 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2869009:2869113, ack 230888, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:14.118195 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230888:230968, ack 2869113, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.119036 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2869113:2869201, ack 230968, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.120689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 230968:231058, ack 2869201, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.129150 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2869201:2873581, ack 231058, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.129395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2873581:2873609, ack 231058, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:14.133980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2872121, win 4380, length 0 15:02:14.135845 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2873609, win 4380, length 0 15:02:14.135931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2873609:2873713, ack 231058, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.137906 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231058:231148, ack 2873713, win 4354, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.138793 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2873713:2873852, ack 231148, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.140573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231148:231236, ack 2873852, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.173711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 231236, win 3247, length 0 15:02:14.175623 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231236:231326, ack 2873852, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.175691 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 231326, win 3247, length 0 15:02:14.184116 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2873852:2878232, ack 231326, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.184354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878232:2878260, ack 231326, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:14.187089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2876772, win 4380, length 0 15:02:14.189077 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2878260, win 4380, length 0 15:02:14.189510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231326:231371, ack 2878260, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.190220 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878260:2878299, ack 231371, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.191944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231371:231416, ack 2878299, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.192619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878299:2878338, ack 231416, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.194911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231416:231534, ack 2878338, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.196110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878338:2878477, ack 231534, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.197816 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231534:231610, ack 2878477, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.198690 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878477:2878549, ack 231610, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.200454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231610:231686, ack 2878549, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.201279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2878549:2878637, ack 231686, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.203125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231686:231804, ack 2878637, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.207986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2878637:2880097, ack 231804, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.208204 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2880097:2880837, ack 231804, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:14.211767 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2880837, win 4380, length 0 15:02:14.212189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231804:231849, ack 2880837, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.212554 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2880837:2880941, ack 231849, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.214192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231849:231937, ack 2880941, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.214280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2880941:2880980, ack 231937, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.216586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 231937:232037, ack 2880980, win 4344, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.217485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2880980:2881119, ack 232037, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.219105 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232037:232113, ack 2881119, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.219952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2881119:2881191, ack 232113, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.221554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232113:232189, ack 2881191, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.222377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2881191:2881279, ack 232189, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.224012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232189:232289, ack 2881279, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.225746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2881279:2881859, ack 232289, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:14.227599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232289:232334, ack 2881859, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.228284 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2881859:2881898, ack 232334, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.230593 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232334:232444, ack 2881898, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.231463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2881898:2882037, ack 232444, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.233062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232444:232520, ack 2882037, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.233951 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882037:2882109, ack 232520, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.235521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232520:232596, ack 2882109, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.236378 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882109:2882197, ack 232596, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.238007 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232596:232706, ack 2882197, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.239557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882197:2882693, ack 232706, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:14.241395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232706:232751, ack 2882693, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.242086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882693:2882732, ack 232751, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.244341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232751:232855, ack 2882732, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.245226 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882732:2882871, ack 232855, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.246822 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232855:232931, ack 2882871, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.247194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882871:2882975, ack 232931, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.249331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 232931:233019, ack 2882975, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.249413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2882975:2883047, ack 233019, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.251028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233019:233095, ack 2883047, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.251851 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2883047:2883135, ack 233095, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.253512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233095:233199, ack 2883135, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.274787 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2883135:2893355, ack 233199, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.278649 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2886055, win 4380, length 0 15:02:14.278747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2893355:2897735, ack 233199, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:14.280808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2888975, win 4380, length 0 15:02:14.280879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2897735:2899195, ack 233199, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:14.280921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899195:2899535, ack 233199, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:14.282970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2891895, win 4380, length 0 15:02:14.285211 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2894815, win 4380, length 0 15:02:14.287320 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2897735, win 4380, length 0 15:02:14.289278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2899535, win 4380, length 0 15:02:14.289736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233199:233240, ack 2899535, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:14.290601 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899535:2899574, ack 233240, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:14.292164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233240:233285, ack 2899574, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.292905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899574:2899613, ack 233285, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.295231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233285:233395, ack 2899613, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.296144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899613:2899752, ack 233395, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.297737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233395:233471, ack 2899752, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.298581 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899752:2899824, ack 233471, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.300184 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233471:233547, ack 2899824, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.301002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2899824:2899912, ack 233547, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.302640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233547:233657, ack 2899912, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.308865 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2899912:2902832, ack 233657, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.309201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2902832:2903300, ack 233657, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:14.314249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2902832, win 4380, length 0 15:02:14.314638 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233657:233702, ack 2903300, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.314712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2903300:2903404, ack 233702, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.316332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233702:233790, ack 2903404, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.316413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2903404:2903443, ack 233790, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.318718 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233790:233892, ack 2903443, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.319640 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2903443:2903582, ack 233892, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.321248 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233892:233968, ack 2903582, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.322092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2903582:2903654, ack 233968, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.323703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 233968:234044, ack 2903654, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.324545 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2903654:2903742, ack 234044, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.326176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234044:234146, ack 2903742, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.331580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2903742:2906662, ack 234146, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.331810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2906662:2906754, ack 234146, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:14.334512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2906662, win 4380, length 0 15:02:14.335841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234146:234191, ack 2906754, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.336516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2906754:2906793, ack 234191, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.338870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234191:234287, ack 2906793, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.339786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2906793:2906932, ack 234287, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.341392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234287:234363, ack 2906932, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.342245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2906932:2907004, ack 234363, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.343872 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234363:234439, ack 2907004, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.344704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2907004:2907092, ack 234439, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.346336 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234439:234535, ack 2907092, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.346704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2907092:2907196, ack 234535, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.348313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234535:234623, ack 2907196, win 4246, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.349465 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2907196:2908484, ack 234623, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:14.351701 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234623:234668, ack 2908484, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.352377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2908484:2908523, ack 234668, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.354704 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234668:234776, ack 2908523, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.355589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2908523:2908662, ack 234776, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.357186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234776:234852, ack 2908662, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.358019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2908662:2908734, ack 234852, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.359611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234852:234928, ack 2908734, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.360427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2908734:2908822, ack 234928, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.362067 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 234928:235036, ack 2908822, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.365155 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2908822:2910282, ack 235036, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.365357 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2910282:2910290, ack 235036, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:14.368654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2910290, win 4380, length 0 15:02:14.369053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235036:235081, ack 2910290, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.369725 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2910290:2910329, ack 235081, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.372026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235081:235199, ack 2910329, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.372910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2910329:2910468, ack 235199, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.374603 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235199:235275, ack 2910468, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.375458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2910468:2910540, ack 235275, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.377386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235275:235351, ack 2910540, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.378208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2910540:2910628, ack 235351, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.379866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235351:235469, ack 2910628, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.385381 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2910628:2912088, ack 235469, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.385586 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2912088:2913396, ack 235469, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:14.389145 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2913396, win 4380, length 0 15:02:14.389234 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2913396:2913500, ack 235469, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.389617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235469:235514, ack 2913396, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.390913 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235514:235602, ack 2913500, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.390998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2913500:2913539, ack 235602, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.393305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235602:235704, ack 2913539, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.394236 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2913539:2913678, ack 235704, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.395836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235704:235780, ack 2913678, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.396680 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2913678:2913750, ack 235780, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.398255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235780:235856, ack 2913750, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.399067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2913750:2913838, ack 235856, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.401131 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235856:235958, ack 2913838, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.414847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2913838:2921138, ack 235958, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.415112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921138:2921326, ack 235958, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:14.417882 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2916758, win 4380, length 0 15:02:14.420050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2919678, win 4380, length 0 15:02:14.421955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2921326, win 4380, length 0 15:02:14.435402 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 235958:236003, ack 2921326, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.436093 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921326:2921365, ack 236003, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.438526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236003:236105, ack 2921365, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.439472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921365:2921504, ack 236105, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.441213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236105:236181, ack 2921504, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.442059 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921504:2921576, ack 236181, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.443820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236181:236257, ack 2921576, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.444662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921576:2921664, ack 236257, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.446503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236257:236359, ack 2921664, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.446871 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921664:2921768, ack 236359, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.448930 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236359:236447, ack 2921768, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.449021 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2921768:2922488, ack 236447, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:14.451253 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236447:236492, ack 2922488, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.451928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2922488:2922527, ack 236492, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.454688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236492:236618, ack 2922527, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.455581 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2922527:2922666, ack 236618, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.457262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236618:236694, ack 2922666, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.458095 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2922666:2922738, ack 236694, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.459847 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236694:236770, ack 2922738, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.460660 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2922738:2922826, ack 236770, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.462345 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236770:236896, ack 2922826, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.488652 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2922826:2937426, ack 236896, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.491726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2925746, win 4380, length 0 15:02:14.497827 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2928666, win 4380, length 0 15:02:14.497906 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2937426:2938886, ack 236896, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:14.497949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2938886:2939130, ack 236896, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:14.498548 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2931586, win 4380, length 0 15:02:14.498876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2934506, win 4380, length 0 15:02:14.500897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2937426, win 4380, length 0 15:02:14.502902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2939130, win 4380, length 0 15:02:14.503478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 236896:237056, ack 2939130, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.529704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2939130:2955190, ack 237056, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.530042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2955190:2955550, ack 237056, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:14.532754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2942050, win 4380, length 0 15:02:14.534852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2944970, win 4380, length 0 15:02:14.537906 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2947890, win 4380, length 0 15:02:14.541011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2950810, win 4380, length 0 15:02:14.543061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2953730, win 4380, length 0 15:02:14.544935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2955550, win 4380, length 0 15:02:14.545014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2955550:2955654, ack 237056, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.545508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237056:237172, ack 2955550, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.546747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237172:237260, ack 2955654, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.571309 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2955654:2971714, ack 237260, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.571645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2971714:2971998, ack 237260, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:14.575984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2958574, win 4380, length 0 15:02:14.577357 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2961494, win 4380, length 0 15:02:14.582708 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2964414, win 4380, length 0 15:02:14.584118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2967334, win 4380, length 0 15:02:14.586141 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2970254, win 4380, length 0 15:02:14.588116 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2971998, win 4380, length 0 15:02:14.588667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237260:237301, ack 2971998, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:14.589557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2971998:2972037, ack 237301, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:14.591117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237301:237346, ack 2972037, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.591803 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2972037:2972076, ack 237346, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.594181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237346:237474, ack 2972076, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.595109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2972076:2972215, ack 237474, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.596701 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237474:237550, ack 2972215, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.597544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2972215:2972287, ack 237550, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.599161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237550:237626, ack 2972287, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.599984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2972287:2972375, ack 237626, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.601624 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237626:237754, ack 2972375, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.608160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2972375:2975295, ack 237754, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.608393 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2975295:2975795, ack 237754, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:14.611062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2975295, win 4380, length 0 15:02:14.612524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237754:237799, ack 2975795, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.613289 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2975795:2975834, ack 237799, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.615586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237799:237907, ack 2975834, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.615674 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2975834:2975938, ack 237907, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.617326 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237907:237995, ack 2975938, win 4219, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.617414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2975938:2976077, ack 237995, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.618982 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 237995:238071, ack 2976077, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.619827 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2976077:2976149, ack 238071, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.621452 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238071:238147, ack 2976149, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.622273 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2976149:2976237, ack 238147, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.623895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238147:238255, ack 2976237, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.627712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2976237:2977697, ack 238255, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:14.627922 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2977697:2978133, ack 238255, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:14.630341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2978133, win 4380, length 0 15:02:14.630774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238255:238300, ack 2978133, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.631452 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2978133:2978172, ack 238300, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.633781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238300:238426, ack 2978172, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.634672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2978172:2978311, ack 238426, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.636273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238426:238502, ack 2978311, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.637110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2978311:2978383, ack 238502, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.638733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238502:238578, ack 2978383, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.639544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2978383:2978471, ack 238578, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.641196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238578:238704, ack 2978471, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.643200 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2978471:2979171, ack 238704, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:14.645358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238704:238749, ack 2979171, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.646053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979171:2979210, ack 238749, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.648430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238749:238883, ack 2979210, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.648808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979210:2979314, ack 238883, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:14.653067 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238883:238971, ack 2979314, win 4084, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:14.653154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979314:2979453, ack 238971, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.654747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 238971:239047, ack 2979453, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.655597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979453:2979525, ack 239047, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.657188 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239047:239123, ack 2979525, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.658010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979525:2979613, ack 239123, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.659698 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239123:239257, ack 2979613, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.660953 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979613:2979881, ack 239257, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:14.662652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239257:239302, ack 2979881, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.663334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979881:2979920, ack 239302, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.665697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239302:239436, ack 2979920, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:14.666592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2979920:2980059, ack 239436, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:14.668178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239436:239512, ack 2980059, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.669017 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2980059:2980131, ack 239512, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:14.670638 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239512:239588, ack 2980131, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.671505 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2980131:2980219, ack 239588, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:14.673148 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239588:239722, ack 2980219, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:14.675665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2980219:2981159, ack 239722, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:14.677674 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239722:239767, ack 2981159, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:14.678363 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2981159:2981198, ack 239767, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:14.868676 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2981198, win 4370, length 0 15:02:16.171479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239767:239847, ack 2981198, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.172525 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2981198:2981302, ack 239847, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:16.174246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239847:239927, ack 2981302, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.175121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2981302:2981390, ack 239927, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.176729 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 239927:240017, ack 2981390, win 4322, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.177170 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2981390:2981494, ack 240017, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.366279 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2981494, win 4296, length 0 15:02:16.366380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2981494:2981633, ack 240017, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.368085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240017:240105, ack 2981633, win 4261, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.403713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 240105, win 3247, length 0 15:02:16.405289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240105:240195, ack 2981633, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.405351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 240195, win 3247, length 0 15:02:16.413761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2981633:2986013, ack 240195, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.414014 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2986013:2986041, ack 240195, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:16.416705 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2984553, win 4380, length 0 15:02:16.418640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2986041, win 4380, length 0 15:02:16.421128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240195:240285, ack 2986041, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.422000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2986041:2986180, ack 240285, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.425116 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240285:240330, ack 2986180, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.425826 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2986180:2986219, ack 240330, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.427397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240330:240420, ack 2986219, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.435810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2986219:2990599, ack 240420, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.436055 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990599:2990627, ack 240420, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:16.438783 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2989139, win 4380, length 0 15:02:16.440585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2990627, win 4380, length 0 15:02:16.441193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240420:240465, ack 2990627, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.441856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990627:2990666, ack 240465, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.444217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240465:240583, ack 2990666, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.445160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990666:2990805, ack 240583, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.446854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240583:240659, ack 2990805, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.447698 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990805:2990877, ack 240659, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.449457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240659:240735, ack 2990877, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.449827 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990877:2990981, ack 240735, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.451488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240735:240823, ack 2990981, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.451571 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2990981:2991069, ack 240823, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.453259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240823:240941, ack 2991069, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.457782 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2991069:2992529, ack 240941, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.457994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2992529:2993269, ack 240941, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:16.460569 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2993269, win 4380, length 0 15:02:16.460933 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240941:240986, ack 2993269, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.461597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2993269:2993308, ack 240986, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.463910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 240986:241086, ack 2993308, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.464799 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2993308:2993447, ack 241086, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.466743 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241086:241162, ack 2993447, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.467587 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2993447:2993519, ack 241162, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.469519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241162:241238, ack 2993519, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.470373 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2993519:2993607, ack 241238, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.472010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241238:241338, ack 2993607, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.473828 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2993607:2994187, ack 241338, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:16.475681 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241338:241383, ack 2994187, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.476383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994187:2994226, ack 241383, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.478681 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241383:241493, ack 2994226, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.479547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994226:2994365, ack 241493, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.481144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241493:241569, ack 2994365, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.481975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994365:2994437, ack 241569, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.483551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241569:241645, ack 2994437, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.484417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994437:2994525, ack 241645, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.486049 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241645:241755, ack 2994525, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.486425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994525:2994629, ack 241755, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.488590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241755:241843, ack 2994629, win 4040, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.488682 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2994629:2995125, ack 241843, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:16.490537 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241843:241888, ack 2995125, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.491243 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2995125:2995164, ack 241888, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.493564 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241888:241992, ack 2995164, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.494482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2995164:2995303, ack 241992, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.496068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 241992:242068, ack 2995303, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.496904 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2995303:2995375, ack 242068, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.498487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242068:242144, ack 2995375, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.499297 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 2995375:2995463, ack 242144, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.500971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242144:242248, ack 2995463, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.520625 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 2995463:3005683, ack 242248, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.523535 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 2998383, win 4380, length 0 15:02:16.523633 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3005683:3010063, ack 242248, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:16.525808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3001303, win 4380, length 0 15:02:16.525882 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3010063:3011523, ack 242248, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:16.525925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3011523:3011863, ack 242248, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:16.529538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3004223, win 4380, length 0 15:02:16.531732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3007143, win 4380, length 0 15:02:16.533886 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3010063, win 4380, length 0 15:02:16.535960 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3011863, win 4380, length 0 15:02:16.536360 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242248:242289, ack 3011863, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:16.537211 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3011863:3011902, ack 242289, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:16.538932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242289:242334, ack 3011902, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.539631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3011902:3011941, ack 242334, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.542110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242334:242444, ack 3011941, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.542488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3011941:3012045, ack 242444, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.544201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242444:242532, ack 3012045, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.544295 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3012045:3012184, ack 242532, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.545855 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242532:242608, ack 3012184, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.546746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3012184:3012256, ack 242608, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.548347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242608:242684, ack 3012256, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.549169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3012256:3012344, ack 242684, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.550832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242684:242794, ack 3012344, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.557056 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3012344:3015264, ack 242794, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.557289 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3015264:3015732, ack 242794, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:16.559890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3015264, win 4380, length 0 15:02:16.561285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242794:242839, ack 3015732, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.561960 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3015732:3015771, ack 242839, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.564250 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242839:242941, ack 3015771, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.565138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3015771:3015910, ack 242941, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.566762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 242941:243017, ack 3015910, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.567597 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3015910:3015982, ack 243017, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.569273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243017:243093, ack 3015982, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.570090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3015982:3016070, ack 243093, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.571741 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243093:243195, ack 3016070, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.577279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3016070:3018990, ack 243195, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.577513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3018990:3019082, ack 243195, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:16.580212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3018990, win 4380, length 0 15:02:16.581486 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243195:243240, ack 3019082, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.582155 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019082:3019121, ack 243240, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.584444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243240:243336, ack 3019121, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.584837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019121:3019225, ack 243336, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.586557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243336:243424, ack 3019225, win 4321, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.586645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019225:3019364, ack 243424, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.588202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243424:243500, ack 3019364, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.589040 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019364:3019436, ack 243500, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.590660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243500:243576, ack 3019436, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.591470 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019436:3019524, ack 243576, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.593098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243576:243672, ack 3019524, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.595586 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3019524:3020812, ack 243672, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:16.597766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243672:243717, ack 3020812, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.598454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3020812:3020851, ack 243717, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.600852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243717:243825, ack 3020851, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.601756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3020851:3020990, ack 243825, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.603350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243825:243901, ack 3020990, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.604237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3020990:3021062, ack 243901, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.605809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243901:243977, ack 3021062, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.606625 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3021062:3021150, ack 243977, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.609165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 243977:244085, ack 3021150, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.612297 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3021150:3022610, ack 244085, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.612503 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022610:3022618, ack 244085, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:16.614834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3022618, win 4380, length 0 15:02:16.615274 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244085:244130, ack 3022618, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.617028 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022618:3022657, ack 244130, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.619379 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244130:244248, ack 3022657, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.620330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022657:3022796, ack 244248, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.621928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244248:244324, ack 3022796, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.622013 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022796:3022900, ack 244324, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.623616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244324:244412, ack 3022900, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.623730 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022900:3022972, ack 244412, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.625361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244412:244488, ack 3022972, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.626199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3022972:3023060, ack 244488, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.629457 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244488:244606, ack 3023060, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.634985 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3023060:3024520, ack 244606, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.635194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3024520:3025828, ack 244606, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:16.637823 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3025828, win 4380, length 0 15:02:16.638281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244606:244651, ack 3025828, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.638973 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3025828:3025867, ack 244651, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.641293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244651:244753, ack 3025867, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.642175 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3025867:3026006, ack 244753, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.643766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244753:244829, ack 3026006, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.644612 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3026006:3026078, ack 244829, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.646188 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244829:244905, ack 3026078, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.646998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3026078:3026166, ack 244905, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.649052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 244905:245007, ack 3026166, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.662688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3026166:3033466, ack 245007, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.662964 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3033466:3033654, ack 245007, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:16.666426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3029086, win 4380, length 0 15:02:16.669675 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3032006, win 4380, length 0 15:02:16.670930 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3033654, win 4380, length 0 15:02:16.674181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245007:245052, ack 3033654, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.674866 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3033654:3033693, ack 245052, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.677294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245052:245154, ack 3033693, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.677688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3033693:3033797, ack 245154, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.679358 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245154:245242, ack 3033797, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.679446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3033797:3033936, ack 245242, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.681003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245242:245318, ack 3033936, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.681841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3033936:3034008, ack 245318, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.683420 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245318:245394, ack 3034008, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.684290 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3034008:3034096, ack 245394, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.685923 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245394:245496, ack 3034096, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.687888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3034096:3034816, ack 245496, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:16.690825 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245496:245541, ack 3034816, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.691522 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3034816:3034855, ack 245541, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.693883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245541:245667, ack 3034855, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.694779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3034855:3034994, ack 245667, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.696473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245667:245743, ack 3034994, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.697354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3034994:3035066, ack 245743, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.699174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245743:245819, ack 3035066, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.699992 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3035066:3035154, ack 245819, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.701793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245819:245945, ack 3035154, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.728129 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3035154:3049754, ack 245945, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.733518 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3038074, win 4380, length 0 15:02:16.735576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3040994, win 4380, length 0 15:02:16.735656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3049754:3051214, ack 245945, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:16.735699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3051214:3051458, ack 245945, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:16.738686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3043914, win 4380, length 0 15:02:16.740760 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3046834, win 4380, length 0 15:02:16.742805 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3049754, win 4380, length 0 15:02:16.745664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3051458, win 4380, length 0 15:02:16.746038 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3051458:3051562, ack 245945, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.746420 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 245945:246105, ack 3051458, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.747665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246105:246193, ack 3051562, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.772870 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3051562:3067622, ack 246193, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.773224 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3067622:3067982, ack 246193, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:16.775895 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3054482, win 4380, length 0 15:02:16.777965 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3057402, win 4380, length 0 15:02:16.780152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3060322, win 4380, length 0 15:02:16.784899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3063242, win 4380, length 0 15:02:16.787111 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3066162, win 4380, length 0 15:02:16.789570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3067982, win 4380, length 0 15:02:16.790040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246193:246309, ack 3067982, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.815579 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3067982:3084042, ack 246309, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.815931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084042:3084326, ack 246309, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:16.818652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3070902, win 4380, length 0 15:02:16.820843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3073822, win 4380, length 0 15:02:16.823048 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3076742, win 4380, length 0 15:02:16.825288 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3079662, win 4380, length 0 15:02:16.828532 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3082582, win 4380, length 0 15:02:16.830490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3084326, win 4380, length 0 15:02:16.830983 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246309:246350, ack 3084326, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:16.831866 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084326:3084365, ack 246350, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:16.834572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246350:246395, ack 3084365, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.838344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084365:3084404, ack 246395, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.840739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246395:246523, ack 3084404, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.841697 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084404:3084543, ack 246523, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.843292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246523:246599, ack 3084543, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.844225 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084543:3084615, ack 246599, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.845803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246599:246675, ack 3084615, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.846207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084615:3084719, ack 246675, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.847816 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246675:246763, ack 3084719, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.847900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3084719:3084807, ack 246763, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.849587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246763:246891, ack 3084807, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.856158 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3084807:3087727, ack 246891, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.856400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3087727:3088227, ack 246891, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:16.859109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3087727, win 4380, length 0 15:02:16.860515 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246891:246936, ack 3088227, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.861220 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3088227:3088266, ack 246936, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.863832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 246936:247044, ack 3088266, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.864740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3088266:3088405, ack 247044, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.866331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247044:247120, ack 3088405, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.867175 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3088405:3088477, ack 247120, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.868796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247120:247196, ack 3088477, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.869622 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3088477:3088565, ack 247196, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.871265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247196:247304, ack 3088565, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.875128 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3088565:3090025, ack 247304, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:16.875333 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090025:3090461, ack 247304, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:16.877771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3090461, win 4380, length 0 15:02:16.878158 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247304:247349, ack 3090461, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.878825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090461:3090500, ack 247349, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.881225 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247349:247475, ack 3090500, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.882107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090500:3090639, ack 247475, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.883703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247475:247551, ack 3090639, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.884608 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090639:3090711, ack 247551, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.886215 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247551:247627, ack 3090711, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.886849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090711:3090815, ack 247627, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.888470 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247627:247715, ack 3090815, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.888568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090815:3090903, ack 247715, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.890265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247715:247841, ack 3090903, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.892336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3090903:3091603, ack 247841, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:16.894495 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247841:247886, ack 3091603, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.895215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3091603:3091642, ack 247886, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.898235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 247886:248020, ack 3091642, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.899130 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3091642:3091781, ack 248020, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.900834 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248020:248096, ack 3091781, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.901677 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3091781:3091853, ack 248096, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.903437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248096:248172, ack 3091853, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.904371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3091853:3091941, ack 248172, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.906035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248172:248306, ack 3091941, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.907305 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3091941:3092209, ack 248306, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:16.909046 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248306:248351, ack 3092209, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.909737 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3092209:3092248, ack 248351, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:16.912110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248351:248485, ack 3092248, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:16.913287 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3092248:3092387, ack 248485, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:16.914888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248485:248561, ack 3092387, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.915807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3092387:3092459, ack 248561, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:16.917383 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248561:248637, ack 3092459, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.918265 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3092459:3092547, ack 248637, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:16.919940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248637:248771, ack 3092547, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:16.922432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3092547:3093487, ack 248771, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:16.924441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248771:248816, ack 3093487, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:16.924853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3093487:3093591, ack 248816, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:16.926487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248816:248904, ack 3093591, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:16.926573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3093591:3093630, ack 248904, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:17.130723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3093630, win 4344, length 0 15:02:18.448626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248904:248984, ack 3093630, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.449629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3093630:3093734, ack 248984, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:18.451459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 248984:249064, ack 3093734, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.452364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3093734:3093822, ack 249064, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.453985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249064:249154, ack 3093822, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.454872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3093822:3093961, ack 249154, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.456550 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249154:249244, ack 3093961, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.465091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3093961:3098341, ack 249244, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.465344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3098341:3098369, ack 249244, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:18.468028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3096881, win 4380, length 0 15:02:18.469882 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3098369, win 4380, length 0 15:02:18.472492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249244:249334, ack 3098369, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.473345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3098369:3098508, ack 249334, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.475323 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249334:249379, ack 3098508, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.476034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3098508:3098547, ack 249379, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.477626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249379:249469, ack 3098547, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.484788 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [S], seq 6541, win 8192, options [mss 1460], length 0 15:02:18.484917 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [S.], seq 3138809904, ack 6542, win 4380, options [mss 1460], length 0 15:02:18.486427 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3098547:3102927, ack 249469, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.486649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3102927:3102955, ack 249469, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:18.491890 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3101467, win 4380, length 0 15:02:18.493015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3102955, win 4380, length 0 15:02:18.493063 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1:52, ack 1, win 8192, length 51SMB PACKET: SMBnegprot (REQUEST) 15:02:18.493157 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [.], ack 52, win 4380, length 0 15:02:18.493647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249469:249514, ack 3102955, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.494799 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3102955:3103059, ack 249514, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.502862 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1:106, ack 52, win 4380, length 105SMB PACKET: SMBnegprot (REPLY) 15:02:18.511695 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 52:184, ack 106, win 8192, length 132SMB PACKET: SMBsesssetupX (REQUEST) 15:02:18.516594 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 106:210, ack 184, win 5360, length 104SMB PACKET: SMBsesssetupX (REPLY) 15:02:18.526532 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 184:240, ack 210, win 8192, length 56SMB PACKET: SMBecho (REQUEST) 15:02:18.527208 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 210:266, ack 240, win 5360, length 56SMB PACKET: SMBecho (REPLY) 15:02:18.535999 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 240:336, ack 266, win 8192, length 96SMB PACKET: SMBtconX (REQUEST) 15:02:18.539893 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 266:324, ack 336, win 5360, length 58SMB PACKET: SMBtconX (REPLY) 15:02:18.550711 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 336:424, ack 324, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.552327 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 324:363, ack 424, win 5360, length 39SMB PACKET: SMBtrans2 (REPLY) 15:02:18.562045 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 424:512, ack 363, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.563294 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 363:463, ack 512, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.571723 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 512:600, ack 463, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.572716 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 463:551, ack 600, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.582673 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 600:686, ack 551, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.583623 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 551:651, ack 686, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.592046 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 686:772, ack 651, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.592969 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 651:739, ack 772, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.602688 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 772:860, ack 739, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.603642 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 739:839, ack 860, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.612091 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 860:948, ack 839, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.613030 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 839:927, ack 948, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.623333 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 948:1053, ack 927, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.624374 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 927:966, ack 1053, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:18.633640 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1053:1139, ack 966, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.634619 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 966:1066, ack 1139, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.643990 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1139:1225, ack 1066, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.644971 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1066:1154, ack 1225, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.648656 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 1154, win 8192, length 0 15:02:18.654373 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1225:1321, ack 1154, win 8192, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.655678 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1154:1322, ack 1321, win 5360, length 168SMB PACKET: SMBtrans2 (REPLY) 15:02:18.665998 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1321:1406, ack 1322, win 8192, length 85SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.666675 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1322:1361, ack 1406, win 5360, length 39SMB PACKET: SMBtrans2 (REPLY) 15:02:18.676100 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1406:1494, ack 1361, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.677043 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1361:1461, ack 1494, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.686688 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1494:1582, ack 1461, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.687618 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1461:1549, ack 1582, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.690680 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3103059, win 4354, length 0 15:02:18.690758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3103059:3103098, ack 249514, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.692482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249514:249602, ack 3103098, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.693227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3103098:3103202, ack 249602, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.693377 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249602:249720, ack 3103098, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.694992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249720:249808, ack 3103202, win 4318, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.695084 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3103202:3103341, ack 249808, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.696456 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1582:1680, ack 1549, win 8192, length 98SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.696702 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249808:249884, ack 3103341, win 4283, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.697567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3103341:3103413, ack 249884, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.698762 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1549:1717, ack 1680, win 5360, length 168SMB PACKET: SMBtrans2 (REPLY) 15:02:18.699165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249884:249960, ack 3103413, win 4265, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.700026 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3103413:3103501, ack 249960, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.701662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 249960:250078, ack 3103501, win 4243, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.706212 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3103501:3104961, ack 250078, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.706514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3104961:3105701, ack 250078, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:18.708986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3105701, win 4380, length 0 15:02:18.709074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3105701:3105805, ack 250078, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.709100 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1680:1765, ack 1717, win 8192, length 85SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.709483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250078:250123, ack 3105701, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.709792 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1717:1756, ack 1765, win 5360, length 39SMB PACKET: SMBtrans2 (REPLY) 15:02:18.710756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250123:250211, ack 3105805, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.710841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3105805:3105844, ack 250211, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.713240 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250211:250311, ack 3105844, win 4344, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.714181 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3105844:3105983, ack 250311, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.715777 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250311:250387, ack 3105983, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.716667 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3105983:3106055, ack 250387, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.718270 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250387:250463, ack 3106055, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.719081 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106055:3106143, ack 250463, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.719256 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1765:1870, ack 1756, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.719971 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1756:1795, ack 1870, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:18.720737 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250463:250563, ack 3106143, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.722457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106143:3106723, ack 250563, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:18.724446 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250563:250608, ack 3106723, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.725143 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106723:3106762, ack 250608, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.727482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250608:250718, ack 3106762, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.728344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106762:3106901, ack 250718, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.729951 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250718:250794, ack 3106901, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.730777 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1870:1956, ack 1795, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.731740 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1795:1895, ack 1956, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.731961 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106901:3106973, ack 250794, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.733540 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250794:250870, ack 3106973, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.733961 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3106973:3107077, ack 250870, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.735576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250870:250958, ack 3107077, win 4036, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.735661 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107077:3107165, ack 250958, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.737328 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 250958:251068, ack 3107165, win 4380, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.738926 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107165:3107661, ack 251068, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:18.740161 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 1956:2042, ack 1895, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.741048 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1895:1983, ack 2042, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.741227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251068:251113, ack 3107661, win 4256, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.741930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107661:3107700, ack 251113, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.744283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251113:251217, ack 3107700, win 4246, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.745176 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107700:3107839, ack 251217, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.746766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251217:251293, ack 3107839, win 4211, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.747610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107839:3107911, ack 251293, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.749231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251293:251369, ack 3107911, win 4193, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.750051 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3107911:3107999, ack 251369, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.751163 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2042:2130, ack 1983, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.751691 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251369:251473, ack 3107999, win 4171, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.752116 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 1983:2083, ack 2130, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:18.760531 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2130:2218, ack 2083, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.761548 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2083:2171, ack 2218, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.771696 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2218:2323, ack 2171, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.772548 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2171:2210, ack 2323, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:18.774382 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3107999:3118219, ack 251473, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.777353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3110919, win 4380, length 0 15:02:18.777446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3118219:3122599, ack 251473, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:18.781863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3113839, win 4380, length 0 15:02:18.781934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3122599:3124059, ack 251473, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:18.781975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124059:3124399, ack 251473, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:18.783261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3116759, win 4380, length 0 15:02:18.786063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3119679, win 4380, length 0 15:02:18.787538 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3122599, win 4380, length 0 15:02:18.789439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3124399, win 4380, length 0 15:02:18.789504 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124399:3124503, ack 251473, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.789891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251473:251514, ack 3124399, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:18.791190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251514:251602, ack 3124503, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.791276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124503:3124542, ack 251602, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:18.792844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251602:251647, ack 3124542, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.793531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124542:3124581, ack 251647, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.795918 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251647:251757, ack 3124581, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.796827 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124581:3124720, ack 251757, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.798416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251757:251833, ack 3124720, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.799259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124720:3124792, ack 251833, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.800870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251833:251909, ack 3124792, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.801693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3124792:3124880, ack 251909, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.803332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 251909:252019, ack 3124880, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.809534 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3124880:3127800, ack 252019, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.809765 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3127800:3128268, ack 252019, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:18.812372 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3127800, win 4380, length 0 15:02:18.812621 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 2210, win 8192, length 0 15:02:18.813789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252019:252064, ack 3128268, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.814470 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3128268:3128307, ack 252064, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.816867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252064:252166, ack 3128307, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.817740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3128307:3128446, ack 252166, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.819350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252166:252242, ack 3128446, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.819432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3128446:3128550, ack 252242, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.821050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252242:252330, ack 3128550, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.821133 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3128550:3128622, ack 252330, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.822742 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252330:252406, ack 3128622, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.823556 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3128622:3128710, ack 252406, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.825202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252406:252508, ack 3128710, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.830607 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3128710:3131630, ack 252508, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.830839 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3131630:3131722, ack 252508, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:18.833560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3131630, win 4380, length 0 15:02:18.851650 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252508:252553, ack 3131722, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.852485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3131722:3131761, ack 252553, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.856378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252553:252649, ack 3131761, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.857277 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3131761:3131900, ack 252649, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.859018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252649:252725, ack 3131900, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.859848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3131900:3131972, ack 252725, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.861454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252725:252801, ack 3131972, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.862267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3131972:3132060, ack 252801, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.863936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252801:252897, ack 3132060, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.866442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3132060:3133348, ack 252897, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:18.868670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252897:252942, ack 3133348, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.869369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3133348:3133387, ack 252942, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.871813 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 252942:253050, ack 3133387, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.872687 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3133387:3133526, ack 253050, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.874273 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253050:253126, ack 3133526, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.875123 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3133526:3133598, ack 253126, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.876697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253126:253202, ack 3133598, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.876778 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3133598:3133702, ack 253202, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.878449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253202:253290, ack 3133702, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.878533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3133702:3133790, ack 253290, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.880247 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253290:253398, ack 3133790, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.883273 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3133790:3135250, ack 253398, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.883478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3135250:3135258, ack 253398, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:18.885917 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3135258, win 4380, length 0 15:02:18.886373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253398:253443, ack 3135258, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.887045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3135258:3135297, ack 253443, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.889444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253443:253561, ack 3135297, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.890330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3135297:3135436, ack 253561, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.891925 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253561:253637, ack 3135436, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.892759 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3135436:3135508, ack 253637, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.894336 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253637:253713, ack 3135508, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.895171 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3135508:3135596, ack 253713, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.896835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253713:253831, ack 3135596, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.902288 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3135596:3137056, ack 253831, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.902497 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3137056:3138364, ack 253831, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:18.905073 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3138364, win 4380, length 0 15:02:18.905572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253831:253876, ack 3138364, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.906245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3138364:3138403, ack 253876, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.908764 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253876:253978, ack 3138403, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.909646 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3138403:3138542, ack 253978, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.911319 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 253978:254054, ack 3138542, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.912154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3138542:3138614, ack 254054, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.913759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254054:254130, ack 3138614, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.913843 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3138614:3138718, ack 254130, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.915464 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254130:254218, ack 3138718, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.915547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3138718:3138806, ack 254218, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.917215 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254218:254320, ack 3138806, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.930841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3138806:3146106, ack 254320, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:18.931117 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146106:3146294, ack 254320, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:18.933798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3141726, win 4380, length 0 15:02:18.935820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3144646, win 4380, length 0 15:02:18.937807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3146294, win 4380, length 0 15:02:18.938277 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254320:254365, ack 3146294, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.938952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146294:3146333, ack 254365, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.941371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254365:254467, ack 3146333, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.942253 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146333:3146472, ack 254467, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.943838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254467:254543, ack 3146472, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.944687 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146472:3146544, ack 254543, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.946265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254543:254619, ack 3146544, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.947074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146544:3146632, ack 254619, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.948732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254619:254721, ack 3146632, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.950689 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3146632:3147352, ack 254721, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:18.958887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254721:254766, ack 3147352, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:18.959642 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3147352:3147391, ack 254766, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:18.962024 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254766:254892, ack 3147391, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:18.962905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3147391:3147530, ack 254892, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:18.964488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254892:254968, ack 3147530, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.965344 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3147530:3147602, ack 254968, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:18.966928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 254968:255044, ack 3147602, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.967009 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3147602:3147706, ack 255044, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:18.968645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255044:255132, ack 3147706, win 4027, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:18.968726 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3147706:3147794, ack 255132, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:18.970451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255132:255258, ack 3147794, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:18.998578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3147794:3162394, ack 255258, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:19.001576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3150714, win 4380, length 0 15:02:19.003742 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3153634, win 4380, length 0 15:02:19.003823 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3162394:3163854, ack 255258, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:19.003867 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3163854:3164098, ack 255258, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:19.005897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3156554, win 4380, length 0 15:02:19.008840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3159474, win 4380, length 0 15:02:19.010171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3162394, win 4380, length 0 15:02:19.012089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3164098, win 4380, length 0 15:02:19.012672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255258:255418, ack 3164098, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.038954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3164098:3180158, ack 255418, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:19.039292 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3180158:3180518, ack 255418, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:19.042835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3167018, win 4380, length 0 15:02:19.044973 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3169938, win 4380, length 0 15:02:19.052854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3172858, win 4380, length 0 15:02:19.053245 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3175778, win 4380, length 0 15:02:19.053725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3178698, win 4380, length 0 15:02:19.054949 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3180518, win 4380, length 0 15:02:19.055616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255418:255534, ack 3180518, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.081201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3180518:3196578, ack 255534, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:19.081539 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3196578:3196862, ack 255534, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:19.084191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3183438, win 4380, length 0 15:02:19.087944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3186358, win 4380, length 0 15:02:19.090063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3189278, win 4380, length 0 15:02:19.092068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3192198, win 4380, length 0 15:02:19.094205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3195118, win 4380, length 0 15:02:19.096262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3196862, win 4380, length 0 15:02:19.096335 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3196862:3196966, ack 255534, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:19.096708 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255534:255575, ack 3196862, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:19.098000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255575:255663, ack 3196966, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:19.098085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3196966:3197005, ack 255663, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:19.099673 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255663:255708, ack 3197005, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.100395 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3197005:3197044, ack 255708, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.102828 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255708:255836, ack 3197044, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.103779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3197044:3197183, ack 255836, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:19.105370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255836:255912, ack 3197183, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.106226 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3197183:3197255, ack 255912, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:19.107812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255912:255988, ack 3197255, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.108629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3197255:3197343, ack 255988, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.110299 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 255988:256116, ack 3197343, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.116829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3197343:3200263, ack 256116, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:19.117066 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3200263:3200763, ack 256116, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:19.119753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3200263, win 4380, length 0 15:02:19.121200 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256116:256161, ack 3200763, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.121873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3200763:3200802, ack 256161, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.124863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256161:256269, ack 3200802, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.125770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3200802:3200941, ack 256269, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:19.127362 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256269:256345, ack 3200941, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.128201 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3200941:3201013, ack 256345, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:19.129810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256345:256421, ack 3201013, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.130622 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3201013:3201101, ack 256421, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.132295 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256421:256529, ack 3201101, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.132665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3201101:3201205, ack 256529, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:19.134282 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256529:256617, ack 3201205, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:19.136789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3201205:3202665, ack 256617, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:19.136988 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3202665:3203101, ack 256617, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:19.140141 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3203101, win 4380, length 0 15:02:19.140629 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256617:256662, ack 3203101, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.141269 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3203101:3203140, ack 256662, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.143733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256662:256788, ack 3203140, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.144657 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3203140:3203279, ack 256788, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:19.146254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256788:256864, ack 3203279, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.147377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3203279:3203351, ack 256864, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:19.148980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256864:256940, ack 3203351, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.149825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3203351:3203439, ack 256940, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.151478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 256940:257066, ack 3203439, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.153506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3203439:3204139, ack 257066, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:19.161510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257066:257111, ack 3204139, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.162262 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204139:3204178, ack 257111, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.164644 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257111:257245, ack 3204178, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.165563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204178:3204317, ack 257245, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:19.167158 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257245:257321, ack 3204317, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.168013 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204317:3204389, ack 257321, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:19.169606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257321:257397, ack 3204389, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.170429 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204389:3204477, ack 257397, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.172088 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257397:257531, ack 3204477, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.173394 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204477:3204745, ack 257531, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:19.175112 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257531:257576, ack 3204745, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.175200 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204745:3204849, ack 257576, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:19.176810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257576:257664, ack 3204849, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:19.176895 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204849:3204888, ack 257664, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.179347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257664:257798, ack 3204888, win 4344, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.180243 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3204888:3205027, ack 257798, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:19.181864 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257798:257874, ack 3205027, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.182714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3205027:3205099, ack 257874, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:19.184287 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257874:257950, ack 3205099, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.185135 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3205099:3205187, ack 257950, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.186781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 257950:258084, ack 3205187, win 4269, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.189259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3205187:3206127, ack 258084, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:19.191348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258084:258129, ack 3206127, win 4034, length 45SMB PACKET: SMBclose (REQUEST) 15:02:19.192086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3206127:3206166, ack 258129, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:19.331080 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2323:2409, ack 2210, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.332119 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2210:2310, ack 2409, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:19.340539 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2409:2495, ack 2310, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.341503 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2310:2398, ack 2495, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.351631 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2495:2583, ack 2398, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.352586 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2398:2498, ack 2583, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:19.361007 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2583:2671, ack 2498, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:19.361945 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2498:2586, ack 2671, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:19.371758 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2671:2776, ack 2586, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:19.372558 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2586:2625, ack 2776, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:19.394044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3206166, win 4024, length 0 15:02:19.467858 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 2625, win 8192, length 0 15:02:20.739092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258129:258209, ack 3206166, win 4024, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:20.739609 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3206166:3206270, ack 258209, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:20.937057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3206270, win 4380, length 0 15:02:20.937153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3206270:3206374, ack 258209, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:20.938901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258209:258289, ack 3206374, win 4354, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:20.939753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3206374:3206462, ack 258289, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:20.941344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258289:258379, ack 3206462, win 4332, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:20.942219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3206462:3206601, ack 258379, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:20.943836 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258379:258467, ack 3206601, win 4297, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:20.983741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 258467, win 3247, length 0 15:02:20.985298 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258467:258557, ack 3206601, win 4297, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:20.985368 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 258557, win 3247, length 0 15:02:20.993922 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3206601:3210981, ack 258557, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:20.994182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3210981:3211009, ack 258557, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:20.997559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3209521, win 4380, length 0 15:02:21.000208 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3211009, win 4380, length 0 15:02:21.002000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258557:258647, ack 3211009, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.002873 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3211009:3211148, ack 258647, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.004749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258647:258692, ack 3211148, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.005470 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3211148:3211187, ack 258692, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.007018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258692:258782, ack 3211187, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.015416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3211187:3215567, ack 258782, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.015661 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215567:3215595, ack 258782, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:21.019948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3214107, win 4380, length 0 15:02:21.022476 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3215595, win 4380, length 0 15:02:21.023118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258782:258827, ack 3215595, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.023820 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215595:3215634, ack 258827, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.030442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258827:258945, ack 3215634, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.031337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215634:3215773, ack 258945, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.033280 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 258945:259021, ack 3215773, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.033362 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215773:3215877, ack 259021, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.034952 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259021:259109, ack 3215877, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.035040 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215877:3215949, ack 259109, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.036632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259109:259185, ack 3215949, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.037459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3215949:3216037, ack 259185, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.039110 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259185:259303, ack 3216037, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.043568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3216037:3217497, ack 259303, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.043821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3217497:3218237, ack 259303, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:21.047811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3218237, win 4380, length 0 15:02:21.048296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259303:259348, ack 3218237, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.048966 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3218237:3218276, ack 259348, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.051878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259348:259448, ack 3218276, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.052784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3218276:3218415, ack 259448, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.055078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259448:259524, ack 3218415, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.055943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3218415:3218487, ack 259524, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.057493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259524:259600, ack 3218487, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.058306 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3218487:3218575, ack 259600, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.059937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259600:259700, ack 3218575, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.061644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3218575:3219155, ack 259700, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:21.064148 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259700:259745, ack 3219155, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.064974 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219155:3219194, ack 259745, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.067213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259745:259855, ack 3219194, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.068098 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219194:3219333, ack 259855, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.069675 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259855:259931, ack 3219333, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.070513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219333:3219405, ack 259931, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.072799 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 259931:260007, ack 3219405, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.072881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219405:3219509, ack 260007, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.074458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260007:260095, ack 3219509, win 4062, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.074542 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219509:3219597, ack 260095, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.076178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260095:260205, ack 3219597, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.077736 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3219597:3220093, ack 260205, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:21.080462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260205:260250, ack 3220093, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.081148 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3220093:3220132, ack 260250, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.083525 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260250:260354, ack 3220132, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.084440 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3220132:3220271, ack 260354, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.086029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260354:260430, ack 3220271, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.086860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3220271:3220343, ack 260430, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.088413 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260430:260506, ack 3220343, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.089218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3220343:3220431, ack 260506, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.090892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260506:260610, ack 3220431, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.110534 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3220431:3230651, ack 260610, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.115044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3223351, win 4380, length 0 15:02:21.115143 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3230651:3235031, ack 260610, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:21.118903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3226271, win 4380, length 0 15:02:21.118972 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3235031:3236491, ack 260610, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:21.119015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3236491:3236831, ack 260610, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:21.122954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3229191, win 4380, length 0 15:02:21.127654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3232111, win 4380, length 0 15:02:21.131474 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3235031, win 4380, length 0 15:02:21.133421 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3236831, win 4380, length 0 15:02:21.133938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260610:260651, ack 3236831, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:21.134783 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3236831:3236870, ack 260651, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:21.136797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260651:260696, ack 3236870, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.136882 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3236870:3236974, ack 260696, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.139191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260696:260784, ack 3236974, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.139276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3236974:3237013, ack 260784, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.141555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260784:260894, ack 3237013, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.142440 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3237013:3237152, ack 260894, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.144001 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260894:260970, ack 3237152, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.144859 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3237152:3237224, ack 260970, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.146401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 260970:261046, ack 3237224, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.147388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3237224:3237312, ack 261046, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.149017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261046:261156, ack 3237312, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.155332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3237312:3240232, ack 261156, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.155567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3240232:3240700, ack 261156, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:21.159735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3240232, win 4380, length 0 15:02:21.161217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261156:261201, ack 3240700, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.161886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3240700:3240739, ack 261201, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.164136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261201:261303, ack 3240739, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.165026 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3240739:3240878, ack 261303, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.166583 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261303:261379, ack 3240878, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.167420 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3240878:3240950, ack 261379, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.169573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261379:261455, ack 3240950, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.170387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3240950:3241038, ack 261455, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.172023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261455:261557, ack 3241038, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.177478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3241038:3243958, ack 261557, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.177716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3243958:3244050, ack 261557, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:21.183042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3243958, win 4380, length 0 15:02:21.184296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261557:261602, ack 3244050, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.184371 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244050:3244154, ack 261602, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.185952 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261602:261690, ack 3244154, win 4331, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.186035 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244154:3244193, ack 261690, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.188296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261690:261786, ack 3244193, win 4321, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.189179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244193:3244332, ack 261786, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.190776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261786:261862, ack 3244332, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.191616 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244332:3244404, ack 261862, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.193154 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261862:261938, ack 3244404, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.194026 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244404:3244492, ack 261938, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.195622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 261938:262034, ack 3244492, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.198110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3244492:3245780, ack 262034, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:21.200266 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262034:262079, ack 3245780, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.200954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3245780:3245819, ack 262079, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.203219 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262079:262187, ack 3245819, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.204137 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3245819:3245958, ack 262187, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.206224 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262187:262263, ack 3245958, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.207056 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3245958:3246030, ack 262263, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.209334 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262263:262339, ack 3246030, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.210146 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3246030:3246118, ack 262339, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.211750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262339:262447, ack 3246118, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.214781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3246118:3247578, ack 262447, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.214984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247578:3247586, ack 262447, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:21.219582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3247586, win 4380, length 0 15:02:21.237288 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262447:262492, ack 3247586, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.237645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247586:3247690, ack 262492, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.242395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262492:262580, ack 3247690, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.242481 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247690:3247729, ack 262580, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.244942 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262580:262698, ack 3247729, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.245851 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247729:3247868, ack 262698, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.247524 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262698:262774, ack 3247868, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.248370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247868:3247940, ack 262774, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.250001 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262774:262850, ack 3247940, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.250821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3247940:3248028, ack 262850, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.252441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262850:262968, ack 3248028, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.258021 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3248028:3249488, ack 262968, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.258228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3249488:3250796, ack 262968, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:21.262447 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3250796, win 4380, length 0 15:02:21.262830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 262968:263013, ack 3250796, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.263481 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3250796:3250835, ack 263013, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.266614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263013:263115, ack 3250835, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.267496 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3250835:3250974, ack 263115, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.269096 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263115:263191, ack 3250974, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.269929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3250974:3251046, ack 263191, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.271998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263191:263267, ack 3251046, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.272806 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3251046:3251134, ack 263267, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.274405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263267:263369, ack 3251134, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.288046 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3251134:3258434, ack 263369, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.288319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258434:3258622, ack 263369, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:21.291677 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3254054, win 4380, length 0 15:02:21.293697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3256974, win 4380, length 0 15:02:21.409885 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3258622, win 4380, length 0 15:02:21.409961 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258622:3258726, ack 263369, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.410444 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263369:263414, ack 3258622, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.411925 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263414:263502, ack 3258726, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.412007 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258726:3258765, ack 263502, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.414359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263502:263604, ack 3258765, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.415267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258765:3258904, ack 263604, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.417406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263604:263680, ack 3258904, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.418240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258904:3258976, ack 263680, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.419795 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263680:263756, ack 3258976, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.420610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3258976:3259064, ack 263756, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.422216 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263756:263858, ack 3259064, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.424280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3259064:3259784, ack 263858, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:21.426424 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263858:263903, ack 3259784, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.427115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3259784:3259823, ack 263903, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.433428 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 263903:264029, ack 3259823, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.434355 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3259823:3259962, ack 264029, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.435931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264029:264105, ack 3259962, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.436783 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3259962:3260034, ack 264105, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.438344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264105:264181, ack 3260034, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.439163 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3260034:3260122, ack 264181, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.442293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264181:264307, ack 3260122, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.468684 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3260122:3274722, ack 264307, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.473292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3263042, win 4380, length 0 15:02:21.476392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3265962, win 4380, length 0 15:02:21.476470 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3274722:3276182, ack 264307, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:21.476514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3276182:3276426, ack 264307, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:21.478492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3268882, win 4380, length 0 15:02:21.481387 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3271802, win 4380, length 0 15:02:21.484156 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3274722, win 4380, length 0 15:02:21.486092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3276426, win 4380, length 0 15:02:21.486157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3276426:3276530, ack 264307, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.486727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264307:264467, ack 3276426, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.487952 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264467:264555, ack 3276530, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.513224 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3276530:3292590, ack 264555, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.513567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3292590:3292950, ack 264555, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:21.516976 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3279450, win 4380, length 0 15:02:21.519922 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3282370, win 4380, length 0 15:02:21.523424 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3285290, win 4380, length 0 15:02:21.524816 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3288210, win 4380, length 0 15:02:21.528619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3291130, win 4380, length 0 15:02:21.531280 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3292950, win 4380, length 0 15:02:21.531819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264555:264671, ack 3292950, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.557502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3292950:3309010, ack 264671, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.557850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309010:3309294, ack 264671, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:21.565053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3295870, win 4380, length 0 15:02:21.567714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3298790, win 4380, length 0 15:02:21.571399 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3301710, win 4380, length 0 15:02:21.575198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3304630, win 4380, length 0 15:02:21.577252 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3307550, win 4380, length 0 15:02:21.580212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3309294, win 4380, length 0 15:02:21.580705 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264671:264712, ack 3309294, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:21.581590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309294:3309333, ack 264712, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:21.583115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264712:264757, ack 3309333, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.583852 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309333:3309372, ack 264757, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.586192 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264757:264885, ack 3309372, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.587143 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309372:3309511, ack 264885, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.588747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264885:264961, ack 3309511, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.588829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309511:3309615, ack 264961, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.590441 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 264961:265049, ack 3309615, win 4299, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.590523 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309615:3309687, ack 265049, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.592098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265049:265125, ack 3309687, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.592925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3309687:3309775, ack 265125, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.594553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265125:265253, ack 3309775, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.601035 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3309775:3312695, ack 265253, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.601274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3312695:3313195, ack 265253, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:21.604776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3312695, win 4380, length 0 15:02:21.606201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265253:265298, ack 3313195, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.607156 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3313195:3313234, ack 265298, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.609472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265298:265406, ack 3313234, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.610422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3313234:3313373, ack 265406, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.612005 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265406:265482, ack 3313373, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.612868 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3313373:3313445, ack 265482, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.614439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265482:265558, ack 3313445, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.615280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3313445:3313533, ack 265558, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.616892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265558:265666, ack 3313533, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.620656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3313533:3314993, ack 265666, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:21.620863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3314993:3315429, ack 265666, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:21.623306 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3315429, win 4380, length 0 15:02:21.623749 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265666:265711, ack 3315429, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.624423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315429:3315468, ack 265711, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.627292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265711:265837, ack 3315468, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.628329 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315468:3315607, ack 265837, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.629932 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265837:265913, ack 3315607, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.630018 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315607:3315711, ack 265913, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.631597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 265913:266001, ack 3315711, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.631682 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315711:3315783, ack 266001, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.633249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266001:266077, ack 3315783, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.634157 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315783:3315871, ack 266077, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.636310 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266077:266203, ack 3315871, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.638348 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3315871:3316571, ack 266203, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:21.640544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266203:266248, ack 3316571, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.641228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3316571:3316610, ack 266248, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.647454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266248:266382, ack 3316610, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.648358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3316610:3316749, ack 266382, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.650044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266382:266458, ack 3316749, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.650885 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3316749:3316821, ack 266458, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.653067 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266458:266534, ack 3316821, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.653983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3316821:3316909, ack 266534, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.655619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266534:266668, ack 3316909, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.656872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3316909:3317177, ack 266668, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:21.658584 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266668:266713, ack 3317177, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.659267 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317177:3317216, ack 266713, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.661609 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266713:266847, ack 3317216, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:21.662482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317216:3317355, ack 266847, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:21.664039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266847:266923, ack 3317355, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.664895 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317355:3317427, ack 266923, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:21.666443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266923:266999, ack 3317427, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.666811 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317427:3317531, ack 266999, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:21.668398 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 266999:267087, ack 3317531, win 4224, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:21.668482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317531:3317619, ack 267087, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:21.670728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267087:267221, ack 3317619, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:21.673241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3317619:3318559, ack 267221, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:21.675205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267221:267266, ack 3318559, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:21.675910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3318559:3318598, ack 267266, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:21.873034 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3318598, win 4370, length 0 15:02:22.381068 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2776:2835, ack 2625, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:22.381734 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2625:2684, ack 2835, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:22.417032 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 2684, win 8192, length 0 15:02:23.191940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267266:267356, ack 3318598, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.193031 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3318598:3318737, ack 267356, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.194826 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267356:267436, ack 3318737, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.195733 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3318737:3318841, ack 267436, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:23.197293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267436:267516, ack 3318841, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.198132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3318841:3318929, ack 267516, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.199735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267516:267606, ack 3318929, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.208182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3318929:3323309, ack 267606, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.208438 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3323309:3323337, ack 267606, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:23.211085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3321849, win 4380, length 0 15:02:23.213003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3323337, win 4380, length 0 15:02:23.214920 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267606:267696, ack 3323337, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.215788 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3323337:3323476, ack 267696, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.217731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267696:267741, ack 3323476, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.218430 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3323476:3323515, ack 267741, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.220056 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267741:267831, ack 3323515, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.220445 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3323515:3323619, ack 267831, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.223748 IP guruplug.microsoft-ds > 192.168.0.10.31674: Flags [F.], seq 3566, ack 3845, win 5360, length 0 15:02:23.224019 IP 192.168.0.10.31674 > guruplug.microsoft-ds: Flags [R.], seq 3845, ack 3567, win 8192, length 0 15:02:23.229356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3323619:3327999, ack 267831, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.232263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3325079, win 4380, length 0 15:02:23.232350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3327999:3328027, ack 267831, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:23.233686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3327999, win 4380, length 0 15:02:23.234887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267831:267919, ack 3328027, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.273711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 267919, win 3247, length 0 15:02:23.275458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267919:267964, ack 3328027, win 4373, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.275525 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 267964, win 3247, length 0 15:02:23.276241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3328027:3328066, ack 267964, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.278593 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 267964:268082, ack 3328066, win 4363, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.279488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3328066:3328205, ack 268082, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.281199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268082:268158, ack 3328205, win 4328, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.282031 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3328205:3328277, ack 268158, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.285344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268158:268234, ack 3328277, win 4310, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.286182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3328277:3328365, ack 268234, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.287878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268234:268352, ack 3328365, win 4288, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.292362 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3328365:3329825, ack 268352, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.292568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3329825:3330565, ack 268352, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:23.295130 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3330565, win 4380, length 0 15:02:23.295497 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268352:268397, ack 3330565, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.296173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3330565:3330604, ack 268397, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.298515 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268397:268497, ack 3330604, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.299418 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3330604:3330743, ack 268497, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.301048 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268497:268573, ack 3330743, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.301875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3330743:3330815, ack 268573, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.303462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268573:268649, ack 3330815, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.303545 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3330815:3330919, ack 268649, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.305146 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268649:268737, ack 3330919, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.305230 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3330919:3331007, ack 268737, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.306891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268737:268837, ack 3331007, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.308599 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331007:3331587, ack 268837, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:23.310491 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268837:268882, ack 3331587, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.311183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331587:3331626, ack 268882, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.313463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268882:268992, ack 3331626, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.314376 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331626:3331765, ack 268992, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.315967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 268992:269068, ack 3331765, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.316809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331765:3331837, ack 269068, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.318408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269068:269144, ack 3331837, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.319255 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331837:3331925, ack 269144, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.320917 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269144:269254, ack 3331925, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.322449 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3331925:3332421, ack 269254, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:23.324338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269254:269299, ack 3332421, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.325033 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3332421:3332460, ack 269299, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.327414 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269299:269403, ack 3332460, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.328265 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3332460:3332599, ack 269403, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.329957 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269403:269479, ack 3332599, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.330779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3332599:3332671, ack 269479, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.332493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269479:269555, ack 3332671, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.333466 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3332671:3332759, ack 269555, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.335247 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269555:269659, ack 3332759, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.335619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3332759:3332863, ack 269659, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.346338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269659:269747, ack 3332863, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.355705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3332863:3343083, ack 269747, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.359393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3335783, win 4380, length 0 15:02:23.359497 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3343083:3347463, ack 269747, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:23.360735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3338703, win 4380, length 0 15:02:23.360807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3347463:3348923, ack 269747, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:23.360848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3348923:3349263, ack 269747, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:23.363651 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3341623, win 4380, length 0 15:02:23.365732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3344543, win 4380, length 0 15:02:23.367166 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3347463, win 4380, length 0 15:02:23.369280 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3349263, win 4380, length 0 15:02:23.369726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269747:269788, ack 3349263, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:23.370553 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3349263:3349302, ack 269788, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:23.372125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269788:269833, ack 3349302, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.372833 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3349302:3349341, ack 269833, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.375152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269833:269943, ack 3349341, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.376068 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3349341:3349480, ack 269943, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.377662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 269943:270019, ack 3349480, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.378504 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3349480:3349552, ack 270019, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.380134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270019:270095, ack 3349552, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.380954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3349552:3349640, ack 270095, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.382596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270095:270205, ack 3349640, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.388805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3349640:3352560, ack 270205, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.389041 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3352560:3353028, ack 270205, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:23.391775 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3352560, win 4380, length 0 15:02:23.393268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270205:270250, ack 3353028, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.393989 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3353028:3353067, ack 270250, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.396283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270250:270352, ack 3353067, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.396363 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3353067:3353171, ack 270352, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.398016 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270352:270440, ack 3353171, win 4227, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.398101 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3353171:3353310, ack 270440, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.399667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270440:270516, ack 3353310, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.400492 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3353310:3353382, ack 270516, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.402114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270516:270592, ack 3353382, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.402936 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3353382:3353470, ack 270592, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.404614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270592:270694, ack 3353470, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.410025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3353470:3356390, ack 270694, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.410256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356390:3356482, ack 270694, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:23.412857 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3356390, win 4380, length 0 15:02:23.414152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270694:270739, ack 3356482, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.414831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356482:3356521, ack 270739, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.417144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270739:270835, ack 3356521, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.418025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356521:3356660, ack 270835, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.419636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270835:270911, ack 3356660, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.420476 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356660:3356732, ack 270911, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.422084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270911:270987, ack 3356732, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.422898 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356732:3356820, ack 270987, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.424532 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 270987:271083, ack 3356820, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.427036 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3356820:3358108, ack 271083, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:23.429236 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271083:271128, ack 3358108, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.429925 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3358108:3358147, ack 271128, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.432201 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271128:271236, ack 3358147, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.432569 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3358147:3358251, ack 271236, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.434226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271236:271324, ack 3358251, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.434313 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3358251:3358390, ack 271324, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.435869 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271324:271400, ack 3358390, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.436696 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3358390:3358462, ack 271400, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.438281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271400:271476, ack 3358462, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.439094 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3358462:3358550, ack 271476, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.440761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271476:271584, ack 3358550, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.443822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3358550:3360010, ack 271584, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.444021 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3360010:3360018, ack 271584, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:23.446450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3360018, win 4380, length 0 15:02:23.446860 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271584:271629, ack 3360018, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.447525 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3360018:3360057, ack 271629, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.449868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271629:271747, ack 3360057, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.450740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3360057:3360196, ack 271747, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.452342 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271747:271823, ack 3360196, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.453183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3360196:3360268, ack 271823, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.454759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271823:271899, ack 3360268, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.455592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3360268:3360356, ack 271899, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.457230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 271899:272017, ack 3360356, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.462700 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3360356:3361816, ack 272017, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.462909 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3361816:3363124, ack 272017, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:23.465513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3363124, win 4380, length 0 15:02:23.465880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272017:272062, ack 3363124, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.466543 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3363124:3363163, ack 272062, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.468881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272062:272164, ack 3363163, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.469251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3363163:3363267, ack 272164, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.470910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272164:272252, ack 3363267, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.470994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3363267:3363406, ack 272252, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.472543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272252:272328, ack 3363406, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.473367 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3363406:3363478, ack 272328, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.474942 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272328:272404, ack 3363478, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.475765 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3363478:3363566, ack 272404, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.477389 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272404:272506, ack 3363566, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.491019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3363566:3370866, ack 272506, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.491286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3370866:3371054, ack 272506, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:23.493985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3366486, win 4380, length 0 15:02:23.496094 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3369406, win 4380, length 0 15:02:23.498161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3371054, win 4380, length 0 15:02:23.498648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272506:272551, ack 3371054, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.499334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3371054:3371093, ack 272551, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.501667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272551:272653, ack 3371093, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.502547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3371093:3371232, ack 272653, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.504140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272653:272729, ack 3371232, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.504997 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3371232:3371304, ack 272729, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.506573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272729:272805, ack 3371304, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.507383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3371304:3371392, ack 272805, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.509040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272805:272907, ack 3371392, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.511037 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3371392:3372112, ack 272907, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:23.519085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272907:272952, ack 3372112, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.519791 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3372112:3372151, ack 272952, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.522175 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 272952:273078, ack 3372151, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.522543 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3372151:3372255, ack 273078, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.524199 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273078:273166, ack 3372255, win 4079, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.524287 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3372255:3372394, ack 273166, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.525877 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273166:273242, ack 3372394, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.526722 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3372394:3372466, ack 273242, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.528300 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273242:273318, ack 3372466, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.529121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3372466:3372554, ack 273318, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.530809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273318:273444, ack 3372554, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.557182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3372554:3387154, ack 273444, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.560218 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3375474, win 4380, length 0 15:02:23.563003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3378394, win 4380, length 0 15:02:23.563079 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3387154:3388614, ack 273444, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:23.563122 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3388614:3388858, ack 273444, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:23.564419 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3381314, win 4380, length 0 15:02:23.568066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3384234, win 4380, length 0 15:02:23.568567 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3387154, win 4380, length 0 15:02:23.570450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3388858, win 4380, length 0 15:02:23.571073 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273444:273604, ack 3388858, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.597375 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3388858:3404918, ack 273604, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.597725 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3404918:3405278, ack 273604, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:23.600361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3391778, win 4380, length 0 15:02:23.602511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3394698, win 4380, length 0 15:02:23.607256 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3397618, win 4380, length 0 15:02:23.613006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3400538, win 4380, length 0 15:02:23.613449 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3403458, win 4380, length 0 15:02:23.615519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3405278, win 4380, length 0 15:02:23.616833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273604:273720, ack 3405278, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.643479 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3405278:3421338, ack 273720, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.643890 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421338:3421622, ack 273720, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:23.646443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3408198, win 4380, length 0 15:02:23.648552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3411118, win 4380, length 0 15:02:23.650653 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3414038, win 4380, length 0 15:02:23.653458 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3416958, win 4380, length 0 15:02:23.654904 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3419878, win 4380, length 0 15:02:23.656938 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3421622, win 4380, length 0 15:02:23.657013 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421622:3421726, ack 273720, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.657414 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273720:273761, ack 3421622, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:23.658724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273761:273849, ack 3421726, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.658817 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421726:3421765, ack 273849, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:23.660419 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273849:273894, ack 3421765, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.661115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421765:3421804, ack 273894, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.663533 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 273894:274022, ack 3421804, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.664508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421804:3421943, ack 274022, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.666098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274022:274098, ack 3421943, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.666947 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3421943:3422015, ack 274098, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.668553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274098:274174, ack 3422015, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.669375 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3422015:3422103, ack 274174, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.671044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274174:274302, ack 3422103, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.677656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3422103:3425023, ack 274302, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.677890 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425023:3425523, ack 274302, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:23.680609 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3425023, win 4380, length 0 15:02:23.682015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274302:274347, ack 3425523, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.682686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425523:3425562, ack 274347, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.685084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274347:274455, ack 3425562, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.685996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425562:3425701, ack 274455, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.687589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274455:274531, ack 3425701, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.688428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425701:3425773, ack 274531, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.690044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274531:274607, ack 3425773, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.690127 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425773:3425877, ack 274607, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.691762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274607:274695, ack 3425877, win 4166, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.691844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3425877:3425965, ack 274695, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.694980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274695:274803, ack 3425965, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.698800 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3425965:3427425, ack 274803, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:23.699009 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3427425:3427861, ack 274803, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:23.702531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3427861, win 4380, length 0 15:02:23.702953 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274803:274848, ack 3427861, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.703613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3427861:3427900, ack 274848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.705986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274848:274974, ack 3427900, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.706888 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3427900:3428039, ack 274974, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.708475 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 274974:275050, ack 3428039, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.709312 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3428039:3428111, ack 275050, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.710918 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275050:275126, ack 3428111, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.711733 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3428111:3428199, ack 275126, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.713375 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275126:275252, ack 3428199, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.715490 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3428199:3428899, ack 275252, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:23.723558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275252:275297, ack 3428899, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.724299 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3428899:3428938, ack 275297, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.726687 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275297:275431, ack 3428938, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.727566 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3428938:3429077, ack 275431, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.729171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275431:275507, ack 3429077, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.730000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429077:3429149, ack 275507, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.731596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275507:275583, ack 3429149, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.731962 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429149:3429253, ack 275583, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:23.733581 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275583:275671, ack 3429253, win 4032, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:23.733688 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429253:3429341, ack 275671, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.735369 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275671:275805, ack 3429341, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.736634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429341:3429609, ack 275805, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:23.738338 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275805:275850, ack 3429609, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.739027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429609:3429648, ack 275850, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.741455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275850:275984, ack 3429648, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:23.742332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429648:3429787, ack 275984, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:23.743909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 275984:276060, ack 3429787, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.744808 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429787:3429859, ack 276060, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:23.746411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276060:276136, ack 3429859, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.747245 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429859:3429947, ack 276136, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:23.748921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276136:276270, ack 3429947, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:23.751373 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3429947:3430887, ack 276270, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:23.753390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276270:276315, ack 3430887, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:23.754138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3430887:3430926, ack 276315, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:23.947856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3430926, win 4370, length 0 15:02:24.357679 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2835:2921, ack 2684, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:24.358847 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2684:2784, ack 2921, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:24.368655 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 2921:3007, ack 2784, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:24.369657 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2784:2872, ack 3007, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:24.378902 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3007:3095, ack 2872, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:24.379858 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2872:2972, ack 3095, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:24.383372 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 2972, win 8192, length 0 15:02:24.389948 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3095:3183, ack 2972, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:24.390857 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 2972:3060, ack 3183, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:24.391228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3430926:3431030, ack 276315, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:24.393165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276315:276403, ack 3431030, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:24.400207 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3183:3288, ack 3060, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:24.401024 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3060:3099, ack 3288, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:24.423716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 276403, win 3247, length 0 15:02:24.546988 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 3099, win 8192, length 0 15:02:25.921796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276403:276493, ack 3431030, win 4344, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:25.921911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 276493, win 3247, length 0 15:02:25.922962 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3431030:3431169, ack 276493, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:25.924744 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276493:276573, ack 3431169, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:25.925653 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3431169:3431273, ack 276573, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:25.927176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276573:276653, ack 3431273, win 4283, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:25.928058 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3431273:3431361, ack 276653, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:25.929642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276653:276743, ack 3431361, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:25.938084 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3431361:3435741, ack 276743, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:25.938333 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3435741:3435769, ack 276743, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:25.940975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3434281, win 4380, length 0 15:02:25.942846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3435769, win 4380, length 0 15:02:25.944666 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276743:276833, ack 3435769, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:25.945544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3435769:3435908, ack 276833, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:25.948565 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276833:276878, ack 3435908, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:25.949260 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3435908:3435947, ack 276878, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:25.950856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276878:276968, ack 3435947, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:25.959254 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3435947:3440327, ack 276968, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:25.959502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440327:3440355, ack 276968, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:25.962863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3438867, win 4380, length 0 15:02:25.963984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3440355, win 4380, length 0 15:02:25.964985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 276968:277013, ack 3440355, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:25.965339 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440355:3440459, ack 277013, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.163052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3440459, win 4354, length 0 15:02:26.163153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440459:3440498, ack 277013, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.181015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277013:277101, ack 3440498, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.181868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277101:277219, ack 3440498, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.182111 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 277219, win 3247, length 0 15:02:26.182941 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440498:3440637, ack 277219, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.184573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277219:277295, ack 3440637, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.185442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440637:3440709, ack 277295, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.187185 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277295:277371, ack 3440709, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.188015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3440709:3440797, ack 277371, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.190592 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277371:277489, ack 3440797, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.195280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3440797:3442257, ack 277489, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.195487 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3442257:3442997, ack 277489, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:26.198711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3442997, win 4380, length 0 15:02:26.199092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277489:277534, ack 3442997, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.199766 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3442997:3443036, ack 277534, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.202168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277534:277634, ack 3443036, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.203044 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3443036:3443175, ack 277634, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.204606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277634:277710, ack 3443175, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.205463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3443175:3443247, ack 277710, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.207034 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277710:277786, ack 3443247, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.207858 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3443247:3443335, ack 277786, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.209483 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277786:277886, ack 3443335, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.211238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3443335:3443915, ack 277886, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:26.213189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277886:277931, ack 3443915, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.213575 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3443915:3444019, ack 277931, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.215164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 277931:278019, ack 3444019, win 4124, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.215251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444019:3444058, ack 278019, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.217602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278019:278129, ack 3444058, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.218482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444058:3444197, ack 278129, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.220069 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278129:278205, ack 3444197, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.220905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444197:3444269, ack 278205, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.222465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278205:278281, ack 3444269, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.223274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444269:3444357, ack 278281, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.224879 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278281:278391, ack 3444357, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.226431 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444357:3444853, ack 278391, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:26.229035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278391:278436, ack 3444853, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.229718 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444853:3444892, ack 278436, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.232034 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278436:278540, ack 3444892, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.232894 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3444892:3445031, ack 278540, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.234450 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278540:278616, ack 3445031, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.235347 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3445031:3445103, ack 278616, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.236887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278616:278692, ack 3445103, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.237710 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3445103:3445191, ack 278692, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.239321 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278692:278796, ack 3445191, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.258921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3445191:3455411, ack 278796, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.262661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3448111, win 4380, length 0 15:02:26.262758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3455411:3459791, ack 278796, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:26.264778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3451031, win 4380, length 0 15:02:26.264849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3459791:3461251, ack 278796, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:26.264891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461251:3461591, ack 278796, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:26.266928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3453951, win 4380, length 0 15:02:26.270479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3456871, win 4380, length 0 15:02:26.270928 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3459791, win 4380, length 0 15:02:26.272921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3461591, win 4380, length 0 15:02:26.272986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461591:3461695, ack 278796, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.273378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278796:278837, ack 3461591, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:26.274654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278837:278925, ack 3461695, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.274741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461695:3461734, ack 278925, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:26.276274 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278925:278970, ack 3461734, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.276952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461734:3461773, ack 278970, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.279313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 278970:279080, ack 3461773, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.280197 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461773:3461912, ack 279080, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.281759 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279080:279156, ack 3461912, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.282599 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461912:3461984, ack 279156, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.284142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279156:279232, ack 3461984, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.285013 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3461984:3462072, ack 279232, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.286618 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279232:279342, ack 3462072, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.292716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3462072:3464992, ack 279342, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.292954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3464992:3465460, ack 279342, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:26.295541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3464992, win 4380, length 0 15:02:26.297042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279342:279387, ack 3465460, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.297720 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3465460:3465499, ack 279387, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.300066 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279387:279489, ack 3465499, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.300983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3465499:3465638, ack 279489, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.302541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279489:279565, ack 3465638, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.303383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3465638:3465710, ack 279565, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.304941 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279565:279641, ack 3465710, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.305321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3465710:3465814, ack 279641, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.306899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279641:279729, ack 3465814, win 4174, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.306984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3465814:3465902, ack 279729, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.308632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279729:279831, ack 3465902, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.314105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3465902:3468822, ack 279831, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.314346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3468822:3468914, ack 279831, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:26.316971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3468822, win 4380, length 0 15:02:26.318331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279831:279876, ack 3468914, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.318991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3468914:3468953, ack 279876, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.338443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279876:279972, ack 3468953, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.339337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3468953:3469092, ack 279972, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.341652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 279972:280048, ack 3469092, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.342490 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3469092:3469164, ack 280048, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.344443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280048:280124, ack 3469164, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.345270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3469164:3469252, ack 280124, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.347068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280124:280220, ack 3469252, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.349501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3469252:3470540, ack 280220, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:26.351661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280220:280265, ack 3470540, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.352346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3470540:3470579, ack 280265, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.354693 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280265:280373, ack 3470579, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.355573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3470579:3470718, ack 280373, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.357845 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280373:280449, ack 3470718, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.358708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3470718:3470790, ack 280449, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.360275 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280449:280525, ack 3470790, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.361099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3470790:3470878, ack 280525, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.362696 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280525:280633, ack 3470878, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.363060 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3470878:3470982, ack 280633, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.364649 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280633:280721, ack 3470982, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.366382 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3470982:3472442, ack 280721, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.366577 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3472442:3472450, ack 280721, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:26.368893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3472450, win 4380, length 0 15:02:26.369250 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280721:280766, ack 3472450, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.369887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3472450:3472489, ack 280766, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.372230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280766:280884, ack 3472489, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.373111 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3472489:3472628, ack 280884, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.374662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280884:280960, ack 3472628, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.375523 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3472628:3472700, ack 280960, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.377065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 280960:281036, ack 3472700, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.377931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3472700:3472788, ack 281036, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.379545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281036:281154, ack 3472788, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.385027 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3472788:3474248, ack 281154, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.385232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3474248:3475556, ack 281154, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:26.387784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3475556, win 4380, length 0 15:02:26.388242 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281154:281199, ack 3475556, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.388891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3475556:3475595, ack 281199, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.391243 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281199:281301, ack 3475595, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.392110 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3475595:3475734, ack 281301, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.393686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281301:281377, ack 3475734, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.394648 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3475734:3475806, ack 281377, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.396183 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281377:281453, ack 3475806, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.396995 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3475806:3475894, ack 281453, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.398617 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281453:281555, ack 3475894, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.398987 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3475894:3475998, ack 281555, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.401221 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281555:281643, ack 3475998, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.412906 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3475998:3483298, ack 281643, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.413164 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483298:3483486, ack 281643, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:26.415815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3478918, win 4380, length 0 15:02:26.418566 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3481838, win 4380, length 0 15:02:26.419768 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3483486, win 4380, length 0 15:02:26.420209 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281643:281688, ack 3483486, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.420903 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483486:3483525, ack 281688, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.423234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281688:281790, ack 3483525, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.424177 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483525:3483664, ack 281790, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.426406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281790:281866, ack 3483664, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.427256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483664:3483736, ack 281866, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.428860 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281866:281942, ack 3483736, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.429671 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483736:3483824, ack 281942, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.431281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 281942:282044, ack 3483824, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.433236 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3483824:3484544, ack 282044, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:26.441269 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282044:282089, ack 3484544, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.442226 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3484544:3484583, ack 282089, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.444599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282089:282215, ack 3484583, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.445570 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3484583:3484722, ack 282215, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.447136 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282215:282291, ack 3484722, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.448030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3484722:3484794, ack 282291, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.449596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282291:282367, ack 3484794, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.450425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3484794:3484882, ack 282367, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.452037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282367:282493, ack 3484882, win 4031, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.452418 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3484882:3484986, ack 282493, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.454020 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282493:282581, ack 3484986, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.479160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3484986:3499586, ack 282581, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.487283 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3487906, win 4380, length 0 15:02:26.487750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3490826, win 4380, length 0 15:02:26.487829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3499586:3501046, ack 282581, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:26.487875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3501046:3501290, ack 282581, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:26.488168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3493746, win 4380, length 0 15:02:26.491014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3496666, win 4380, length 0 15:02:26.492379 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3499586, win 4380, length 0 15:02:26.495091 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3501290, win 4380, length 0 15:02:26.495727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282581:282741, ack 3501290, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.522034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3501290:3517350, ack 282741, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.522387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3517350:3517710, ack 282741, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:26.525670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3504210, win 4380, length 0 15:02:26.531555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3507130, win 4380, length 0 15:02:26.535459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3510050, win 4380, length 0 15:02:26.538420 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3512970, win 4380, length 0 15:02:26.540615 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3515890, win 4380, length 0 15:02:26.543276 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3517710, win 4380, length 0 15:02:26.543840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282741:282857, ack 3517710, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.569509 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3517710:3533770, ack 282857, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.569860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3533770:3534054, ack 282857, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:26.575103 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3520630, win 4380, length 0 15:02:26.579013 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3523550, win 4380, length 0 15:02:26.582732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3526470, win 4380, length 0 15:02:26.587754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3529390, win 4380, length 0 15:02:26.592881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3532310, win 4380, length 0 15:02:26.593227 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3534054, win 4380, length 0 15:02:26.593727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282857:282898, ack 3534054, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:26.594613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534054:3534093, ack 282898, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:26.596725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282898:282943, ack 3534093, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.596810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534093:3534197, ack 282943, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.598375 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 282943:283031, ack 3534197, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.598456 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534197:3534236, ack 283031, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.600919 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283031:283159, ack 3534236, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.601818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534236:3534375, ack 283159, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.603378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283159:283235, ack 3534375, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.604283 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534375:3534447, ack 283235, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.605826 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283235:283311, ack 3534447, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.606662 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3534447:3534535, ack 283311, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.608296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283311:283439, ack 3534535, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.614862 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3534535:3537455, ack 283439, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.615091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3537455:3537955, ack 283439, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:26.618683 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3537455, win 4380, length 0 15:02:26.620142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283439:283484, ack 3537955, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.620809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3537955:3537994, ack 283484, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.623149 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283484:283592, ack 3537994, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.624085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3537994:3538133, ack 283592, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.625635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283592:283668, ack 3538133, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.626474 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3538133:3538205, ack 283668, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.628020 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283668:283744, ack 3538205, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.628835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3538205:3538293, ack 283744, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.630493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283744:283852, ack 3538293, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.634405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3538293:3539753, ack 283852, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:26.634610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3539753:3540189, ack 283852, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:26.637811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3540189, win 4380, length 0 15:02:26.637915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540189:3540293, ack 283852, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.638269 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283852:283897, ack 3540189, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.639503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283897:283985, ack 3540293, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.639591 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540293:3540332, ack 283985, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.641954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 283985:284111, ack 3540332, win 4344, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.642843 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540332:3540471, ack 284111, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.644400 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284111:284187, ack 3540471, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.645263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540471:3540543, ack 284187, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.646815 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284187:284263, ack 3540543, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.647629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540543:3540631, ack 284263, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.649255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284263:284389, ack 3540631, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.651275 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3540631:3541331, ack 284389, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:26.659120 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284389:284434, ack 3541331, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.659824 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541331:3541370, ack 284434, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.662170 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284434:284568, ack 3541370, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.663090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541370:3541509, ack 284568, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.665753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284568:284644, ack 3541509, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.666614 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541509:3541581, ack 284644, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.668168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284644:284720, ack 3541581, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.668986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541581:3541669, ack 284720, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.670632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284720:284854, ack 3541669, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.671880 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541669:3541937, ack 284854, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:26.673545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284854:284899, ack 3541937, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.674279 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541937:3541976, ack 284899, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.676698 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 284899:285033, ack 3541976, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:26.677081 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3541976:3542080, ack 285033, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:26.678730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285033:285121, ack 3542080, win 4277, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:26.678819 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3542080:3542219, ack 285121, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:26.680421 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285121:285197, ack 3542219, win 4242, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.681257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3542219:3542291, ack 285197, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:26.683461 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285197:285273, ack 3542291, win 4224, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.684328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3542291:3542379, ack 285273, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:26.685937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285273:285407, ack 3542379, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:26.688432 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3542379:3543319, ack 285407, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:26.690428 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285407:285452, ack 3543319, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:26.691109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3543319:3543358, ack 285452, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:26.880606 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3543358, win 4370, length 0 15:02:27.410402 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3288:3347, ack 3099, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:27.411095 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3099:3158, ack 3347, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:27.496158 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 3158, win 8192, length 0 15:02:28.215322 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285452:285542, ack 3543358, win 4370, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.219383 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3543358:3543497, ack 285542, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.221218 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285542:285622, ack 3543497, win 4335, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.222115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3543497:3543601, ack 285622, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:28.224302 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285622:285702, ack 3543601, win 4309, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.225169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3543601:3543689, ack 285702, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.226723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285702:285792, ack 3543689, win 4287, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.235252 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3543689:3548069, ack 285792, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.235500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3548069:3548097, ack 285792, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:28.238852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3546609, win 4380, length 0 15:02:28.242763 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3548097, win 4380, length 0 15:02:28.244910 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285792:285882, ack 3548097, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.245526 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3548097:3548201, ack 285882, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.440646 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3548201, win 4354, length 0 15:02:28.440746 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3548201:3548340, ack 285882, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.443210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285882:285970, ack 3548340, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.473719 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 285970, win 3247, length 0 15:02:28.475385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 285970:286060, ack 3548340, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.475447 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 286060, win 3247, length 0 15:02:28.483870 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3548340:3552720, ack 286060, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.484116 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3552720:3552748, ack 286060, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:28.489796 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3551260, win 4380, length 0 15:02:28.491685 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3552748, win 4380, length 0 15:02:28.492124 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286060:286105, ack 3552748, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.492814 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3552748:3552787, ack 286105, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.494539 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286105:286150, ack 3552787, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.495236 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3552787:3552826, ack 286150, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.497518 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286150:286268, ack 3552826, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.498409 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3552826:3552965, ack 286268, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.500107 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286268:286344, ack 3552965, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.500938 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3552965:3553037, ack 286344, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.502636 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286344:286420, ack 3553037, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.503446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3553037:3553125, ack 286420, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.505258 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286420:286538, ack 3553125, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.510032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3553125:3554585, ack 286538, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.510249 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3554585:3555325, ack 286538, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:28.512873 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3555325, win 4380, length 0 15:02:28.513277 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286538:286583, ack 3555325, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.514263 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555325:3555364, ack 286583, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.516514 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286583:286683, ack 3555364, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.516606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555364:3555468, ack 286683, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.518256 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286683:286771, ack 3555468, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.518343 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555468:3555607, ack 286771, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.520407 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286771:286847, ack 3555607, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.521259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555607:3555679, ack 286847, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.522819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286847:286923, ack 3555679, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.523743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555679:3555767, ack 286923, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.525344 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 286923:287023, ack 3555767, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.527090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3555767:3556347, ack 287023, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:28.529620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287023:287068, ack 3556347, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.530307 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3556347:3556386, ack 287068, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.532568 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287068:287178, ack 3556386, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.533439 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3556386:3556525, ack 287178, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.535005 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287178:287254, ack 3556525, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.535866 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3556525:3556597, ack 287254, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.537416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287254:287330, ack 3556597, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.538246 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3556597:3556685, ack 287330, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.539871 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287330:287440, ack 3556685, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.541416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3556685:3557181, ack 287440, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:28.543196 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287440:287485, ack 3557181, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.543943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3557181:3557220, ack 287485, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.546185 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287485:287589, ack 3557220, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.547089 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3557220:3557359, ack 287589, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.548665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287589:287665, ack 3557359, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.549498 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3557359:3557431, ack 287665, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.551114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287665:287741, ack 3557431, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.551195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3557431:3557535, ack 287741, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.552769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287741:287829, ack 3557535, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.552848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3557535:3557623, ack 287829, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.554495 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287829:287933, ack 3557623, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.574170 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3557623:3567843, ack 287933, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.582784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3560543, win 4380, length 0 15:02:28.582882 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3567843:3572223, ack 287933, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:28.583114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3563463, win 4380, length 0 15:02:28.583186 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3572223:3573683, ack 287933, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:28.583228 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3573683:3574023, ack 287933, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:28.586008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3566383, win 4380, length 0 15:02:28.590521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3569303, win 4380, length 0 15:02:28.594673 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3572223, win 4380, length 0 15:02:28.597681 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3574023, win 4380, length 0 15:02:28.598133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287933:287974, ack 3574023, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:28.598977 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3574023:3574062, ack 287974, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:28.600520 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 287974:288019, ack 3574062, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.601207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3574062:3574101, ack 288019, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.603607 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288019:288129, ack 3574101, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.604577 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3574101:3574240, ack 288129, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.606134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288129:288205, ack 3574240, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.607017 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3574240:3574312, ack 288205, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.610851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288205:288281, ack 3574312, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.611664 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3574312:3574400, ack 288281, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.614912 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288281:288391, ack 3574400, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.621019 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3574400:3577320, ack 288391, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.621358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3577320:3577788, ack 288391, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:28.626908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3577320, win 4380, length 0 15:02:28.628490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288391:288436, ack 3577788, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.628561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3577788:3577892, ack 288436, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.630190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288436:288524, ack 3577892, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.630274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3577892:3577931, ack 288524, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.633180 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288524:288626, ack 3577931, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.634119 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3577931:3578070, ack 288626, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.635677 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288626:288702, ack 3578070, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.636525 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3578070:3578142, ack 288702, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.638096 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288702:288778, ack 3578142, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.639940 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3578142:3578230, ack 288778, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.641590 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288778:288880, ack 3578230, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.647232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3578230:3581150, ack 288880, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.647475 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581150:3581242, ack 288880, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:28.651731 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3581150, win 4380, length 0 15:02:28.653079 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288880:288925, ack 3581242, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.653795 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581242:3581281, ack 288925, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.656852 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 288925:289021, ack 3581281, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.657750 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581281:3581420, ack 289021, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.660036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289021:289097, ack 3581420, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.660872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581420:3581492, ack 289097, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.662460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289097:289173, ack 3581492, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.663274 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581492:3581580, ack 289173, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.664879 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289173:289269, ack 3581580, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.667336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3581580:3582868, ack 289269, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:28.671562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289269:289314, ack 3582868, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.671646 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3582868:3582972, ack 289314, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.673808 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289314:289402, ack 3582972, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.673895 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3582972:3583011, ack 289402, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.677084 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289402:289510, ack 3583011, win 4344, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.677963 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3583011:3583150, ack 289510, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.679551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289510:289586, ack 3583150, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.680382 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3583150:3583222, ack 289586, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.681935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289586:289662, ack 3583222, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.682749 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3583222:3583310, ack 289662, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.684367 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289662:289770, ack 3583310, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.687356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3583310:3584770, ack 289770, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.687561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3584770:3584778, ack 289770, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:28.692776 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3584778, win 4380, length 0 15:02:28.693204 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289770:289815, ack 3584778, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.693910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3584778:3584817, ack 289815, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.696829 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289815:289933, ack 3584817, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.697724 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3584817:3584956, ack 289933, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.699913 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 289933:290009, ack 3584956, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.700815 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3584956:3585028, ack 290009, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.702378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290009:290085, ack 3585028, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.703205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3585028:3585116, ack 290085, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.706394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290085:290203, ack 3585116, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.711825 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3585116:3586576, ack 290203, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.712030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3586576:3587884, ack 290203, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:28.718522 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3587884, win 4380, length 0 15:02:28.718613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3587884:3587988, ack 290203, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.736670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290203:290248, ack 3587988, win 4354, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.737364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3587988:3588027, ack 290248, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.743558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290248:290336, ack 3588027, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.744431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290336:290438, ack 3588027, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.744656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 290438, win 3247, length 0 15:02:28.745458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3588027:3588166, ack 290438, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.749012 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290438:290514, ack 3588166, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.749847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3588166:3588238, ack 290514, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.752124 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290514:290590, ack 3588238, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.753113 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3588238:3588326, ack 290590, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.754933 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290590:290692, ack 3588326, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.768645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3588326:3595626, ack 290692, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.768915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3595626:3595814, ack 290692, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:28.774105 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3591246, win 4380, length 0 15:02:28.780455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3594166, win 4380, length 0 15:02:28.784692 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3595814, win 4380, length 0 15:02:28.785191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290692:290737, ack 3595814, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.785871 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3595814:3595853, ack 290737, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.789594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290737:290839, ack 3595853, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.790485 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3595853:3595992, ack 290839, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.793509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290839:290915, ack 3595992, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.794392 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3595992:3596064, ack 290915, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.796631 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290915:290991, ack 3596064, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.797456 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3596064:3596152, ack 290991, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.800624 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 290991:291093, ack 3596152, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.800998 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3596152:3596256, ack 291093, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.803115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291093:291181, ack 3596256, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.803207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3596256:3596976, ack 291181, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:28.812026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291181:291226, ack 3596976, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:28.812708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3596976:3597015, ack 291226, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:28.817017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291226:291352, ack 3597015, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:28.817939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3597015:3597154, ack 291352, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:28.820183 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291352:291428, ack 3597154, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.821021 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3597154:3597226, ack 291428, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:28.823294 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291428:291504, ack 3597226, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.824166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3597226:3597314, ack 291504, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:28.826356 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291504:291630, ack 3597314, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.852683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3597314:3611914, ack 291630, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.859861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3600234, win 4380, length 0 15:02:28.865448 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3603154, win 4380, length 0 15:02:28.865523 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3611914:3613374, ack 291630, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:28.865566 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3613374:3613618, ack 291630, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:28.874582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3606074, win 4380, length 0 15:02:28.880281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3608994, win 4380, length 0 15:02:28.883599 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3611914, win 4380, length 0 15:02:28.890016 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3613618, win 4380, length 0 15:02:28.899293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291630:291790, ack 3613618, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.925767 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3613618:3629678, ack 291790, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.926119 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3629678:3630038, ack 291790, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:28.934346 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3616538, win 4380, length 0 15:02:28.938102 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3619458, win 4380, length 0 15:02:28.944388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3622378, win 4380, length 0 15:02:28.950174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3625298, win 4380, length 0 15:02:28.958401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3628218, win 4380, length 0 15:02:28.961058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3630038, win 4380, length 0 15:02:28.961136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3630038:3630142, ack 291790, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:28.961727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291790:291906, ack 3630038, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:28.964354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291906:291994, ack 3630142, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:28.987572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3630142:3646202, ack 291994, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:28.987914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646202:3646486, ack 291994, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:28.993326 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3633062, win 4380, length 0 15:02:28.999440 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3635982, win 4380, length 0 15:02:29.006541 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3638902, win 4380, length 0 15:02:29.010661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3641822, win 4380, length 0 15:02:29.016395 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3644742, win 4380, length 0 15:02:29.023189 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3646486, win 4380, length 0 15:02:29.023664 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 291994:292035, ack 3646486, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:29.024564 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646486:3646525, ack 292035, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:29.026772 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292035:292080, ack 3646525, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.027463 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646525:3646564, ack 292080, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.030516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292080:292208, ack 3646564, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.031415 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646564:3646703, ack 292208, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:29.034317 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292208:292284, ack 3646703, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.035214 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646703:3646775, ack 292284, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:29.037384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292284:292360, ack 3646775, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.038205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3646775:3646863, ack 292360, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.039847 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292360:292488, ack 3646863, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.046386 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3646863:3649783, ack 292488, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:29.046624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3649783:3650283, ack 292488, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:29.053518 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3649783, win 4380, length 0 15:02:29.056635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292488:292533, ack 3650283, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.057351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3650283:3650322, ack 292533, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.059829 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292533:292641, ack 3650322, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.059911 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3650322:3650426, ack 292641, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:29.062070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292641:292729, ack 3650426, win 4219, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:29.062154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3650426:3650565, ack 292729, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:29.064414 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292729:292805, ack 3650565, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.065369 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3650565:3650637, ack 292805, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:29.067647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292805:292881, ack 3650637, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.068478 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3650637:3650725, ack 292881, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.071612 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292881:292989, ack 3650725, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.075455 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3650725:3652185, ack 292989, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:29.075658 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652185:3652621, ack 292989, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:29.080585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3652621, win 4380, length 0 15:02:29.081000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 292989:293034, ack 3652621, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.081700 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652621:3652660, ack 293034, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.084653 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293034:293160, ack 3652660, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.085555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652660:3652799, ack 293160, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:29.088562 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293160:293236, ack 3652799, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.089404 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652799:3652871, ack 293236, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:29.091661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293236:293312, ack 3652871, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.092476 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652871:3652959, ack 293312, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.094940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293312:293438, ack 3652959, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.096964 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3652959:3653659, ack 293438, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:29.106392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293438:293483, ack 3653659, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.107090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3653659:3653698, ack 293483, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.110161 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293483:293617, ack 3653698, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.110528 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3653698:3653802, ack 293617, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:29.112694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293617:293705, ack 3653802, win 4084, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:29.112780 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3653802:3653941, ack 293705, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:29.114866 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293705:293781, ack 3653941, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.115762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3653941:3654013, ack 293781, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:29.118935 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293781:293857, ack 3654013, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.119764 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654013:3654101, ack 293857, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.123397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293857:293991, ack 3654101, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.124702 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654101:3654369, ack 293991, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:29.126985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 293991:294036, ack 3654369, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.127678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654369:3654408, ack 294036, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.130806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294036:294170, ack 3654408, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.131685 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654408:3654547, ack 294170, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:29.133892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294170:294246, ack 3654547, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.134750 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654547:3654619, ack 294246, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:29.136820 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294246:294322, ack 3654619, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.137635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654619:3654707, ack 294322, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.139278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294322:294456, ack 3654707, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.141754 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3654707:3655647, ack 294456, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:29.145519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294456:294501, ack 3655647, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:29.146229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3655647:3655686, ack 294501, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:29.345427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3655686, win 4370, length 0 15:02:29.377290 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3347:3433, ack 3158, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.378389 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3158:3258, ack 3433, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:29.387815 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3433:3519, ack 3258, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.388766 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3258:3346, ack 3519, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.398016 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3519:3607, ack 3346, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.399083 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3346:3446, ack 3607, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:29.399426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3655686:3655790, ack 294501, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:29.401249 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294501:294589, ack 3655790, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:29.408909 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3607:3695, ack 3446, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:29.409885 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3446:3534, ack 3695, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:29.419244 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3695:3800, ack 3534, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:29.420038 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3534:3573, ack 3800, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:29.433714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 294589, win 3247, length 0 15:02:29.462269 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 3573, win 8192, length 0 15:02:30.932874 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294589:294669, ack 3655790, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:30.932984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 294669, win 3247, length 0 15:02:30.934046 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3655790:3655894, ack 294669, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:31.012572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294669:294749, ack 3655894, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.013635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3655894:3655982, ack 294749, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.015700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294749:294839, ack 3655982, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.016624 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3655982:3656121, ack 294839, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.018574 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294839:294929, ack 3656121, win 4261, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.027099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3656121:3660501, ack 294929, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.027343 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3660501:3660529, ack 294929, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:31.032085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3659041, win 4380, length 0 15:02:31.032551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3660529, win 4380, length 0 15:02:31.052700 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 294929:295019, ack 3660529, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.053929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3660529:3660668, ack 295019, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.055859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295019:295109, ack 3660668, win 4345, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.064379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3660668:3665048, ack 295109, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.064735 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665048:3665076, ack 295109, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:31.070753 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3663588, win 4380, length 0 15:02:31.073554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3665076, win 4380, length 0 15:02:31.073635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665076:3665180, ack 295109, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.073998 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295109:295154, ack 3665076, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.113711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 295154, win 3247, length 0 15:02:31.264274 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3665180, win 4354, length 0 15:02:31.264351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665180:3665219, ack 295154, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.266129 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295154:295242, ack 3665219, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.266336 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 295242, win 3247, length 0 15:02:31.273000 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295242:295287, ack 3665219, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.273232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 295287, win 3247, length 0 15:02:31.273876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665219:3665258, ack 295287, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.278736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295287:295405, ack 3665258, win 4334, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.279639 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665258:3665397, ack 295405, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.283178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295405:295481, ack 3665397, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.284073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665397:3665469, ack 295481, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.285846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295481:295557, ack 3665469, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.286677 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3665469:3665557, ack 295557, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.288378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295557:295675, ack 3665557, win 4259, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.292902 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3665557:3667017, ack 295675, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.293109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3667017:3667757, ack 295675, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:31.296557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3667757, win 4380, length 0 15:02:31.297063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295675:295720, ack 3667757, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.297734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3667757:3667796, ack 295720, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.301025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295720:295820, ack 3667796, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.301890 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3667796:3667935, ack 295820, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.303512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295820:295896, ack 3667935, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.304390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3667935:3668007, ack 295896, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.305977 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295896:295972, ack 3668007, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.306354 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668007:3668111, ack 295972, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.307997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 295972:296060, ack 3668111, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.308081 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668111:3668199, ack 296060, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.309811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296060:296160, ack 3668199, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.311553 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668199:3668779, ack 296160, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:31.314164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296160:296205, ack 3668779, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.314858 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668779:3668818, ack 296205, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.317270 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296205:296315, ack 3668818, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.318142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668818:3668957, ack 296315, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.319761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296315:296391, ack 3668957, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.320590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3668957:3669029, ack 296391, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.322186 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296391:296467, ack 3669029, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.322994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669029:3669117, ack 296467, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.324790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296467:296577, ack 3669117, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.326345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669117:3669613, ack 296577, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:31.328197 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296577:296622, ack 3669613, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.328885 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669613:3669652, ack 296622, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.331295 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296622:296726, ack 3669652, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.332154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669652:3669791, ack 296726, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.333756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296726:296802, ack 3669791, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.334606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669791:3669863, ack 296802, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.338838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296802:296878, ack 3669863, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.339694 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3669863:3669951, ack 296878, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.341980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296878:296982, ack 3669951, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.361584 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3669951:3680171, ack 296982, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.366413 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3672871, win 4380, length 0 15:02:31.366515 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3680171:3684551, ack 296982, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:31.370353 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3675791, win 4380, length 0 15:02:31.370425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3684551:3686011, ack 296982, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:31.370467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686011:3686455, ack 296982, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:02:31.372445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3678711, win 4380, length 0 15:02:31.383147 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3681631, win 4380, length 0 15:02:31.383511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3684551, win 4380, length 0 15:02:31.385575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3686455, win 4380, length 0 15:02:31.386089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 296982:297023, ack 3686455, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:31.386648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297023:297111, ack 3686455, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.387126 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686455:3686494, ack 297111, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:31.389359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297111:297156, ack 3686494, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.390042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686494:3686533, ack 297156, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.393061 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297156:297266, ack 3686533, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.394000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686533:3686672, ack 297266, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.395604 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297266:297342, ack 3686672, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.396450 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686672:3686744, ack 297342, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.398801 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297342:297418, ack 3686744, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.399613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3686744:3686832, ack 297418, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.401292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297418:297528, ack 3686832, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.407503 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3686832:3689752, ack 297528, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.407748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3689752:3690220, ack 297528, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:31.413576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3689752, win 4380, length 0 15:02:31.413974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297528:297573, ack 3690220, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.414650 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3690220:3690259, ack 297573, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.417062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297573:297675, ack 3690259, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.417950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3690259:3690398, ack 297675, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.420426 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297675:297751, ack 3690398, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.420507 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3690398:3690502, ack 297751, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.423781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297751:297839, ack 3690502, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.423867 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3690502:3690574, ack 297839, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.425563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297839:297915, ack 3690574, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.426384 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3690574:3690662, ack 297915, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.428652 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 297915:298017, ack 3690662, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.434068 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3690662:3693582, ack 298017, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.434301 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3693582:3693674, ack 298017, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:31.439099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3693582, win 4380, length 0 15:02:31.439578 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298017:298062, ack 3693674, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.440276 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3693674:3693713, ack 298062, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.442711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298062:298158, ack 3693713, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.443579 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3693713:3693852, ack 298158, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.445936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298158:298234, ack 3693852, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.446783 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3693852:3693924, ack 298234, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.448371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298234:298310, ack 3693924, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.449187 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3693924:3694012, ack 298310, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.450845 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298310:298406, ack 3694012, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.453293 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3694012:3695300, ack 298406, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:31.456270 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298406:298451, ack 3695300, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.456975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3695300:3695339, ack 298451, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.459370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298451:298559, ack 3695339, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.460240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3695339:3695478, ack 298559, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.461856 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298559:298635, ack 3695478, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.462229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3695478:3695582, ack 298635, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.463894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298635:298723, ack 3695582, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.463979 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3695582:3695654, ack 298723, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.465596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298723:298799, ack 3695654, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.466436 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3695654:3695742, ack 298799, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.468909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298799:298907, ack 3695742, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.471887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3695742:3697202, ack 298907, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.472092 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3697202:3697210, ack 298907, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:31.474463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3697210, win 4380, length 0 15:02:31.474951 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298907:298952, ack 3697210, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.475629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3697210:3697249, ack 298952, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.478720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 298952:299070, ack 3697249, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.479756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3697249:3697388, ack 299070, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.481390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299070:299146, ack 3697388, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.482224 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3697388:3697460, ack 299146, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.503200 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299146:299222, ack 3697460, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.504082 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3697460:3697548, ack 299222, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.505936 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299222:299340, ack 3697548, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.511381 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3697548:3699008, ack 299340, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.511594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3699008:3700316, ack 299340, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:31.515078 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3700316, win 4380, length 0 15:02:31.515462 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299340:299385, ack 3700316, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.516127 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3700316:3700355, ack 299385, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.518555 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299385:299487, ack 3700355, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.519426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3700355:3700494, ack 299487, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.521058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299487:299563, ack 3700494, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.521438 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3700494:3700598, ack 299563, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.523083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299563:299651, ack 3700598, win 4309, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.523165 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3700598:3700670, ack 299651, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.524786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299651:299727, ack 3700670, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.525626 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3700670:3700758, ack 299727, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.527281 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299727:299829, ack 3700758, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.540852 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3700758:3708058, ack 299829, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.541122 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708058:3708246, ack 299829, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:31.544765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3703678, win 4380, length 0 15:02:31.548878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3706598, win 4380, length 0 15:02:31.552466 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3708246, win 4380, length 0 15:02:31.552953 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299829:299874, ack 3708246, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.553630 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708246:3708285, ack 299874, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.556042 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299874:299976, ack 3708285, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.556990 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708285:3708424, ack 299976, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.559150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 299976:300052, ack 3708424, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.559984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708424:3708496, ack 300052, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.563597 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300052:300128, ack 3708496, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.564475 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708496:3708584, ack 300128, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.566940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300128:300230, ack 3708584, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.568897 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3708584:3709304, ack 300230, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:31.577296 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300230:300275, ack 3709304, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.577991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3709304:3709343, ack 300275, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.581117 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300275:300401, ack 3709343, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.581991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3709343:3709482, ack 300401, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.583595 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300401:300477, ack 3709482, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.584001 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3709482:3709586, ack 300477, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.585661 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300477:300565, ack 3709586, win 4045, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.585747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3709586:3709658, ack 300565, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.587370 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300565:300641, ack 3709658, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.588227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3709658:3709746, ack 300641, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.589913 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300641:300767, ack 3709746, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.616227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3709746:3724346, ack 300767, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.619155 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3712666, win 4380, length 0 15:02:31.622152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3715586, win 4380, length 0 15:02:31.622227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3724346:3725806, ack 300767, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:31.622270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3725806:3726050, ack 300767, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:31.626246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3718506, win 4380, length 0 15:02:31.630878 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3721426, win 4380, length 0 15:02:31.636824 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3724346, win 4380, length 0 15:02:31.637243 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3726050, win 4380, length 0 15:02:31.637843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300767:300927, ack 3726050, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.665282 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3726050:3742110, ack 300927, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.665645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3742110:3742470, ack 300927, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:31.668340 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3728970, win 4380, length 0 15:02:31.672473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3731890, win 4380, length 0 15:02:31.676601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3734810, win 4380, length 0 15:02:31.680616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3737730, win 4380, length 0 15:02:31.688573 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3740650, win 4380, length 0 15:02:31.689037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3742470, win 4380, length 0 15:02:31.689438 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 300927:301043, ack 3742470, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.714941 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3742470:3758530, ack 301043, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.715293 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3758530:3758814, ack 301043, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:31.719361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3745390, win 4380, length 0 15:02:31.725798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3748310, win 4380, length 0 15:02:31.726311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3751230, win 4380, length 0 15:02:31.730427 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3754150, win 4380, length 0 15:02:31.732602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3757070, win 4380, length 0 15:02:31.735974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3758814, win 4380, length 0 15:02:31.736045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3758814:3758918, ack 301043, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.736480 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301043:301084, ack 3758814, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:31.737802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301084:301172, ack 3758918, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.737889 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3758918:3758957, ack 301172, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:31.739484 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301172:301217, ack 3758957, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.740169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3758957:3758996, ack 301217, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.742629 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301217:301345, ack 3758996, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.743534 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3758996:3759135, ack 301345, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.745172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301345:301421, ack 3759135, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.746033 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3759135:3759207, ack 301421, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.747649 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301421:301497, ack 3759207, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.748472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3759207:3759295, ack 301497, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.750924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301497:301625, ack 3759295, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.757459 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3759295:3762215, ack 301625, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.757693 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3762215:3762715, ack 301625, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:31.761508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3762215, win 4380, length 0 15:02:31.761992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301625:301670, ack 3762715, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.762657 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3762715:3762754, ack 301670, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.765193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301670:301778, ack 3762754, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.766085 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3762754:3762893, ack 301778, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.767694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301778:301854, ack 3762893, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.768536 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3762893:3762965, ack 301854, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.771057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301854:301930, ack 3762965, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.771905 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3762965:3763053, ack 301930, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.780827 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 301930:302038, ack 3763053, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.780910 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3763053:3763157, ack 302038, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.784777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3763157:3764617, ack 302038, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:31.788101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3764617, win 4380, length 0 15:02:31.788193 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3764617:3765053, ack 302038, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:31.803017 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302038:302126, ack 3765053, win 4271, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.803420 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302126:302171, ack 3765053, win 4271, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.804074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 302171, win 3247, length 0 15:02:31.804676 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3765053:3765092, ack 302171, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.807224 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302171:302297, ack 3765092, win 4261, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.808121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3765092:3765231, ack 302297, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.809736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302297:302373, ack 3765231, win 4226, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.810567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3765231:3765303, ack 302373, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.812708 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302373:302449, ack 3765303, win 4208, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.813566 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3765303:3765391, ack 302449, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.815230 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302449:302575, ack 3765391, win 4186, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.817257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3765391:3766091, ack 302575, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:31.826021 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302575:302620, ack 3766091, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.826723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766091:3766130, ack 302620, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.874311 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302620:302754, ack 3766130, win 4370, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.875218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766130:3766269, ack 302754, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.876962 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302754:302830, ack 3766269, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.877810 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766269:3766341, ack 302830, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.879605 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302830:302906, ack 3766341, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.880426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766341:3766429, ack 302906, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.882306 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 302906:303040, ack 3766429, win 4295, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.882673 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766429:3766533, ack 303040, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:31.919909 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303040:303128, ack 3766533, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:31.920000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766533:3766801, ack 303128, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:31.963328 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303128:303173, ack 3766801, win 4202, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.964075 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766801:3766840, ack 303173, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:31.966812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303173:303307, ack 3766840, win 4192, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:31.967705 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766840:3766979, ack 303307, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:31.969348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303307:303383, ack 3766979, win 4158, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.970186 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3766979:3767051, ack 303383, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:31.971806 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303383:303459, ack 3767051, win 4140, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.972914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3767051:3767139, ack 303459, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:31.974576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303459:303593, ack 3767139, win 4118, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:31.977230 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3767139:3768079, ack 303593, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:31.980026 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303593:303638, ack 3768079, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:31.980767 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768079:3768118, ack 303638, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:32.184616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3768118, win 4370, length 0 15:02:32.429439 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3800:3859, ack 3573, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:32.430076 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3573:3632, ack 3859, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:32.575281 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 3632, win 8192, length 0 15:02:33.456176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303638:303718, ack 3768118, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.460516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768118:3768222, ack 303718, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:33.462332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303718:303798, ack 3768222, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.463218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768222:3768310, ack 303798, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.464892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303798:303878, ack 3768310, win 4322, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.465753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768310:3768414, ack 303878, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:33.467301 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303878:303958, ack 3768414, win 4296, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.468167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768414:3768502, ack 303958, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.469809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 303958:304048, ack 3768502, win 4274, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.469891 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768502:3768606, ack 304048, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.666603 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3768606, win 4248, length 0 15:02:33.666716 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3768606:3768745, ack 304048, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.668633 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304048:304136, ack 3768745, win 4213, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.703725 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 304136, win 3247, length 0 15:02:33.705302 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304136:304226, ack 3768745, win 4213, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.705366 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 304226, win 3247, length 0 15:02:33.713851 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3768745:3773125, ack 304226, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.714098 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3773125:3773153, ack 304226, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:33.716803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3771665, win 4380, length 0 15:02:33.718773 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3773153, win 4380, length 0 15:02:33.720622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304226:304316, ack 3773153, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.721498 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3773153:3773292, ack 304316, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.723438 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304316:304361, ack 3773292, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.724179 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3773292:3773331, ack 304361, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.725854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304361:304451, ack 3773331, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.734260 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3773331:3777711, ack 304451, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.734501 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3777711:3777739, ack 304451, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:33.738068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3776251, win 4380, length 0 15:02:33.739964 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3777739, win 4380, length 0 15:02:33.746745 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304451:304496, ack 3777739, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.747428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3777739:3777778, ack 304496, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.749807 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304496:304614, ack 3777778, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.750699 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3777778:3777917, ack 304614, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.752297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304614:304690, ack 3777917, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.753141 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3777917:3777989, ack 304690, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.754716 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304690:304766, ack 3777989, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.754801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3777989:3778093, ack 304766, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.756431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304766:304854, ack 3778093, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.756513 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3778093:3778181, ack 304854, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.758184 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304854:304972, ack 3778181, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.762677 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3778181:3779641, ack 304972, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.762884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3779641:3780381, ack 304972, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:33.765354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3780381, win 4380, length 0 15:02:33.765726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 304972:305017, ack 3780381, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.766402 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3780381:3780420, ack 305017, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.768774 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305017:305117, ack 3780420, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.769642 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3780420:3780559, ack 305117, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.771265 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305117:305193, ack 3780559, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.772100 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3780559:3780631, ack 305193, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.773689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305193:305269, ack 3780631, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.774562 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3780631:3780719, ack 305269, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.777224 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305269:305369, ack 3780719, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.778929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3780719:3781299, ack 305369, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:33.780837 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305369:305414, ack 3781299, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.781519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781299:3781338, ack 305414, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.783875 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305414:305524, ack 3781338, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.784753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781338:3781477, ack 305524, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.786341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305524:305600, ack 3781477, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.787180 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781477:3781549, ack 305600, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.788765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305600:305676, ack 3781549, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.789572 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781549:3781637, ack 305676, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.791943 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305676:305786, ack 3781637, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.792022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781637:3781741, ack 305786, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.794207 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305786:305874, ack 3781741, win 4040, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.794298 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3781741:3782237, ack 305874, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:33.796142 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305874:305919, ack 3782237, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.796863 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3782237:3782276, ack 305919, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.799769 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 305919:306023, ack 3782276, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.800641 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3782276:3782415, ack 306023, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.802267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306023:306099, ack 3782415, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.803106 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3782415:3782487, ack 306099, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.804678 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306099:306175, ack 3782487, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.805529 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3782487:3782575, ack 306175, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.807165 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306175:306279, ack 3782575, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.826795 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3782575:3792795, ack 306279, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.829842 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3785495, win 4380, length 0 15:02:33.829939 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3792795:3797175, ack 306279, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:33.834701 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3788415, win 4380, length 0 15:02:33.834776 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3797175:3798635, ack 306279, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:33.834818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3798635:3798975, ack 306279, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:33.837526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3791335, win 4380, length 0 15:02:33.839797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3794255, win 4380, length 0 15:02:33.841985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3797175, win 4380, length 0 15:02:33.843293 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3798975, win 4380, length 0 15:02:33.845582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306279:306320, ack 3798975, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:33.846441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3798975:3799014, ack 306320, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:33.850718 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306320:306365, ack 3799014, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.851416 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3799014:3799053, ack 306365, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.856188 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306365:306475, ack 3799053, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.856270 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3799053:3799157, ack 306475, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.858033 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306475:306563, ack 3799157, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.858120 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3799157:3799296, ack 306563, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.859742 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306563:306639, ack 3799296, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.860621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3799296:3799368, ack 306639, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.862217 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306639:306715, ack 3799368, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.863029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3799368:3799456, ack 306715, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.864665 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306715:306825, ack 3799456, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.870831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3799456:3802376, ack 306825, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.871065 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3802376:3802844, ack 306825, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:33.874692 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3802376, win 4380, length 0 15:02:33.876671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306825:306870, ack 3802844, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.877351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3802844:3802883, ack 306870, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.880030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306870:306972, ack 3802883, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.880916 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3802883:3803022, ack 306972, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.882527 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 306972:307048, ack 3803022, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.883358 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3803022:3803094, ack 307048, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.885008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307048:307124, ack 3803094, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.885835 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3803094:3803182, ack 307124, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.887482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307124:307226, ack 3803182, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.892880 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3803182:3806102, ack 307226, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.893108 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806102:3806194, ack 307226, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:33.896177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3806102, win 4380, length 0 15:02:33.896600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307226:307271, ack 3806194, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.897271 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806194:3806233, ack 307271, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.899655 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307271:307367, ack 3806233, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.899736 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806233:3806337, ack 307367, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.901401 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307367:307455, ack 3806337, win 4321, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.901487 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806337:3806476, ack 307455, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.903081 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307455:307531, ack 3806476, win 4286, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.904132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806476:3806548, ack 307531, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.905711 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307531:307607, ack 3806548, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.906548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806548:3806636, ack 307607, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.908172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307607:307703, ack 3806636, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.910634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3806636:3807924, ack 307703, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:33.912835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307703:307748, ack 3807924, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.913565 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3807924:3807963, ack 307748, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.915898 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307748:307856, ack 3807963, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.916790 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3807963:3808102, ack 307856, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.918603 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307856:307932, ack 3808102, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.919437 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3808102:3808174, ack 307932, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.921178 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 307932:308008, ack 3808174, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.921994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3808174:3808262, ack 308008, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.923645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308008:308116, ack 3808262, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.926679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3808262:3809722, ack 308116, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.926887 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3809722:3809730, ack 308116, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:33.929305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3809730, win 4380, length 0 15:02:33.929802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308116:308161, ack 3809730, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.930457 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3809730:3809769, ack 308161, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.932833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308161:308279, ack 3809769, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.933205 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3809769:3809873, ack 308279, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:33.935725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308279:308367, ack 3809873, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:33.935813 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3809873:3810012, ack 308367, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.937405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308367:308443, ack 3810012, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.938273 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3810012:3810084, ack 308443, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.939886 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308443:308519, ack 3810084, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.940695 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3810084:3810172, ack 308519, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.942361 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308519:308637, ack 3810172, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.947920 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3810172:3811632, ack 308637, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:33.948128 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3811632:3812940, ack 308637, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:33.951814 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3812940, win 4380, length 0 15:02:33.968508 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308637:308682, ack 3812940, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:33.969210 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3812940:3812979, ack 308682, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:33.973648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308682:308784, ack 3812979, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:33.974544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3812979:3813118, ack 308784, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:33.982821 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308784:308860, ack 3813118, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.983709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3813118:3813190, ack 308860, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:33.985380 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308860:308936, ack 3813190, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:33.986207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3813190:3813278, ack 308936, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:33.987863 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 308936:309038, ack 3813278, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.001631 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3813278:3820578, ack 309038, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.001899 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3820578:3820766, ack 309038, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:34.004634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3816198, win 4380, length 0 15:02:34.006754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3819118, win 4380, length 0 15:02:34.008781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3820766, win 4380, length 0 15:02:34.009193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309038:309083, ack 3820766, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.009907 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3820766:3820805, ack 309083, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.012317 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309083:309185, ack 3820805, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.012402 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3820805:3820909, ack 309185, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:34.014064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309185:309273, ack 3820909, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:34.014153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3820909:3821048, ack 309273, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.015748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309273:309349, ack 3821048, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.016592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3821048:3821120, ack 309349, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.018171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309349:309425, ack 3821120, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.018987 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3821120:3821208, ack 309425, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.020644 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309425:309527, ack 3821208, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.022603 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3821208:3821928, ack 309527, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:34.032083 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309527:309572, ack 3821928, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.032789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3821928:3821967, ack 309572, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.035177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309572:309698, ack 3821967, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.036067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3821967:3822106, ack 309698, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.038037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309698:309774, ack 3822106, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.038921 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3822106:3822178, ack 309774, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.040526 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309774:309850, ack 3822178, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.041346 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3822178:3822266, ack 309850, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.043076 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309850:309976, ack 3822266, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.069679 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3822266:3836866, ack 309976, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.072600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3825186, win 4380, length 0 15:02:34.075752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3828106, win 4380, length 0 15:02:34.075831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3836866:3838326, ack 309976, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:34.075875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3838326:3838570, ack 309976, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:34.077965 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3831026, win 4380, length 0 15:02:34.081726 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3833946, win 4380, length 0 15:02:34.083037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3836866, win 4380, length 0 15:02:34.087024 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3838570, win 4380, length 0 15:02:34.087096 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3838570:3838674, ack 309976, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:34.087642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 309976:310136, ack 3838570, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.109714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310136:310224, ack 3838674, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:34.114330 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3838674:3854734, ack 310224, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.114666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3854734:3855094, ack 310224, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:34.120719 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3841594, win 4380, length 0 15:02:34.121632 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3844514, win 4380, length 0 15:02:34.123716 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3847434, win 4380, length 0 15:02:34.125894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3850354, win 4380, length 0 15:02:34.129091 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3853274, win 4380, length 0 15:02:34.131003 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3855094, win 4380, length 0 15:02:34.131622 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310224:310340, ack 3855094, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.157211 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3855094:3871154, ack 310340, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.157557 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871154:3871438, ack 310340, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:34.160378 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3858014, win 4380, length 0 15:02:34.162506 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3860934, win 4380, length 0 15:02:34.164751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3863854, win 4380, length 0 15:02:34.166877 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3866774, win 4380, length 0 15:02:34.169187 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3869694, win 4380, length 0 15:02:34.171174 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3871438, win 4380, length 0 15:02:34.171660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310340:310381, ack 3871438, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:34.172561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871438:3871477, ack 310381, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:34.174115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310381:310426, ack 3871477, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.174827 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871477:3871516, ack 310426, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.177263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310426:310554, ack 3871516, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.178183 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871516:3871655, ack 310554, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.179793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310554:310630, ack 3871655, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.180642 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871655:3871727, ack 310630, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.182916 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310630:310706, ack 3871727, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.182999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871727:3871831, ack 310706, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:34.184582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310706:310794, ack 3871831, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:34.184666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3871831:3871919, ack 310794, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.186325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310794:310922, ack 3871919, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.192774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3871919:3874839, ack 310922, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.193010 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3874839:3875339, ack 310922, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:34.195586 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3874839, win 4380, length 0 15:02:34.197029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310922:310967, ack 3875339, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.197754 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3875339:3875378, ack 310967, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.200122 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 310967:311075, ack 3875378, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.201005 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3875378:3875517, ack 311075, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.203139 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311075:311151, ack 3875517, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.204032 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3875517:3875589, ack 311151, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.205575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311151:311227, ack 3875589, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.206396 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3875589:3875677, ack 311227, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.207996 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311227:311335, ack 3875677, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.211726 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3875677:3877137, ack 311335, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:34.211929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877137:3877573, ack 311335, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:34.214397 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3877573, win 4380, length 0 15:02:34.214816 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311335:311380, ack 3877573, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.215497 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877573:3877612, ack 311380, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.217825 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311380:311506, ack 3877612, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.218708 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877612:3877751, ack 311506, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.220292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311506:311582, ack 3877751, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.221173 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877751:3877823, ack 311582, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.222725 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311582:311658, ack 3877823, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.222809 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877823:3877927, ack 311658, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:34.224435 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311658:311746, ack 3877927, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:34.224521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3877927:3878015, ack 311746, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.226689 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311746:311872, ack 3878015, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.229016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3878015:3878715, ack 311872, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:34.237473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311872:311917, ack 3878715, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.238240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3878715:3878754, ack 311917, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.240601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 311917:312051, ack 3878754, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.241517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3878754:3878893, ack 312051, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.243454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312051:312127, ack 3878893, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.244370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3878893:3878965, ack 312127, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.245930 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312127:312203, ack 3878965, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.246756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3878965:3879053, ack 312203, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.248394 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312203:312337, ack 3879053, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.249656 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879053:3879321, ack 312337, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:34.251907 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312337:312382, ack 3879321, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.252590 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879321:3879360, ack 312382, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.254941 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312382:312516, ack 3879360, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.255879 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879360:3879499, ack 312516, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:34.257451 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312516:312592, ack 3879499, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.258294 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879499:3879571, ack 312592, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:34.260348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312592:312668, ack 3879571, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.261170 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879571:3879659, ack 312668, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.263416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312668:312802, ack 3879659, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.265950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3879659:3880599, ack 312802, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:34.268762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312802:312847, ack 3880599, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:34.268850 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3880599:3880703, ack 312847, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:34.270482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312847:312935, ack 3880703, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:34.270568 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3880703:3880742, ack 312935, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:34.395263 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3859:3945, ack 3632, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.396463 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3632:3732, ack 3945, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:34.406025 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 3945:4031, ack 3732, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.406970 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3732:3820, ack 4031, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.417506 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4031:4119, ack 3820, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.418449 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3820:3920, ack 4119, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:34.428231 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4119:4207, ack 3920, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:34.429214 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 3920:4008, ack 4207, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:34.438572 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4207:4312, ack 4008, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:34.439363 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4008:4047, ack 4312, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:34.462156 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3880742, win 4344, length 0 15:02:34.541399 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4047, win 8192, length 0 15:02:35.797554 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 312935:313015, ack 3880742, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.798604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3880742:3880846, ack 313015, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:35.801025 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313015:313095, ack 3880846, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.801933 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3880846:3880934, ack 313095, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.804779 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313095:313175, ack 3880934, win 4296, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.805623 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3880934:3881038, ack 313175, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:35.807832 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313175:313255, ack 3881038, win 4270, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.808659 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3881038:3881126, ack 313255, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.811756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313255:313345, ack 3881126, win 4248, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.812614 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3881126:3881265, ack 313345, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.814974 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313345:313435, ack 3881265, win 4213, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.815377 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3881265:3881369, ack 313435, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:35.823837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3881369:3885749, ack 313435, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:35.827867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3882829, win 4380, length 0 15:02:35.827958 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3885749:3885777, ack 313435, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:35.833773 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3885749, win 4380, length 0 15:02:35.835623 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313435:313523, ack 3885777, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:35.873786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 313523, win 3247, length 0 15:02:35.876152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313523:313613, ack 3885777, win 4373, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.876219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 313613, win 3247, length 0 15:02:35.877082 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3885777:3885916, ack 313613, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.883125 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313613:313658, ack 3885916, win 4338, length 45SMB PACKET: SMBclose (REQUEST) 15:02:35.883875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3885916:3885955, ack 313658, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:35.886135 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313658:313748, ack 3885955, win 4328, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.894563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3885955:3890335, ack 313748, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:35.894813 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3890335:3890363, ack 313748, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:35.900999 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3888875, win 4380, length 0 15:02:35.906245 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3890363, win 4380, length 0 15:02:35.913087 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313748:313793, ack 3890363, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:35.913830 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3890363:3890402, ack 313793, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:35.916719 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313793:313911, ack 3890402, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.917632 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3890402:3890541, ack 313911, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.919825 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313911:313987, ack 3890541, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.920711 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3890541:3890613, ack 313987, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:35.923563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 313987:314063, ack 3890613, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.924447 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3890613:3890701, ack 314063, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.926810 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314063:314181, ack 3890701, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.931284 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3890701:3892161, ack 314181, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:35.931582 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3892161:3892901, ack 314181, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:35.937109 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3892901, win 4380, length 0 15:02:35.937195 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3892901:3893005, ack 314181, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:35.937556 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314181:314226, ack 3892901, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:35.938911 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314226:314314, ack 3893005, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:35.938996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893005:3893044, ack 314314, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:35.942079 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314314:314414, ack 3893044, win 4344, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.942985 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893044:3893183, ack 314414, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.944585 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314414:314490, ack 3893183, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.945447 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893183:3893255, ack 314490, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:35.947030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314490:314566, ack 3893255, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.947849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893255:3893343, ack 314566, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.949531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314566:314666, ack 3893343, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.951241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893343:3893923, ack 314666, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:35.953892 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314666:314711, ack 3893923, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:35.954594 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893923:3893962, ack 314711, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:35.956940 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314711:314821, ack 3893962, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.957812 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3893962:3894101, ack 314821, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.959962 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314821:314897, ack 3894101, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.960795 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894101:3894173, ack 314897, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:35.962916 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314897:314973, ack 3894173, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.963777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894173:3894261, ack 314973, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.965942 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 314973:315083, ack 3894261, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.967527 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894261:3894757, ack 315083, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:35.969365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315083:315128, ack 3894757, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:35.969742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894757:3894861, ack 315128, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:35.972077 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315128:315216, ack 3894861, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:35.972160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894861:3894900, ack 315216, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:35.974552 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315216:315320, ack 3894900, win 4344, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:35.975448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3894900:3895039, ack 315320, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:35.977115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315320:315396, ack 3895039, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.977954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3895039:3895111, ack 315396, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:35.980277 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315396:315472, ack 3895111, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:35.981083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3895111:3895199, ack 315472, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:35.983602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315472:315576, ack 3895199, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.004991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3895199:3906879, ack 315576, win 3247, length 11680WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.011118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3898119, win 4380, length 0 15:02:36.011216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3906879:3911259, ack 315576, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:36.015150 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3901039, win 4380, length 0 15:02:36.015223 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911259:3911599, ack 315576, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:36.019075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3903959, win 4380, length 0 15:02:36.024793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3906879, win 4380, length 0 15:02:36.027099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3909799, win 4380, length 0 15:02:36.030992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3911599, win 4380, length 0 15:02:36.031398 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315576:315617, ack 3911599, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:36.032255 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911599:3911638, ack 315617, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:36.033818 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315617:315662, ack 3911638, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.034569 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911638:3911677, ack 315662, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.036981 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315662:315772, ack 3911677, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.037886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911677:3911816, ack 315772, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.039519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315772:315848, ack 3911816, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.040364 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911816:3911888, ack 315848, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.041956 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315848:315924, ack 3911888, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.042332 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911888:3911992, ack 315924, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.043966 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 315924:316012, ack 3911992, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.044054 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3911992:3912080, ack 316012, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.046339 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316012:316122, ack 3912080, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.052502 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3912080:3915000, ack 316122, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.052742 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3915000:3915468, ack 316122, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:36.058767 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3915000, win 4380, length 0 15:02:36.059226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316122:316167, ack 3915468, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.059900 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3915468:3915507, ack 316167, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.062267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316167:316269, ack 3915507, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.063144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3915507:3915646, ack 316269, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.064748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316269:316345, ack 3915646, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.065614 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3915646:3915718, ack 316345, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.067888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316345:316421, ack 3915718, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.068701 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3915718:3915806, ack 316421, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.070412 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316421:316523, ack 3915806, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.075883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3915806:3918726, ack 316523, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.076112 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3918726:3918818, ack 316523, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:36.081090 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3918726, win 4380, length 0 15:02:36.081558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316523:316568, ack 3918818, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.082222 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3918818:3918857, ack 316568, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.085570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316568:316664, ack 3918857, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.086462 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3918857:3918996, ack 316664, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.088134 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316664:316740, ack 3918996, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.088977 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3918996:3919068, ack 316740, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.091309 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316740:316816, ack 3919068, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.091392 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3919068:3919172, ack 316816, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.093551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316816:316904, ack 3919172, win 4268, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.093634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3919172:3919260, ack 316904, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.095908 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 316904:317000, ack 3919260, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.098422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3919260:3920548, ack 317000, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:36.118411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317000:317045, ack 3920548, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.119132 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3920548:3920587, ack 317045, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.122997 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317045:317153, ack 3920587, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.123914 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3920587:3920726, ack 317153, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.126542 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317153:317229, ack 3920726, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.127380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3920726:3920798, ack 317229, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.129889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317229:317305, ack 3920798, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.130691 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3920798:3920886, ack 317305, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.135551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317305:317413, ack 3920886, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.138539 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3920886:3922346, ack 317413, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.138743 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922346:3922354, ack 317413, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:36.143763 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3922354, win 4380, length 0 15:02:36.144181 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317413:317458, ack 3922354, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.144886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922354:3922393, ack 317458, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.147881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317458:317576, ack 3922393, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.148757 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922393:3922532, ack 317576, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.151132 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317576:317652, ack 3922532, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.151965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922532:3922604, ack 317652, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.154229 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317652:317728, ack 3922604, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.155067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922604:3922692, ack 317728, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.157380 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317728:317846, ack 3922692, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.157458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3922692:3922796, ack 317846, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.159113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317846:317934, ack 3922796, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.163180 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3922796:3924256, ack 317934, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.163379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3924256:3925564, ack 317934, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:36.167937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3925564, win 4380, length 0 15:02:36.168408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317934:317979, ack 3925564, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.169053 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3925564:3925603, ack 317979, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.171455 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 317979:318081, ack 3925603, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.172328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3925603:3925742, ack 318081, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.174551 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318081:318157, ack 3925742, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.175405 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3925742:3925814, ack 318157, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.177519 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318157:318233, ack 3925814, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.178324 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3925814:3925902, ack 318233, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.180511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318233:318335, ack 3925902, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.194247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3925902:3933202, ack 318335, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.194512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933202:3933390, ack 318335, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:36.198954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3928822, win 4380, length 0 15:02:36.203030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3931742, win 4380, length 0 15:02:36.206575 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3933390, win 4380, length 0 15:02:36.207086 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318335:318380, ack 3933390, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.207761 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933390:3933429, ack 318380, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.210873 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318380:318482, ack 3933429, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.211763 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933429:3933568, ack 318482, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.213376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318482:318558, ack 3933568, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.214261 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933568:3933640, ack 318558, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.215848 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318558:318634, ack 3933640, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.215930 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933640:3933744, ack 318634, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.217560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318634:318722, ack 3933744, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.217642 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933744:3933832, ack 318722, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.219347 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318722:318824, ack 3933832, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.221356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3933832:3934552, ack 318824, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:36.230415 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318824:318869, ack 3934552, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.231121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3934552:3934591, ack 318869, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.233505 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318869:318995, ack 3934591, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.234425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3934591:3934730, ack 318995, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.236030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 318995:319071, ack 3934730, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.236875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3934730:3934802, ack 319071, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.238460 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319071:319147, ack 3934802, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.239280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3934802:3934890, ack 319147, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.258231 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319147:319273, ack 3934890, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.284544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3934890:3950950, ack 319273, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.288667 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3937810, win 4380, length 0 15:02:36.288758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3950950:3951194, ack 319273, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:36.294262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3940730, win 4380, length 0 15:02:36.298104 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3943650, win 4380, length 0 15:02:36.302430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3946570, win 4380, length 0 15:02:36.305647 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3949490, win 4380, length 0 15:02:36.308547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3951194, win 4380, length 0 15:02:36.309262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319273:319433, ack 3951194, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.335516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3951194:3967254, ack 319433, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.335860 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3967254:3967614, ack 319433, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:36.340261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3954114, win 4380, length 0 15:02:36.344086 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3957034, win 4380, length 0 15:02:36.348065 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3959954, win 4380, length 0 15:02:36.352313 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3962874, win 4380, length 0 15:02:36.356226 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3965794, win 4380, length 0 15:02:36.360600 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3967614, win 4380, length 0 15:02:36.360666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3967614:3967718, ack 319433, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.361168 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319433:319549, ack 3967614, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.363037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319549:319637, ack 3967718, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.386951 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3967718:3983778, ack 319637, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.387286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3983778:3984062, ack 319637, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:36.391738 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3970638, win 4380, length 0 15:02:36.399222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3973558, win 4380, length 0 15:02:36.401521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3976478, win 4380, length 0 15:02:36.405543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3979398, win 4380, length 0 15:02:36.411445 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3982318, win 4380, length 0 15:02:36.415121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3984062, win 4380, length 0 15:02:36.415578 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319637:319678, ack 3984062, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:36.416446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3984062:3984101, ack 319678, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:36.418754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319678:319723, ack 3984101, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.419441 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3984101:3984140, ack 319723, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.421917 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319723:319851, ack 3984140, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.422853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3984140:3984279, ack 319851, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.425114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319851:319927, ack 3984279, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.425975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3984279:3984351, ack 319927, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.428185 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 319927:320003, ack 3984351, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.429008 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3984351:3984439, ack 320003, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.430695 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320003:320131, ack 3984439, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.437241 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3984439:3987359, ack 320131, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.437472 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3987359:3987859, ack 320131, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:36.445459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3987359, win 4380, length 0 15:02:36.447697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320131:320176, ack 3987859, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.447771 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3987859:3987963, ack 320176, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.450126 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320176:320264, ack 3987963, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.450229 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3987963:3988002, ack 320264, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.452671 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320264:320372, ack 3988002, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.453592 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3988002:3988141, ack 320372, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.456386 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320372:320448, ack 3988141, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.457342 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3988141:3988213, ack 320448, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.459677 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320448:320524, ack 3988213, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.460546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3988213:3988301, ack 320524, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.462732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320524:320632, ack 3988301, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.466606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3988301:3989761, ack 320632, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:36.466818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3989761:3990197, ack 320632, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:36.470241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3990197, win 4380, length 0 15:02:36.470662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320632:320677, ack 3990197, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.471367 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3990197:3990236, ack 320677, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.473733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320677:320803, ack 3990236, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.474653 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3990236:3990375, ack 320803, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.476991 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320803:320879, ack 3990375, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.477840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3990375:3990447, ack 320879, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.479456 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320879:320955, ack 3990447, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.480283 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3990447:3990535, ack 320955, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.481959 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 320955:321081, ack 3990535, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.484062 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3990535:3991235, ack 321081, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:36.492754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321081:321126, ack 3991235, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.493444 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991235:3991274, ack 321126, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.496454 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321126:321260, ack 3991274, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.496538 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991274:3991378, ack 321260, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:36.498214 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321260:321348, ack 3991378, win 4084, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:36.498298 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991378:3991517, ack 321348, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.499912 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321348:321424, ack 3991517, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.500786 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991517:3991589, ack 321424, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.503055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321424:321500, ack 3991589, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.503931 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991589:3991677, ack 321500, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.505589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321500:321634, ack 3991677, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.506846 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991677:3991945, ack 321634, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:36.508559 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321634:321679, ack 3991945, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.509243 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991945:3991984, ack 321679, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.512333 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321679:321813, ack 3991984, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:36.513210 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3991984:3992123, ack 321813, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:36.514809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321813:321889, ack 3992123, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.515668 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3992123:3992195, ack 321889, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:36.517819 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321889:321965, ack 3992195, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.518645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3992195:3992283, ack 321965, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:36.520351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 321965:322099, ack 3992283, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:36.522849 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3992283:3993223, ack 322099, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:36.525694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322099:322144, ack 3993223, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:36.526406 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993223:3993262, ack 322144, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:36.724164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3993262, win 4370, length 0 15:02:37.448721 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4312:4371, ack 4047, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:37.449428 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4047:4106, ack 4371, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:37.490574 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4106, win 8192, length 0 15:02:37.490982 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993262:3993366, ack 322144, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:37.492902 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322144:322232, ack 3993366, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:37.523715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 322232, win 3247, length 0 15:02:39.026010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322232:322312, ack 3993366, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.026128 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 322312, win 3247, length 0 15:02:39.027169 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993366:3993470, ack 322312, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:39.029022 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322312:322392, ack 3993470, win 4318, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.029903 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993470:3993558, ack 322392, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.031545 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322392:322482, ack 3993558, win 4296, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.032422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993558:3993697, ack 322482, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.034169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322482:322562, ack 3993697, win 4261, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.035030 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993697:3993801, ack 322562, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:39.036607 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322562:322642, ack 3993801, win 4235, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.037424 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3993801:3993889, ack 322642, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.039055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322642:322732, ack 3993889, win 4213, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.047574 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3993889:3998269, ack 322732, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.047826 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3998269:3998297, ack 322732, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:39.051719 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3996809, win 4380, length 0 15:02:39.053740 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 3998297, win 4380, length 0 15:02:39.056587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322732:322822, ack 3998297, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.057461 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3998297:3998436, ack 322822, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.059517 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322822:322867, ack 3998436, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.060258 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 3998436:3998475, ack 322867, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.061870 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322867:322957, ack 3998475, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.070425 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 3998475:4002855, ack 322957, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.070683 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4002855:4002883, ack 322957, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:39.074868 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4001395, win 4380, length 0 15:02:39.075252 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4002883, win 4380, length 0 15:02:39.075680 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4002883:4002987, ack 322957, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.075850 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 322957:323002, ack 4002883, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.113713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 323002, win 3247, length 0 15:02:39.266956 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4002987, win 4354, length 0 15:02:39.267040 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4002987:4003026, ack 323002, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.268789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323002:323090, ack 4003026, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.269002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 323090, win 3247, length 0 15:02:39.270631 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323090:323208, ack 4003026, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.270862 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 323208, win 3247, length 0 15:02:39.271692 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4003026:4003165, ack 323208, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.273258 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323208:323284, ack 4003165, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.274167 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4003165:4003237, ack 323284, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.275771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323284:323360, ack 4003237, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.276617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4003237:4003325, ack 323360, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.278285 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323360:323478, ack 4003325, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.282818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4003325:4004785, ack 323478, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.283024 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4004785:4005525, ack 323478, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:39.285670 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4005525, win 4380, length 0 15:02:39.286037 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323478:323523, ack 4005525, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.286712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005525:4005564, ack 323523, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.289071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323523:323623, ack 4005564, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.289950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005564:4005703, ack 323623, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.291588 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323623:323699, ack 4005703, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.292417 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005703:4005775, ack 323699, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.294016 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323699:323775, ack 4005775, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.294848 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005775:4005863, ack 323775, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.297023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323775:323875, ack 4005863, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.297105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005863:4005967, ack 323875, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.319011 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323875:323963, ack 4005967, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.319104 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4005967:4006547, ack 323963, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:39.323561 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 323963:324008, ack 4006547, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.324294 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4006547:4006586, ack 324008, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.326744 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324008:324118, ack 4006586, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.327666 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4006586:4006725, ack 324118, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.330255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324118:324194, ack 4006725, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.331098 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4006725:4006797, ack 324194, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.332881 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324194:324270, ack 4006797, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.333734 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4006797:4006885, ack 324270, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.335425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324270:324380, ack 4006885, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.336984 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4006885:4007381, ack 324380, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:39.339468 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324380:324425, ack 4007381, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.340152 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4007381:4007420, ack 324425, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.342498 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324425:324529, ack 4007420, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.343521 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4007420:4007559, ack 324529, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.345145 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324529:324605, ack 4007559, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.345997 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4007559:4007631, ack 324605, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.347587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324605:324681, ack 4007631, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.348396 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4007631:4007719, ack 324681, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.350089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324681:324785, ack 4007719, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.369874 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4007719:4017939, ack 324785, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.373891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4010639, win 4380, length 0 15:02:39.373989 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4017939:4022319, ack 324785, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:39.376990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4013559, win 4380, length 0 15:02:39.377075 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4022319:4023779, ack 324785, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:39.377117 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4023779:4024223, ack 324785, win 3247, length 444SMB-over-TCP packet:(raw data or continuation?) 15:02:39.381027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4016479, win 4380, length 0 15:02:39.384857 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4019399, win 4380, length 0 15:02:39.389662 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4022319, win 4380, length 0 15:02:39.392605 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4024223, win 4380, length 0 15:02:39.393075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324785:324826, ack 4024223, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:39.393587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324826:324914, ack 4024223, win 4380, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.394140 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4024223:4024262, ack 324914, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:39.395717 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324914:324959, ack 4024262, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.396408 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4024262:4024301, ack 324959, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.399292 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 324959:325069, ack 4024301, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.400182 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4024301:4024440, ack 325069, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.401794 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325069:325145, ack 4024440, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.402629 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4024440:4024512, ack 325145, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.404955 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325145:325221, ack 4024512, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.405784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4024512:4024600, ack 325221, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.407511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325221:325331, ack 4024600, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.413650 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4024600:4027520, ack 325331, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.413912 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4027520:4027988, ack 325331, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:39.417499 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4371:4457, ack 4106, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.418506 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4027520, win 4380, length 0 15:02:39.418699 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4106:4206, ack 4457, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:39.419937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325331:325376, ack 4027988, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.420623 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4027988:4028027, ack 325376, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.423553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325376:325478, ack 4028027, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.424482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4028027:4028166, ack 325478, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.426634 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325478:325554, ack 4028166, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.426717 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4028166:4028270, ack 325554, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.428496 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4457:4543, ack 4206, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.429018 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325554:325642, ack 4028270, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.429099 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4028270:4028342, ack 325642, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.429626 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4206:4294, ack 4543, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.431503 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325642:325718, ack 4028342, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.432345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4028342:4028430, ack 325718, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.434558 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325718:325820, ack 4028430, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.438878 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4543:4631, ack 4294, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.439881 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4294:4394, ack 4631, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:39.441242 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4028430:4031350, ack 325820, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.441458 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031350:4031442, ack 325820, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:39.446376 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4031350, win 4380, length 0 15:02:39.449765 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4631:4719, ack 4394, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.450646 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4394:4482, ack 4719, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.456688 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4482, win 8192, length 0 15:02:39.459702 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325820:325865, ack 4031442, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.460374 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031442:4031481, ack 325865, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.460480 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4719:4824, ack 4482, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.461289 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4482:4521, ack 4824, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:39.462859 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325865:325961, ack 4031481, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.463851 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031481:4031620, ack 325961, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.466509 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 325961:326037, ack 4031620, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.467394 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031620:4031692, ack 326037, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.469044 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326037:326113, ack 4031692, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.469407 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031692:4031796, ack 326113, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.471835 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326113:326201, ack 4031796, win 4268, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.471916 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031796:4031884, ack 326201, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.474205 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326201:326297, ack 4031884, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.476690 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4031884:4033172, ack 326297, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:39.479732 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326297:326342, ack 4033172, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.480423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4033172:4033211, ack 326342, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.483487 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326342:326450, ack 4033211, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.484401 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4033211:4033350, ack 326450, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.486560 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326450:326526, ack 4033350, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.487414 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4033350:4033422, ack 326526, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.489030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326526:326602, ack 4033422, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.489906 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4033422:4033510, ack 326602, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.491563 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326602:326710, ack 4033510, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.494628 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4033510:4034970, ack 326710, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.494831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4034970:4034978, ack 326710, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:39.498040 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4034978, win 4380, length 0 15:02:39.498474 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326710:326755, ack 4034978, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.499130 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4034978:4035017, ack 326755, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.501493 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326755:326873, ack 4035017, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.502365 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4035017:4035156, ack 326873, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.504501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326873:326949, ack 4035156, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.505356 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4035156:4035228, ack 326949, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.506951 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 326949:327025, ack 4035228, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.507762 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4035228:4035316, ack 327025, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.510053 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327025:327143, ack 4035316, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.510422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4035316:4035420, ack 327143, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.512679 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327143:327231, ack 4035420, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.516253 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4035420:4036880, ack 327231, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.516454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4036880:4038188, ack 327231, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:39.520736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4038188, win 4380, length 0 15:02:39.521140 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327231:327276, ack 4038188, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.521784 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4038188:4038227, ack 327276, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.524663 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327276:327378, ack 4038227, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.525546 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4038227:4038366, ack 327378, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.527739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327378:327454, ack 4038366, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.528577 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4038366:4038438, ack 327454, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.530198 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327454:327530, ack 4038438, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.531054 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4038438:4038526, ack 327530, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.533478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327530:327632, ack 4038526, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.547171 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4038526:4045826, ack 327632, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.547442 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4045826:4046014, ack 327632, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:39.552152 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4041446, win 4380, length 0 15:02:39.555972 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4044366, win 4380, length 0 15:02:39.559354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4046014, win 4380, length 0 15:02:39.559772 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327632:327677, ack 4046014, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.560454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046014:4046053, ack 327677, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.563528 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327677:327779, ack 4046053, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.564527 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046053:4046192, ack 327779, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.567645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327779:327855, ack 4046192, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.568495 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046192:4046264, ack 327855, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.570841 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327855:327931, ack 4046264, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.571215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046264:4046368, ack 327931, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.572850 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 327931:328019, ack 4046368, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.572934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046368:4046456, ack 328019, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.574616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328019:328121, ack 4046456, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.576610 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4046456:4047176, ack 328121, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:39.586194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328121:328166, ack 4047176, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.586896 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4047176:4047215, ack 328166, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.590977 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328166:328292, ack 4047215, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.591847 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4047215:4047354, ack 328292, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.594145 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328292:328368, ack 4047354, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.595007 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4047354:4047426, ack 328368, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.597309 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328368:328444, ack 4047426, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.598134 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4047426:4047514, ack 328444, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.600354 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328444:328570, ack 4047514, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.620532 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4521, win 8192, length 0 15:02:39.627037 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4047514:4062114, ack 328570, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.631947 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4050434, win 4380, length 0 15:02:39.637064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4053354, win 4380, length 0 15:02:39.637154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4062114:4063574, ack 328570, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:39.637203 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4063574:4063818, ack 328570, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:39.641268 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4056274, win 4380, length 0 15:02:39.646727 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4059194, win 4380, length 0 15:02:39.650639 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4062114, win 4380, length 0 15:02:39.654244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4063818, win 4380, length 0 15:02:39.654880 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328570:328730, ack 4063818, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.682544 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4063818:4079878, ack 328730, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.682915 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4079878:4080238, ack 328730, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:39.687267 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4066738, win 4380, length 0 15:02:39.691289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4069658, win 4380, length 0 15:02:39.695308 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4072578, win 4380, length 0 15:02:39.700954 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4075498, win 4380, length 0 15:02:39.703419 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4078418, win 4380, length 0 15:02:39.707119 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4080238, win 4380, length 0 15:02:39.707188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4080238:4080342, ack 328730, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.707754 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328730:328846, ack 4080238, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.709063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328846:328934, ack 4080342, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.733630 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4080342:4096402, ack 328934, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.734004 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096402:4096686, ack 328934, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:39.738709 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4083262, win 4380, length 0 15:02:39.742542 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4086182, win 4380, length 0 15:02:39.746406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4089102, win 4380, length 0 15:02:39.756714 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4092022, win 4380, length 0 15:02:39.757062 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4094942, win 4380, length 0 15:02:39.759101 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4096686, win 4380, length 0 15:02:39.759588 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328934:328975, ack 4096686, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:39.760456 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096686:4096725, ack 328975, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:39.762610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 328975:329020, ack 4096725, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.763292 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096725:4096764, ack 329020, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.766340 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329020:329148, ack 4096764, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.767260 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096764:4096903, ack 329148, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.769610 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329148:329224, ack 4096903, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.770453 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096903:4096975, ack 329224, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.773992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329224:329300, ack 4096975, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.774829 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4096975:4097063, ack 329300, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.777138 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329300:329428, ack 4097063, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.783604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4097063:4099983, ack 329428, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.783883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4099983:4100483, ack 329428, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:39.788350 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4099983, win 4380, length 0 15:02:39.790706 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329428:329473, ack 4100483, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.790776 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4100483:4100587, ack 329473, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.792992 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329473:329561, ack 4100587, win 4229, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.793074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4100587:4100626, ack 329561, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.796191 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329561:329669, ack 4100626, win 4219, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.797102 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4100626:4100765, ack 329669, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.799833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329669:329745, ack 4100765, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.800712 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4100765:4100837, ack 329745, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.802869 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329745:329821, ack 4100837, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.803722 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4100837:4100925, ack 329821, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.806057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329821:329929, ack 4100925, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.809821 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4100925:4102385, ack 329929, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:39.810026 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4102385:4102821, ack 329929, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:39.814145 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4102821, win 4380, length 0 15:02:39.814529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329929:329974, ack 4102821, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.815208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4102821:4102860, ack 329974, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.818096 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 329974:330100, ack 4102860, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.818970 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4102860:4102999, ack 330100, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.820587 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330100:330176, ack 4102999, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.821423 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4102999:4103071, ack 330176, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.823006 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330176:330252, ack 4103071, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.823999 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4103071:4103159, ack 330252, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.826185 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330252:330378, ack 4103159, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.828209 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4103159:4103859, ack 330378, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:39.837494 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330378:330423, ack 4103859, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.837886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4103859:4103963, ack 330423, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:39.840123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330423:330511, ack 4103963, win 4094, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:39.840204 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4103963:4104002, ack 330511, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.843132 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330511:330645, ack 4104002, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.844082 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104002:4104141, ack 330645, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.845707 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330645:330721, ack 4104141, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.846567 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104141:4104213, ack 330721, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.848166 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330721:330797, ack 4104213, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.848994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104213:4104301, ack 330797, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.850682 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330797:330931, ack 4104301, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.851972 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104301:4104569, ack 330931, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:39.854365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330931:330976, ack 4104569, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.855059 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104569:4104608, ack 330976, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:39.857986 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 330976:331110, ack 4104608, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:39.858859 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104608:4104747, ack 331110, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:39.861023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331110:331186, ack 4104747, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.861857 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104747:4104819, ack 331186, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:39.863970 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331186:331262, ack 4104819, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.864805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104819:4104907, ack 331262, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:39.866488 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331262:331396, ack 4104907, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:39.868926 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4104907:4105847, ack 331396, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:39.871722 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331396:331441, ack 4105847, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:39.872422 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4105847:4105886, ack 331441, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:40.062506 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4105886, win 4370, length 0 15:02:41.366703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331441:331521, ack 4105886, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.367747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4105886:4105990, ack 331521, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:41.369594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331521:331601, ack 4105990, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.369684 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4105990:4106094, ack 331601, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:41.560159 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4106094, win 4318, length 0 15:02:41.560247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4106094:4106182, ack 331601, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.562098 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331601:331681, ack 4106182, win 4296, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.562934 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4106182:4106286, ack 331681, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:41.565680 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331681:331761, ack 4106286, win 4270, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.566516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4106286:4106374, ack 331761, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.568229 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331761:331851, ack 4106374, win 4248, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.569086 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4106374:4106513, ack 331851, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.570781 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331851:331939, ack 4106513, win 4213, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:41.603709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 331939, win 3247, length 0 15:02:41.605513 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 331939:332029, ack 4106513, win 4213, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.605574 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 332029, win 3247, length 0 15:02:41.613995 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4106513:4110893, ack 332029, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:41.614238 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4110893:4110921, ack 332029, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:41.617112 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4109433, win 4380, length 0 15:02:41.619041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4110921, win 4380, length 0 15:02:41.620977 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332029:332119, ack 4110921, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.621832 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4110921:4111060, ack 332119, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.623784 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332119:332164, ack 4111060, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.624488 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4111060:4111099, ack 332164, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.626215 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332164:332254, ack 4111099, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.634622 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4111099:4115479, ack 332254, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:41.634864 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115479:4115507, ack 332254, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:41.639790 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4114019, win 4380, length 0 15:02:41.640867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4115507, win 4380, length 0 15:02:41.641215 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115507:4115611, ack 332254, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:41.641579 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332254:332299, ack 4115507, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.673807 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 332299, win 3247, length 0 15:02:41.840900 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4115611, win 4354, length 0 15:02:41.840987 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115611:4115650, ack 332299, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.858838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332299:332387, ack 4115650, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:41.859073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 332387, win 3247, length 0 15:02:41.859697 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332387:332505, ack 4115650, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.860115 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 332505, win 3247, length 0 15:02:41.860965 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115650:4115789, ack 332505, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.864363 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332505:332581, ack 4115789, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.865237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115789:4115861, ack 332581, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:41.867987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332581:332657, ack 4115861, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.868812 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4115861:4115949, ack 332657, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.870693 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332657:332775, ack 4115949, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.875322 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4115949:4117409, ack 332775, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:41.875531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4117409:4118149, ack 332775, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:41.878224 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4118149, win 4380, length 0 15:02:41.879527 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332775:332820, ack 4118149, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.880194 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118149:4118188, ack 332820, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.882602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332820:332920, ack 4118188, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.883506 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118188:4118327, ack 332920, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.885128 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332920:332996, ack 4118327, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.886237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118327:4118399, ack 332996, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:41.887843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 332996:333072, ack 4118399, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.888677 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118399:4118487, ack 333072, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.890385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333072:333172, ack 4118487, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.890755 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118487:4118591, ack 333172, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:41.892408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333172:333260, ack 4118591, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:41.892710 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4118591:4119171, ack 333260, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:41.894642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333260:333305, ack 4119171, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.895372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4119171:4119210, ack 333305, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.897833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333305:333415, ack 4119210, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.898754 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4119210:4119349, ack 333415, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.900406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333415:333491, ack 4119349, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.901252 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4119349:4119421, ack 333491, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:41.902854 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333491:333567, ack 4119421, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.903779 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4119421:4119509, ack 333567, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.905529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333567:333677, ack 4119509, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.907111 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4119509:4120005, ack 333677, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:41.909009 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333677:333722, ack 4120005, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.909701 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4120005:4120044, ack 333722, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.912123 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333722:333826, ack 4120044, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.912989 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4120044:4120183, ack 333826, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.914602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333826:333902, ack 4120183, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.915466 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4120183:4120255, ack 333902, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:41.917064 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333902:333978, ack 4120255, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.917889 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4120255:4120343, ack 333978, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.919657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 333978:334082, ack 4120343, win 4295, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.939388 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4120343:4130563, ack 334082, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:41.942612 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4123263, win 4380, length 0 15:02:41.942706 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4130563:4134943, ack 334082, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:41.945673 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4126183, win 4380, length 0 15:02:41.945747 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4134943:4136403, ack 334082, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:41.945789 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4136403:4136743, ack 334082, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:41.947190 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4129103, win 4380, length 0 15:02:41.949463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4132023, win 4380, length 0 15:02:41.951713 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4134943, win 4380, length 0 15:02:41.953770 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4136743, win 4380, length 0 15:02:41.953837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4136743:4136847, ack 334082, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:41.954315 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334082:334123, ack 4136743, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:41.955630 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334123:334211, ack 4136847, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:41.955718 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4136847:4136886, ack 334211, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:41.957459 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334211:334256, ack 4136886, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.958144 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4136886:4136925, ack 334256, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:41.960589 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334256:334366, ack 4136925, win 4334, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:41.961471 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4136925:4137064, ack 334366, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:41.963087 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334366:334442, ack 4137064, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.963994 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4137064:4137136, ack 334442, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:41.965604 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334442:334518, ack 4137136, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.966428 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4137136:4137224, ack 334518, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:41.968884 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334518:334628, ack 4137224, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:41.975091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4137224:4140144, ack 334628, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:41.975328 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140144:4140612, ack 334628, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:41.978225 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4140144, win 4380, length 0 15:02:41.979735 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334628:334673, ack 4140612, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:41.980413 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140612:4140651, ack 334673, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.004405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334673:334775, ack 4140651, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.005950 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140651:4140790, ack 334775, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.008160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334775:334851, ack 4140790, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.008561 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140790:4140894, ack 334851, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.011901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334851:334939, ack 4140894, win 4192, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.011990 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140894:4140966, ack 334939, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.013708 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 334939:335015, ack 4140966, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.014565 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4140966:4141054, ack 335015, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.016254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335015:335117, ack 4141054, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.021667 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4141054:4143974, ack 335117, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.021901 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4143974:4144066, ack 335117, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:42.026371 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4143974, win 4380, length 0 15:02:42.027733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335117:335162, ack 4144066, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.028418 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4144066:4144105, ack 335162, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.031373 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335162:335258, ack 4144105, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.032251 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4144105:4144244, ack 335258, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.033887 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335258:335334, ack 4144244, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.034741 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4144244:4144316, ack 335334, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.036343 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335334:335410, ack 4144316, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.037160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4144316:4144404, ack 335410, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.038833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335410:335506, ack 4144404, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.041325 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4144404:4145692, ack 335506, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:42.043763 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335506:335551, ack 4145692, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.044492 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4145692:4145731, ack 335551, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.046893 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335551:335659, ack 4145731, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.047781 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4145731:4145870, ack 335659, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.049453 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335659:335735, ack 4145870, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.050288 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4145870:4145942, ack 335735, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.051888 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335735:335811, ack 4145942, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.052256 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4145942:4146046, ack 335811, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.053899 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335811:335899, ack 4146046, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.053983 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4146046:4146134, ack 335899, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.055920 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 335899:336007, ack 4146134, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.058958 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4146134:4147594, ack 336007, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.059166 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4147594:4147602, ack 336007, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:42.061740 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4147602, win 4380, length 0 15:02:42.062213 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336007:336052, ack 4147602, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.062884 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4147602:4147641, ack 336052, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.065312 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336052:336170, ack 4147641, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.066227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4147641:4147780, ack 336170, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.067839 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336170:336246, ack 4147780, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.068682 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4147780:4147852, ack 336246, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.070385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336246:336322, ack 4147852, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.071196 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4147852:4147940, ack 336322, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.072876 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336322:336440, ack 4147940, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.078387 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4147940:4149400, ack 336440, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.078598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4149400:4150708, ack 336440, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:42.081432 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4150708, win 4380, length 0 15:02:42.081860 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336440:336485, ack 4150708, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.082515 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4150708:4150747, ack 336485, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.084912 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336485:336587, ack 4150747, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.085801 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4150747:4150886, ack 336587, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.087424 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336587:336663, ack 4150886, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.088272 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4150886:4150958, ack 336663, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.089883 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336663:336739, ack 4150958, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.090262 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4150958:4151062, ack 336739, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.091971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336739:336827, ack 4151062, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.092054 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4151062:4151150, ack 336827, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.093847 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336827:336929, ack 4151150, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.107514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4151150:4158450, ack 336929, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.107774 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158450:4158638, ack 336929, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:42.110690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4154070, win 4380, length 0 15:02:42.113709 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4156990, win 4380, length 0 15:02:42.114931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4158638, win 4380, length 0 15:02:42.115430 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336929:336974, ack 4158638, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.116105 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158638:4158677, ack 336974, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.118640 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 336974:337076, ack 4158677, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.119692 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158677:4158816, ack 337076, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.121391 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337076:337152, ack 4158816, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.122232 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158816:4158888, ack 337152, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.123861 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337152:337228, ack 4158888, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.124704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158888:4158976, ack 337228, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.127694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337228:337330, ack 4158976, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.129691 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4158976:4159696, ack 337330, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:42.138056 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337330:337375, ack 4159696, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.138758 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4159696:4159735, ack 337375, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.141831 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337375:337501, ack 4159735, win 4105, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.142704 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4159735:4159874, ack 337501, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.144331 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337501:337577, ack 4159874, win 4071, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.145191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4159874:4159946, ack 337577, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.146792 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337577:337653, ack 4159946, win 4053, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.147171 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4159946:4160050, ack 337653, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.148840 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337653:337741, ack 4160050, win 4027, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.148924 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4160050:4160138, ack 337741, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.150668 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337741:337867, ack 4160138, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.177036 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4160138:4174738, ack 337867, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.180814 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4163058, win 4380, length 0 15:02:42.183803 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4165978, win 4380, length 0 15:02:42.183881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4174738:4176198, ack 337867, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:42.183924 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4176198:4176442, ack 337867, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:42.187778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4168898, win 4380, length 0 15:02:42.191771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4171818, win 4380, length 0 15:02:42.195750 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4174738, win 4380, length 0 15:02:42.198694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4176442, win 4380, length 0 15:02:42.199381 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 337867:338027, ack 4176442, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.225634 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4176442:4192502, ack 338027, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.225991 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4192502:4192862, ack 338027, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:42.233744 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4179362, win 4380, length 0 15:02:42.236089 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4182282, win 4380, length 0 15:02:42.239228 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4185202, win 4380, length 0 15:02:42.242402 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4188122, win 4380, length 0 15:02:42.245619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4191042, win 4380, length 0 15:02:42.248456 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4192862, win 4380, length 0 15:02:42.249092 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338027:338143, ack 4192862, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.274678 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4192862:4208922, ack 338143, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.275022 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4208922:4209206, ack 338143, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:42.277905 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4195782, win 4380, length 0 15:02:42.281243 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4198702, win 4380, length 0 15:02:42.283621 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4201622, win 4380, length 0 15:02:42.286052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4204542, win 4380, length 0 15:02:42.288482 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4207462, win 4380, length 0 15:02:42.290582 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4209206, win 4380, length 0 15:02:42.290668 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209206:4209310, ack 338143, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.291055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338143:338184, ack 4209206, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:42.292364 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338184:338272, ack 4209310, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.292451 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209310:4209349, ack 338272, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:42.294051 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338272:338317, ack 4209349, win 4344, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.294768 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209349:4209388, ack 338317, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.297244 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338317:338445, ack 4209388, win 4334, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.298160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209388:4209527, ack 338445, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.299798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338445:338521, ack 4209527, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.300653 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209527:4209599, ack 338521, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.302263 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338521:338597, ack 4209599, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.303091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4209599:4209687, ack 338597, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.304770 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338597:338725, ack 4209687, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.311280 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4209687:4212607, ack 338725, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.311517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4212607:4213107, ack 338725, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:42.314979 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4212607, win 4380, length 0 15:02:42.315467 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338725:338770, ack 4213107, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.316152 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4213107:4213146, ack 338770, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.318578 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338770:338878, ack 4213146, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.319456 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4213146:4213285, ack 338878, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.321115 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338878:338954, ack 4213285, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.321949 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4213285:4213357, ack 338954, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.323546 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 338954:339030, ack 4213357, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.324410 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4213357:4213445, ack 339030, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.326071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339030:339138, ack 4213445, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.326439 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4213445:4213549, ack 339138, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.328082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339138:339226, ack 4213549, win 4144, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.330516 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4213549:4215009, ack 339226, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:42.330714 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215009:4215445, ack 339226, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:42.333479 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4215445, win 4380, length 0 15:02:42.333896 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339226:339271, ack 4215445, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.334562 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215445:4215484, ack 339271, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.336948 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339271:339397, ack 4215484, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.337842 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215484:4215623, ack 339397, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.339473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339397:339473, ack 4215623, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.340322 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215623:4215695, ack 339473, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.343194 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339473:339549, ack 4215695, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.344072 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215695:4215783, ack 339549, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.345818 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339549:339675, ack 4215783, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.347842 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4215783:4216483, ack 339675, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:42.356172 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339675:339720, ack 4216483, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.356876 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4216483:4216522, ack 339720, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.359303 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339720:339854, ack 4216522, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.360222 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4216522:4216661, ack 339854, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.361844 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339854:339930, ack 4216661, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.362692 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4216661:4216733, ack 339930, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.364429 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 339930:340006, ack 4216733, win 4058, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.365266 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4216733:4216821, ack 340006, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.366958 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340006:340140, ack 4216821, win 4036, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.368203 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4216821:4217089, ack 340140, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:42.369953 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340140:340185, ack 4217089, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.370327 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217089:4217193, ack 340185, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:42.372583 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340185:340273, ack 4217193, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:42.372665 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217193:4217232, ack 340273, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.375234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340273:340407, ack 4217232, win 4344, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:42.376136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217232:4217371, ack 340407, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:42.377766 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340407:340483, ack 4217371, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.378606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217371:4217443, ack 340483, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:42.380254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340483:340559, ack 4217443, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.381070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217443:4217531, ack 340559, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:42.382752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340559:340693, ack 4217531, win 4269, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:42.385303 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4217531:4218471, ack 340693, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:42.387417 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340693:340738, ack 4218471, win 4034, length 45SMB PACKET: SMBclose (REQUEST) 15:02:42.388103 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218471:4218510, ack 340738, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:42.470653 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4824:4883, ack 4521, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:42.471250 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4521:4580, ack 4883, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:42.569698 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4580, win 8192, length 0 15:02:42.589717 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4218510, win 4024, length 0 15:02:43.907765 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340738:340818, ack 4218510, win 4024, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.908823 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218510:4218614, ack 340818, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:43.910712 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340818:340898, ack 4218614, win 4380, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.911578 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218614:4218702, ack 340898, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:43.913332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340898:340978, ack 4218702, win 4358, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.914227 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218702:4218806, ack 340978, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:43.915791 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 340978:341058, ack 4218806, win 4332, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.916633 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218806:4218894, ack 341058, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:43.918275 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341058:341148, ack 4218894, win 4310, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:43.919153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4218894:4219033, ack 341148, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:43.921434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341148:341238, ack 4219033, win 4275, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.921519 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4219033:4219137, ack 341238, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:43.930070 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4219137:4223517, ack 341238, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:43.932342 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4220597, win 4380, length 0 15:02:43.932430 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4223517:4223545, ack 341238, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:43.934733 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4223517, win 4380, length 0 15:02:43.935985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341238:341326, ack 4223545, win 4373, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:43.973709 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 341326, win 3247, length 0 15:02:43.977171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341326:341416, ack 4223545, win 4373, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:43.977240 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 341416, win 3247, length 0 15:02:43.978102 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4223545:4223684, ack 341416, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:43.980422 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341416:341461, ack 4223684, win 4338, length 45SMB PACKET: SMBclose (REQUEST) 15:02:43.981366 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4223684:4223723, ack 341461, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:43.982967 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341461:341551, ack 4223723, win 4328, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:43.992016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4223723:4228103, ack 341551, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:43.992277 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228103:4228131, ack 341551, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:43.995169 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4226643, win 4380, length 0 15:02:43.997238 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4228131, win 4380, length 0 15:02:44.004055 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341551:341596, ack 4228131, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.005319 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228131:4228170, ack 341596, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.007703 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341596:341714, ack 4228170, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.008637 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228170:4228309, ack 341714, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.010366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341714:341790, ack 4228309, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.011219 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228309:4228381, ack 341790, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.012842 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341790:341866, ack 4228381, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.013732 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228381:4228469, ack 341866, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.015399 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341866:341984, ack 4228469, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.015785 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4228469:4228573, ack 341984, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.017437 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 341984:342072, ack 4228573, win 4269, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.020628 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4228573:4230033, ack 342072, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.020828 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4230033:4230773, ack 342072, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:44.023518 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4230773, win 4380, length 0 15:02:44.023904 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342072:342117, ack 4230773, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.027715 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4230773:4230812, ack 342117, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.030167 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342117:342217, ack 4230812, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.031088 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4230812:4230951, ack 342217, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.032721 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342217:342293, ack 4230951, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.033573 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4230951:4231023, ack 342293, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.035164 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342293:342369, ack 4231023, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.036000 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231023:4231111, ack 342369, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.037660 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342369:342469, ack 4231111, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.039372 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231111:4231691, ack 342469, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:44.041318 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342469:342514, ack 4231691, win 4150, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.042003 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231691:4231730, ack 342514, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.044351 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342514:342624, ack 4231730, win 4140, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.045277 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231730:4231869, ack 342624, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.046891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342624:342700, ack 4231869, win 4106, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.047731 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231869:4231941, ack 342700, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.049367 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342700:342776, ack 4231941, win 4088, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.050188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4231941:4232029, ack 342776, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.051858 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342776:342886, ack 4232029, win 4066, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.053400 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232029:4232525, ack 342886, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:44.055251 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342886:342931, ack 4232525, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.055645 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232525:4232629, ack 342931, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.057297 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 342931:343019, ack 4232629, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.057381 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232629:4232668, ack 343019, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.059809 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343019:343123, ack 4232668, win 4344, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.060684 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232668:4232807, ack 343123, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.062305 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343123:343199, ack 4232807, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.063147 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232807:4232879, ack 343199, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.064747 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343199:343275, ack 4232879, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.065621 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4232879:4232967, ack 343275, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.067312 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343275:343379, ack 4232967, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.087011 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4232967:4244647, ack 343379, win 3247, length 11680WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.090255 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4235887, win 4380, length 0 15:02:44.090353 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4244647:4249027, ack 343379, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:44.092570 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4238807, win 4380, length 0 15:02:44.092635 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249027:4249367, ack 343379, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:44.094897 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4241727, win 4380, length 0 15:02:44.097272 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4244647, win 4380, length 0 15:02:44.099645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4247567, win 4380, length 0 15:02:44.101793 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4249367, win 4380, length 0 15:02:44.102234 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343379:343420, ack 4249367, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:44.103073 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249367:4249406, ack 343420, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:44.104648 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343420:343465, ack 4249406, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.105350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249406:4249445, ack 343465, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.107720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343465:343575, ack 4249445, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.108606 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249445:4249584, ack 343575, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.110235 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343575:343651, ack 4249584, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.111067 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249584:4249656, ack 343651, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.112690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343651:343727, ack 4249656, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.112770 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249656:4249760, ack 343727, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.114410 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343727:343815, ack 4249760, win 4281, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.114494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4249760:4249848, ack 343815, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.116212 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343815:343925, ack 4249848, win 4259, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.122359 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4249848:4252768, ack 343925, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.122589 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4252768:4253236, ack 343925, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:44.126332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4252768, win 4380, length 0 15:02:44.126762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343925:343970, ack 4253236, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.127433 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4253236:4253275, ack 343970, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.129901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 343970:344072, ack 4253275, win 4253, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.130785 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4253275:4253414, ack 344072, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.132416 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344072:344148, ack 4253414, win 4218, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.133248 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4253414:4253486, ack 344148, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.134851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344148:344224, ack 4253486, win 4200, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.135724 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4253486:4253574, ack 344224, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.137384 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344224:344326, ack 4253574, win 4178, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.142723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4253574:4256494, ack 344326, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.142952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256494:4256586, ack 344326, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:44.145761 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4256494, win 4380, length 0 15:02:44.147135 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344326:344371, ack 4256586, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.147812 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256586:4256625, ack 344371, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.150619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344371:344467, ack 4256625, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.151482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256625:4256764, ack 344467, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.153113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344467:344543, ack 4256764, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.154043 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256764:4256836, ack 344543, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.155642 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344543:344619, ack 4256836, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.155723 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256836:4256940, ack 344619, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.157366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344619:344707, ack 4256940, win 4268, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.157448 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4256940:4257028, ack 344707, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.159163 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344707:344803, ack 4257028, win 4246, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.161619 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4257028:4258316, ack 344803, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:44.163891 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344803:344848, ack 4258316, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.164607 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4258316:4258355, ack 344848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.166990 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344848:344956, ack 4258355, win 4370, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.167875 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4258355:4258494, ack 344956, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.169511 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 344956:345032, ack 4258494, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.170351 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4258494:4258566, ack 345032, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.171971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345032:345108, ack 4258566, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.172790 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4258566:4258654, ack 345108, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.175739 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345108:345216, ack 4258654, win 4295, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.178777 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4258654:4260114, ack 345216, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.178986 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260114:4260122, ack 345216, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:44.181539 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4260122, win 4380, length 0 15:02:44.181989 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345216:345261, ack 4260122, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.182644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260122:4260161, ack 345261, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.185041 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345261:345379, ack 4260161, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.185923 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260161:4260300, ack 345379, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.187529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345379:345455, ack 4260300, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.188360 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260300:4260372, ack 345455, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.189971 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345455:345531, ack 4260372, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.190350 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260372:4260476, ack 345531, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.192008 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345531:345619, ack 4260476, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.192093 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4260476:4260564, ack 345619, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.193798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345619:345737, ack 4260564, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.199257 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4260564:4262024, ack 345737, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.199464 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4262024:4263332, ack 345737, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:44.202262 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4263332, win 4380, length 0 15:02:44.215085 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345737:345782, ack 4263332, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.215756 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4263332:4263371, ack 345782, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.221797 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345782:345884, ack 4263371, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.222669 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4263371:4263510, ack 345884, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.224431 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345884:345960, ack 4263510, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.225286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4263510:4263582, ack 345960, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.227049 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 345960:346036, ack 4263582, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.227866 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4263582:4263670, ack 346036, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.229596 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346036:346138, ack 4263670, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.243216 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4263670:4270970, ack 346138, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.243494 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4270970:4271158, ack 346138, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:44.248789 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4266590, win 4380, length 0 15:02:44.249241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4269510, win 4380, length 0 15:02:44.251492 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4271158, win 4380, length 0 15:02:44.251945 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346138:346183, ack 4271158, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.252620 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271158:4271197, ack 346183, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.255014 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346183:346285, ack 4271197, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.255917 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271197:4271336, ack 346285, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.257543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346285:346361, ack 4271336, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.258379 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271336:4271408, ack 346361, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.260027 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346361:346437, ack 4271408, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.260109 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271408:4271512, ack 346437, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.261802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346437:346525, ack 4271512, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.261883 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271512:4271600, ack 346525, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.263576 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346525:346627, ack 4271600, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.267286 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4271600:4272320, ack 346627, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:44.277393 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346627:346672, ack 4272320, win 4089, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.278191 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4272320:4272359, ack 346672, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.280921 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346672:346798, ack 4272359, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.281831 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4272359:4272498, ack 346798, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.283463 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346798:346874, ack 4272498, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.284380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4272498:4272570, ack 346874, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.285980 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346874:346950, ack 4272570, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.286805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4272570:4272658, ack 346950, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.288484 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 346950:347076, ack 4272658, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.314881 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4272658:4288718, ack 347076, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.318118 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4275578, win 4380, length 0 15:02:44.318208 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4288718:4288962, ack 347076, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:44.320388 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4278498, win 4380, length 0 15:02:44.323510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4281418, win 4380, length 0 15:02:44.325071 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4284338, win 4380, length 0 15:02:44.328937 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4287258, win 4380, length 0 15:02:44.329385 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4288962, win 4380, length 0 15:02:44.431515 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347076:347236, ack 4288962, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.437653 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4883:4969, ack 4580, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.438903 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4580:4680, ack 4969, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:44.448695 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 4969:5055, ack 4680, win 8192, length 86SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.449803 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4680:4768, ack 5055, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.459052 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 5055:5143, ack 4768, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.460087 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4768:4868, ack 5143, win 5360, length 100SMB PACKET: SMBtrans2 (REPLY) 15:02:44.463334 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4288962:4305022, ack 347236, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.463692 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4305022:4305382, ack 347236, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:44.467465 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4291882, win 4380, length 0 15:02:44.469075 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4294802, win 4380, length 0 15:02:44.469986 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 5143:5231, ack 4868, win 8192, length 88SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.470906 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4868:4956, ack 5231, win 5360, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.471392 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4297722, win 4380, length 0 15:02:44.473619 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4300642, win 4380, length 0 15:02:44.475975 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4303562, win 4380, length 0 15:02:44.478036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4305382, win 4380, length 0 15:02:44.478101 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4305382:4305486, ack 347236, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.478748 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347236:347352, ack 4305382, win 4380, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.480121 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347352:347440, ack 4305486, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.480369 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 5231:5336, ack 4956, win 8192, length 105SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.481083 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4956:4995, ack 5336, win 5360, length 39SMB PACKET: SMBntcreateX (REPLY) 15:02:44.505822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4305486:4321546, ack 347440, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.506176 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4321546:4321830, ack 347440, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:44.509024 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4308406, win 4380, length 0 15:02:44.511336 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4311326, win 4380, length 0 15:02:44.513616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4314246, win 4380, length 0 15:02:44.516093 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4317166, win 4380, length 0 15:02:44.518472 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4320086, win 4380, length 0 15:02:44.520557 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4321830, win 4380, length 0 15:02:44.521009 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347440:347481, ack 4321830, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:44.521871 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4321830:4321869, ack 347481, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:44.523442 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347481:347526, ack 4321869, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.524178 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4321869:4321908, ack 347526, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.526654 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347526:347654, ack 4321908, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.526739 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4321908:4322012, ack 347654, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.528425 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347654:347742, ack 4322012, win 4334, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.528512 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4322012:4322151, ack 347742, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.532421 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347742:347818, ack 4322151, win 4299, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.533259 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4322151:4322223, ack 347818, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.535810 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 4995, win 8192, length 0 15:02:44.541812 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347818:347894, ack 4322223, win 4281, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.542626 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4322223:4322311, ack 347894, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.544403 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 347894:348022, ack 4322311, win 4259, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.550899 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4322311:4325231, ack 348022, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.551139 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4325231:4325731, ack 348022, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:44.554035 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4325231, win 4380, length 0 15:02:44.555542 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348022:348067, ack 4325731, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.556218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4325731:4325770, ack 348067, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.558659 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348067:348175, ack 4325770, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.559533 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4325770:4325909, ack 348175, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.561179 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348175:348251, ack 4325909, win 4210, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.562015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4325909:4325981, ack 348251, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.563611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348251:348327, ack 4325981, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.564515 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4325981:4326069, ack 348327, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.566193 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348327:348435, ack 4326069, win 4170, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.569941 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4326069:4327529, ack 348435, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:44.570142 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4327529:4327965, ack 348435, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:44.572786 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4327965, win 4380, length 0 15:02:44.573162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348435:348480, ack 4327965, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.573514 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4327965:4328069, ack 348480, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.575162 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348480:348568, ack 4328069, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.575247 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4328069:4328108, ack 348568, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.577658 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348568:348694, ack 4328108, win 4344, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.578548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4328108:4328247, ack 348694, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.580176 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348694:348770, ack 4328247, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.581015 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4328247:4328319, ack 348770, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.582618 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348770:348846, ack 4328319, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.583473 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4328319:4328407, ack 348846, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.585501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348846:348972, ack 4328407, win 4269, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.587541 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4328407:4329107, ack 348972, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:44.595626 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 348972:349017, ack 4329107, win 4094, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.596320 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329107:4329146, ack 349017, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.598728 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349017:349151, ack 4329146, win 4084, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.599604 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329146:4329285, ack 349151, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.601246 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349151:349227, ack 4329285, win 4050, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.602076 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329285:4329357, ack 349227, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.603842 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349227:349303, ack 4329357, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.604672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329357:4329445, ack 349303, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.606366 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349303:349437, ack 4329445, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.607600 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329445:4329713, ack 349437, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:44.609365 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349437:349482, ack 4329713, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.610039 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329713:4329752, ack 349482, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.612500 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349482:349616, ack 4329752, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:44.613446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329752:4329891, ack 349616, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:44.615057 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349616:349692, ack 4329891, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.615443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329891:4329995, ack 349692, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:44.617113 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349692:349780, ack 4329995, win 4242, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:44.617199 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4329995:4330067, ack 349780, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:44.618959 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349780:349856, ack 4330067, win 4224, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.619790 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4330067:4330155, ack 349856, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:44.621531 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349856:349990, ack 4330155, win 4202, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:44.624698 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4330155:4331095, ack 349990, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:44.626802 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 349990:350035, ack 4331095, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:44.627780 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331095:4331134, ack 350035, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:44.820544 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4331134, win 4370, length 0 15:02:46.139616 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350035:350115, ack 4331134, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.140663 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331134:4331238, ack 350115, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:46.142516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350115:350195, ack 4331238, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.143382 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331238:4331326, ack 350195, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.145002 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350195:350275, ack 4331326, win 4322, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.145859 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331326:4331430, ack 350275, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:46.148028 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350275:350355, ack 4331430, win 4296, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.148856 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331430:4331518, ack 350355, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.150580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350355:350445, ack 4331518, win 4274, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.151443 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4331518:4331657, ack 350445, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.153867 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350445:350535, ack 4331657, win 4239, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.162315 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4331657:4336037, ack 350535, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.162555 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4336037:4336065, ack 350535, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:46.167171 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4334577, win 4380, length 0 15:02:46.170030 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4336065, win 4380, length 0 15:02:46.171826 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350535:350625, ack 4336065, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.172190 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4336065:4336169, ack 350625, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.365063 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4336169, win 4354, length 0 15:02:46.365153 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4336169:4336308, ack 350625, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.375755 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350625:350713, ack 4336308, win 4319, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.413710 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 350713, win 3247, length 0 15:02:46.415439 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350713:350803, ack 4336308, win 4319, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.415499 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 350803, win 3247, length 0 15:02:46.423894 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4336308:4340688, ack 350803, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.424136 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4340688:4340716, ack 350803, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:46.426969 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4339228, win 4380, length 0 15:02:46.430529 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4340716, win 4380, length 0 15:02:46.430957 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350803:350848, ack 4340716, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.431644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4340716:4340755, ack 350848, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.439811 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350848:350893, ack 4340755, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.440517 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4340755:4340794, ack 350893, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.446798 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 350893:351011, ack 4340794, win 4360, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.447753 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4340794:4340933, ack 351011, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.450720 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351011:351087, ack 4340933, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.451580 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4340933:4341005, ack 351087, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.453254 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351087:351163, ack 4341005, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.454129 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4341005:4341093, ack 351163, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.455838 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351163:351281, ack 4341093, win 4285, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.460339 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4341093:4342553, ack 351281, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.460548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4342553:4343293, ack 351281, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:46.463243 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4343293, win 4380, length 0 15:02:46.463635 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351281:351326, ack 4343293, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.464353 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343293:4343332, ack 351326, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.466736 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351326:351426, ack 4343332, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.466818 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343332:4343436, ack 351426, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.468510 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351426:351514, ack 4343436, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.468595 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343436:4343575, ack 351514, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.470253 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351514:351590, ack 4343575, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.471083 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343575:4343647, ack 351590, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.472688 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351590:351666, ack 4343647, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.473500 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343647:4343735, ack 351666, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.475287 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351666:351766, ack 4343735, win 4269, length 100SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.477042 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4343735:4344315, ack 351766, win 3247, length 580SMB PACKET: SMBtrans2 (REPLY) 15:02:46.478993 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351766:351811, ack 4344315, win 4124, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.479686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4344315:4344354, ack 351811, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.482114 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351811:351921, ack 4344354, win 4114, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.483031 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4344354:4344493, ack 351921, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.484638 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351921:351997, ack 4344493, win 4080, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.485508 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4344493:4344565, ack 351997, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.487100 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 351997:352073, ack 4344565, win 4062, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.487935 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4344565:4344653, ack 352073, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.489620 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352073:352183, ack 4344653, win 4040, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.491160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4344653:4345149, ack 352183, win 3247, length 496SMB PACKET: SMBtrans2 (REPLY) 15:02:46.493036 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352183:352228, ack 4345149, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.493845 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4345149:4345188, ack 352228, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.496208 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352228:352332, ack 4345188, win 4370, length 104SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.497084 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4345188:4345327, ack 352332, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.498694 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352332:352408, ack 4345327, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.499520 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4345327:4345399, ack 352408, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.501156 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352408:352484, ack 4345399, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.501237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4345399:4345503, ack 352484, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.502885 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352484:352572, ack 4345503, win 4291, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.502967 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4345503:4345591, ack 352572, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.504659 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352572:352676, ack 4345591, win 4269, length 104SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.524318 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4345591:4355811, ack 352676, win 3247, length 10220WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.527434 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4348511, win 4380, length 0 15:02:46.527530 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4355811:4360191, ack 352676, win 3247, length 4380SMB-over-TCP packet:(raw data or continuation?) 15:02:46.531512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4351431, win 4380, length 0 15:02:46.531585 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4360191:4361651, ack 352676, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:46.531627 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4361651:4361991, ack 352676, win 3247, length 340SMB-over-TCP packet:(raw data or continuation?) 15:02:46.533851 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4354351, win 4380, length 0 15:02:46.536288 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4357271, win 4380, length 0 15:02:46.538690 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4360191, win 4380, length 0 15:02:46.540833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4361991, win 4380, length 0 15:02:46.561222 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352676:352717, ack 4361991, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:46.562081 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4361991:4362030, ack 352717, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:46.563843 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352717:352762, ack 4362030, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.564569 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4362030:4362069, ack 352762, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.567070 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352762:352872, ack 4362069, win 4360, length 110SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.567975 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4362069:4362208, ack 352872, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.569751 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352872:352948, ack 4362208, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.570598 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4362208:4362280, ack 352948, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.572223 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 352948:353024, ack 4362280, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.573045 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4362280:4362368, ack 353024, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.574723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353024:353134, ack 4362368, win 4285, length 110SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.580872 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4362368:4365288, ack 353134, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.581207 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4365288:4365756, ack 353134, win 3247, length 468SMB-over-TCP packet:(raw data or continuation?) 15:02:46.584023 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4365288, win 4380, length 0 15:02:46.585571 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353134:353179, ack 4365756, win 4263, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.585644 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4365756:4365860, ack 353179, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.587501 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353179:353267, ack 4365860, win 4237, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.587582 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4365860:4365899, ack 353267, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.590082 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353267:353369, ack 4365899, win 4227, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.591002 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4365899:4366038, ack 353369, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.592630 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353369:353445, ack 4366038, win 4192, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.593467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4366038:4366110, ack 353445, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.595060 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353445:353521, ack 4366110, win 4174, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.595895 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4366110:4366198, ack 353521, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.597580 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353521:353623, ack 4366198, win 4152, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.602928 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4366198:4369118, ack 353623, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.603159 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369118:4369210, ack 353623, win 3247, length 92SMB-over-TCP packet:(raw data or continuation?) 15:02:46.606032 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4369118, win 4380, length 0 15:02:46.607406 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353623:353668, ack 4369210, win 4357, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.608118 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369210:4369249, ack 353668, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.610512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353668:353764, ack 4369249, win 4347, length 96SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.611384 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369249:4369388, ack 353764, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.613050 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353764:353840, ack 4369388, win 4312, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.613952 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369388:4369460, ack 353840, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.615572 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353840:353916, ack 4369460, win 4294, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.616390 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369460:4369548, ack 353916, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.618052 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 353916:354012, ack 4369548, win 4272, length 96SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.620675 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4369548:4370836, ack 354012, win 3247, length 1288SMB PACKET: SMBtrans2 (REPLY) 15:02:46.622985 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354012:354057, ack 4370836, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.623071 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4370836:4370940, ack 354057, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.624756 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354057:354145, ack 4370940, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.624840 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4370940:4370979, ack 354145, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.627276 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354145:354253, ack 4370979, win 4344, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.628160 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4370979:4371118, ack 354253, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.629794 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354253:354329, ack 4371118, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.630672 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4371118:4371190, ack 354329, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.633210 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354329:354405, ack 4371190, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.634090 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4371190:4371278, ack 354405, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.635758 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354405:354513, ack 4371278, win 4269, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.638732 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4371278:4372738, ack 354513, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.638935 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4372738:4372746, ack 354513, win 3247, length 8SMB-over-TCP packet:(raw data or continuation?) 15:02:46.641408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4372746, win 4380, length 0 15:02:46.641903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354513:354558, ack 4372746, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.642562 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4372746:4372785, ack 354558, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.644962 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354558:354676, ack 4372785, win 4370, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.645853 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4372785:4372924, ack 354676, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.647490 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354676:354752, ack 4372924, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.648321 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4372924:4372996, ack 354752, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.650029 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354752:354828, ack 4372996, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.650844 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4372996:4373084, ack 354828, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.652521 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354828:354946, ack 4373084, win 4295, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.658034 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4373084:4374544, ack 354946, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.658244 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4374544:4375852, ack 354946, win 3247, length 1308SMB-over-TCP packet:(raw data or continuation?) 15:02:46.661039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4375852, win 4380, length 0 15:02:46.661128 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4375852:4375956, ack 354946, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.679259 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354946:354991, ack 4375956, win 4354, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.680091 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4375956:4375995, ack 354991, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.682830 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 354991:355093, ack 4375995, win 4344, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.683341 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355093:355181, ack 4375995, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.684016 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4375995:4376134, ack 355181, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.686724 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355181:355257, ack 4376134, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.687613 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4376134:4376206, ack 355257, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.689411 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355257:355333, ack 4376206, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.690237 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4376206:4376294, ack 355333, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.691924 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355333:355435, ack 4376294, win 4269, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.705667 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4376294:4383594, ack 355435, win 3247, length 7300WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.705929 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4383594:4383782, ack 355435, win 3247, length 188SMB-over-TCP packet:(raw data or continuation?) 15:02:46.711325 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4379214, win 4380, length 0 15:02:46.711672 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4382134, win 4380, length 0 15:02:46.712846 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4383782, win 4380, length 0 15:02:46.713241 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355435:355480, ack 4383782, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.713972 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4383782:4383821, ack 355480, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.716359 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355480:355582, ack 4383821, win 4370, length 102SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.717282 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4383821:4383960, ack 355582, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.718944 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355582:355658, ack 4383960, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.719787 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4383960:4384032, ack 355658, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.721408 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355658:355734, ack 4384032, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.722221 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4384032:4384120, ack 355734, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.723879 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355734:355836, ack 4384120, win 4295, length 102SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.725843 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4384120:4384840, ack 355836, win 3247, length 720SMB PACKET: SMBtrans2 (REPLY) 15:02:46.735033 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355836:355881, ack 4384840, win 4115, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.735121 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4384840:4384944, ack 355881, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.736825 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355881:355969, ack 4384944, win 4089, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.736908 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4384944:4384983, ack 355969, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.739390 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 355969:356095, ack 4384983, win 4079, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.740284 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4384983:4385122, ack 356095, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.741903 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356095:356171, ack 4385122, win 4045, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.742748 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4385122:4385194, ack 356171, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.744348 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356171:356247, ack 4385194, win 4027, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.745233 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4385194:4385282, ack 356247, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.746901 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356247:356373, ack 4385282, win 4380, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.773181 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4385282:4399882, ack 356373, win 3247, length 14600WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.778885 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4388202, win 4380, length 0 15:02:46.779261 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4391122, win 4380, length 0 15:02:46.779337 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4399882:4401342, ack 356373, win 3247, length 1460SMB-over-TCP packet:(raw data or continuation?) 15:02:46.779380 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4401342:4401586, ack 356373, win 3247, length 244SMB-over-TCP packet:(raw data or continuation?) 15:02:46.780723 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4394042, win 4380, length 0 15:02:46.783067 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4396962, win 4380, length 0 15:02:46.785405 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4399882, win 4380, length 0 15:02:46.787543 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4401586, win 4380, length 0 15:02:46.788160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356373:356533, ack 4401586, win 4380, length 160SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.814548 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4401586:4417646, ack 356533, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.814885 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4417646:4418006, ack 356533, win 3247, length 360SMB-over-TCP packet:(raw data or continuation?) 15:02:46.817771 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4404506, win 4380, length 0 15:02:46.820157 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4407426, win 4380, length 0 15:02:46.822512 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4410346, win 4380, length 0 15:02:46.824833 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4413266, win 4380, length 0 15:02:46.827323 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4416186, win 4380, length 0 15:02:46.829486 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4418006, win 4380, length 0 15:02:46.829563 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4418006:4418110, ack 356533, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.840601 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356533:356649, ack 4418110, win 4354, length 116SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.841068 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356649:356737, ack 4418110, win 4354, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.866419 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4418110:4434170, ack 356737, win 3247, length 16060WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.866755 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434170:4434454, ack 356737, win 3247, length 284SMB-over-TCP packet:(raw data or continuation?) 15:02:46.870418 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4421030, win 4380, length 0 15:02:46.871889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4423950, win 4380, length 0 15:02:46.874278 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4426870, win 4380, length 0 15:02:46.876686 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4429790, win 4380, length 0 15:02:46.879099 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4432710, win 4380, length 0 15:02:46.881133 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4434454, win 4380, length 0 15:02:46.881614 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356737:356778, ack 4434454, win 4380, length 41SMB PACKET: SMBfindclose (REQUEST) 15:02:46.882467 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434454:4434493, ack 356778, win 3247, length 39SMB PACKET: SMBfindclose (REPLY) 15:02:46.884039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356778:356823, ack 4434493, win 4370, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.884740 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434493:4434532, ack 356823, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.887182 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356823:356951, ack 4434532, win 4360, length 128SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.888089 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434532:4434671, ack 356951, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.889717 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 356951:357027, ack 4434671, win 4325, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.890558 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434671:4434743, ack 357027, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.892160 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357027:357103, ack 4434743, win 4307, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.892977 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4434743:4434831, ack 357103, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.894645 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357103:357231, ack 4434831, win 4285, length 128SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.901138 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4434831:4437751, ack 357231, win 3247, length 2920WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.901370 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4437751:4438251, ack 357231, win 3247, length 500SMB-over-TCP packet:(raw data or continuation?) 15:02:46.904202 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4437751, win 4380, length 0 15:02:46.905772 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357231:357276, ack 4438251, win 4255, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.906454 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4438251:4438290, ack 357276, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.908914 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357276:357384, ack 4438290, win 4245, length 108SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.908996 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4438290:4438394, ack 357384, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.910734 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357384:357472, ack 4438394, win 4219, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.910823 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4438394:4438533, ack 357472, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.912553 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357472:357548, ack 4438533, win 4184, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.913393 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4438533:4438605, ack 357548, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.915002 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357548:357624, ack 4438605, win 4166, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.915841 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4438605:4438693, ack 357624, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.917507 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357624:357732, ack 4438693, win 4144, length 108SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.921345 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4438693:4440153, ack 357732, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:46.921547 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440153:4440589, ack 357732, win 3247, length 436SMB-over-TCP packet:(raw data or continuation?) 15:02:46.924144 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4440589, win 4380, length 0 15:02:46.924516 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357732:357777, ack 4440589, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.925188 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440589:4440628, ack 357777, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.927594 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357777:357903, ack 4440628, win 4370, length 126SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.928477 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440628:4440767, ack 357903, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.930108 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357903:357979, ack 4440767, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.930954 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440767:4440839, ack 357979, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.932549 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 357979:358055, ack 4440839, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.933409 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440839:4440927, ack 358055, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.935069 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358055:358181, ack 4440927, win 4295, length 126SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.937114 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4440927:4441627, ack 358181, win 3247, length 700SMB PACKET: SMBtrans2 (REPLY) 15:02:46.945332 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358181:358226, ack 4441627, win 4120, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.946029 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4441627:4441666, ack 358226, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.948478 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358226:358360, ack 4441666, win 4110, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.949641 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4441666:4441805, ack 358360, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.951289 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358360:358436, ack 4441805, win 4076, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.951376 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4441805:4441909, ack 358436, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:46.953024 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358436:358524, ack 4441909, win 4050, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:46.953107 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4441909:4441981, ack 358524, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.954762 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358524:358600, ack 4441981, win 4032, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.955649 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4441981:4442069, ack 358600, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.957342 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358600:358734, ack 4442069, win 4380, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.958837 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442069:4442337, ack 358734, win 3247, length 268SMB PACKET: SMBtrans2 (REPLY) 15:02:46.960657 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358734:358779, ack 4442337, win 4313, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.961355 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442337:4442376, ack 358779, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:46.963778 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358779:358913, ack 4442376, win 4303, length 134SMB PACKET: SMBntcreateX (REQUEST) 15:02:46.964686 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442376:4442515, ack 358913, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:46.966304 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358913:358989, ack 4442515, win 4268, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.967154 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442515:4442587, ack 358989, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:46.968752 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 358989:359065, ack 4442587, win 4250, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.969618 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442587:4442675, ack 359065, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:46.971308 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359065:359199, ack 4442675, win 4228, length 134SMB PACKET: SMBtrans2 (REQUEST) 15:02:46.973870 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4442675:4443615, ack 359199, win 3247, length 940SMB PACKET: SMBtrans2 (REPLY) 15:02:46.975984 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359199:359244, ack 4443615, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:46.976696 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4443615:4443654, ack 359244, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:47.176073 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4443654, win 4370, length 0 15:02:47.491035 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [P.], seq 5336:5395, ack 4995, win 8192, length 59SMB PACKET: SMBecho (REQUEST) 15:02:47.491695 IP guruplug.microsoft-ds > 192.168.0.10.6815: Flags [P.], seq 4995:5054, ack 5395, win 5360, length 59SMB PACKET: SMBecho (REPLY) 15:02:47.648825 IP 192.168.0.10.6815 > guruplug.microsoft-ds: Flags [.], ack 5054, win 8192, length 0 15:02:48.476010 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359244:359324, ack 4443654, win 4370, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.477025 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4443654:4443758, ack 359324, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:48.480473 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359324:359404, ack 4443758, win 4344, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.480886 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4443758:4443862, ack 359404, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:48.673687 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4443862, win 4318, length 0 15:02:48.673805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4443862:4443950, ack 359404, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:48.675565 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359404:359484, ack 4443950, win 4296, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.676435 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4443950:4444054, ack 359484, win 3247, length 104SMB PACKET: SMBtrans2 (REPLY) 15:02:48.678015 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359484:359564, ack 4444054, win 4270, length 80SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.679531 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4444054:4444142, ack 359564, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:48.681403 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359564:359654, ack 4444142, win 4248, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:48.682302 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4444142:4444281, ack 359654, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:48.684602 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359654:359742, ack 4444281, win 4213, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:48.723713 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 359742, win 3247, length 0 15:02:48.725420 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359742:359832, ack 4444281, win 4213, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.725482 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 359832, win 3247, length 0 15:02:48.733908 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4444281:4448661, ack 359832, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:48.734155 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4448661:4448689, ack 359832, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:48.738931 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4447201, win 4380, length 0 15:02:48.742306 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4448689, win 4380, length 0 15:02:48.744926 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359832:359922, ack 4448689, win 4380, length 90SMB PACKET: SMBntcreateX (REQUEST) 15:02:48.745805 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4448689:4448828, ack 359922, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:48.747730 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359922:359967, ack 4448828, win 4345, length 45SMB PACKET: SMBclose (REQUEST) 15:02:48.748426 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4448828:4448867, ack 359967, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:48.750039 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 359967:360057, ack 4448867, win 4335, length 90SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.758446 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4448867:4453247, ack 360057, win 3247, length 4380WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:48.758701 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453247:4453275, ack 360057, win 3247, length 28SMB-over-TCP packet:(raw data or continuation?) 15:02:48.765443 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4451787, win 4380, length 0 15:02:48.765894 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4453275, win 4380, length 0 15:02:48.772611 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360057:360102, ack 4453275, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:48.772966 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453275:4453379, ack 360102, win 3247, length 104SMB PACKET: SMBnttrans (REPLY) 15:02:48.970058 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4453379, win 4354, length 0 15:02:48.970147 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453379:4453418, ack 360102, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:48.988323 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360102:360190, ack 4453418, win 4344, length 88SMB PACKET: SMBnttrans (REQUEST) 15:02:48.989177 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360190:360308, ack 4453418, win 4344, length 118SMB PACKET: SMBntcreateX (REQUEST) 15:02:48.989401 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], ack 360308, win 3247, length 0 15:02:48.990218 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453418:4453557, ack 360308, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:48.993779 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360308:360384, ack 4453557, win 4309, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.994647 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453557:4453629, ack 360384, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:48.997375 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360384:360460, ack 4453629, win 4291, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:48.998200 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4453629:4453717, ack 360460, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:49.000045 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360460:360578, ack 4453717, win 4269, length 118SMB PACKET: SMBtrans2 (REQUEST) 15:02:49.004617 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [.], seq 4453717:4455177, ack 360578, win 3247, length 1460WARNING: Packet is continued in later TCP segments SMB PACKET: SMBtrans2 (REPLY) 15:02:49.004822 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4455177:4455917, ack 360578, win 3247, length 740SMB-over-TCP packet:(raw data or continuation?) 15:02:49.008987 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [.], ack 4455917, win 4380, length 0 15:02:49.009409 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360578:360623, ack 4455917, win 4380, length 45SMB PACKET: SMBclose (REQUEST) 15:02:49.010074 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4455917:4455956, ack 360623, win 3247, length 39SMB PACKET: SMBclose (REPLY) 15:02:49.013032 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360623:360723, ack 4455956, win 4370, length 100SMB PACKET: SMBntcreateX (REQUEST) 15:02:49.013943 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4455956:4456095, ack 360723, win 3247, length 139SMB PACKET: SMBntcreateX (REPLY) 15:02:49.015547 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360723:360799, ack 4456095, win 4335, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:49.016398 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4456095:4456167, ack 360799, win 3247, length 72SMB PACKET: SMBtrans2 (REPLY) 15:02:49.018329 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360799:360875, ack 4456167, win 4317, length 76SMB PACKET: SMBtrans2 (REQUEST) 15:02:49.019197 IP guruplug.microsoft-ds > 192.168.0.2.50712: Flags [P.], seq 4456167:4456255, ack 360875, win 3247, length 88SMB PACKET: SMBtrans2 (REPLY) 15:02:49.020889 IP 192.168.0.2.50712 > guruplug.microsoft-ds: Flags [P.], seq 360875:360975, ack 4456255, win 4295, length 100SMB PACKET: SMBtrans2 (REQUEST)