WifiLamp: Difference between revisions
Jump to navigation
Jump to search
m (→Protocol) |
|||
| Line 38: | Line 38: | ||
I sniffed the protocol using TCP dump, running on an OpenWRT based wireless router. | I sniffed the protocol using TCP dump, running on an OpenWRT based wireless router. | ||
My laptop, Android phone and the WiFi lamp were all connected to this router. | My laptop, Android phone and the WiFi lamp were all connected to this router. | ||
See https://images.tuyacn.com/smart/aircondition/Guide-to-Interworking-with-the-Tuya-MCU.pdf | |||
Changing the state of the lamp by the app causes a message to be sent to | Changing the state of the lamp by the app causes a message to be sent to | ||
Revision as of 22:35, 6 November 2019
| Project WifiLamp | |
|---|---|
| |
| Investigating my Action WiFi enabled LED lamp | |
| Status | In progress |
| Contact | bertrik |
| Last Update | 2019-11-06 |
Intro
This page is about a WiFi enabled LED lamp from the Action store, with E27 form factor. The associated Android app refers to this lamp as A60 RGB-CCT.
I hoped this would be an ESP8266 based lamp, so it can possibly be flashed with my StofAnanas/stoflama firmware so it can indicate local air quality (PM10).
More info:
- https://www.action.com/nl-nl/p/lsc-smart-connect-slimme-multicolor-ledlamp-3/
- https://www.letscontrolit.com/forum/viewtopic.php?t=6955
- https://www.circuitsonline.net/forum/view/146361/1
- https://github.com/arendst/Tasmota/issues/6495 This thread unfortunately mentions the bulb with E27 base as *not* containing an ESP8266
Still it might be nice if I can add an output option to send the particulate matter RGB value to a bulb like this, using the UDP protocol.
Hardware info
The lamp communicates over 2.4 GHz WiFi.
Inside is a SM2135 LED controller.
It has two setup modes, triggered by switching it off-and-on three times quickly in a row
- fast blink mode: about 1 blink per second
- slow blink mode: about 1 blink per 3 seconds
The manufacturer part of the MAC address (68:57:2d:1a:6a:ea) points to "HANGZHOU AIXIANGJI TECHNOLOGY CO., LTD", see https://www.cleancss.com/mac-lookup/68-57-2D
It received ip address 192.168.1.240 through DHCP from an OpenWRT router.
Protocol
I sniffed the protocol using TCP dump, running on an OpenWRT based wireless router. My laptop, Android phone and the WiFi lamp were all connected to this router.
See https://images.tuyacn.com/smart/aircondition/Guide-to-Interworking-with-the-Tuya-MCU.pdf
Changing the state of the lamp by the app causes a message to be sent to ec2-3-121-210-75.eu-central-1.compute.amazonaws.com.8886
The local protocol appears to use UDP (?). There is an UDP broadcast message sent by the lamp every 3 seconds or so, consisting of 172 bytes. The contents of the UDP broadcast message does not depend on the lighting state of the lamp (brightness or colour temperature).
In both directions a TCP packet message to have the same structure. Example of a command to turn the lamp ON:
Command:
- 00 00 55 AA: probably some kind of "magic header"
- 00 00 00 17: some number, maybe a command or sequence number
- 00 00 00 0D: some number, maybe a command or sequence number
- 00 00 00 37: the size of the rest of the packet
- 33 2E 33 00: "3.3\0" in ASCII, perhaps a protocol version
- 00 00 00 00: ?
- 00 00 53 00: ... more data
- 00 00 AA 55: footer
Response 1:
- 00 00 55 AA header
- 00 00 00 00 ?
- 00 00 00 08 ?
- 00 00 00 4B size
- more data
- 00 00 AA 55: footer
Response 2:
- 00 00 55 AA header
- 00 00 00 17 ?
- 00 00 00 0D ?
- 00 00 00 0C size
- 00 00 00 00 ?
- 24 C9 5A 8D ?
- 00 00 AA 55: footer
broadcast
The broadcast message is 164 bytes, starts with 0000 55aa, and ends with 0000 aa55.
Capture
In the captures below:
- 192.168.1.178 is the IP address of my Android phone sending commands to the lamp
- 192.168.1.240 is the IP address of the WiFi lamp itself
Broadcast
In OFF mode, it sends:
21:17:39.434577 IP 192.168.1.240.49153 > 255.255.255.255.6667: UDP, length 172
0x0000: 4500 00c8 0609 0000 ff11 f283 c0a8 01f0 E...............
0x0010: ffff ffff c001 1a0b 00b4 f1e8 0000 55aa ..............U.
0x0020: 0000 0000 0000 0013 0000 009c 0000 0000 ................
0x0030: d097 6667 6f33 69eb 10b5 e9f1 32fd 802a ..fgo3i.....2..*
0x0040: 748d b61a 5e0b 3034 aff7 9af9 cddc f214 t...^.04........
0x0050: 4ef9 12df 8046 2fa3 7469 859b 52d0 97eb N....F/.ti..R...
0x0060: 35d6 9379 4bc7 a48f 53c5 29be 7e05 2782 5..yK...S.).~.'.
0x0070: 7256 f992 ef0b b3c9 946f 6ca8 e2e1 4853 rV.......ol...HS
0x0080: 2e0d bc9a 92c3 3172 86eb f238 be57 9786 ......1r...8.W..
0x0090: a9e3 b2e7 b4bb 197b 7ef4 b0f2 267e 06c8 .......{~...&~..
0x00a0: 5594 f0a3 1645 4ac1 6035 27f9 845c 201b U....EJ.`5'..\..
0x00b0: 7a23 e3b2 249f 5adf 48a7 14f8 51aa f439 z#..$.Z.H...Q..9
0x00c0: e9a5 9add 0000 aa55 .......U
In ON mode, it sends:
21:17:59.439649 IP 192.168.1.240.49153 > 255.255.255.255.6667: UDP, length 172
0x0000: 4500 00c8 060f 0000 ff11 f27d c0a8 01f0 E..........}....
0x0010: ffff ffff c001 1a0b 00b4 f1e8 0000 55aa ..............U.
0x0020: 0000 0000 0000 0013 0000 009c 0000 0000 ................
0x0030: d097 6667 6f33 69eb 10b5 e9f1 32fd 802a ..fgo3i.....2..*
0x0040: 748d b61a 5e0b 3034 aff7 9af9 cddc f214 t...^.04........
0x0050: 4ef9 12df 8046 2fa3 7469 859b 52d0 97eb N....F/.ti..R...
0x0060: 35d6 9379 4bc7 a48f 53c5 29be 7e05 2782 5..yK...S.).~.'.
0x0070: 7256 f992 ef0b b3c9 946f 6ca8 e2e1 4853 rV.......ol...HS
0x0080: 2e0d bc9a 92c3 3172 86eb f238 be57 9786 ......1r...8.W..
0x0090: a9e3 b2e7 b4bb 197b 7ef4 b0f2 267e 06c8 .......{~...&~..
0x00a0: 5594 f0a3 1645 4ac1 6035 27f9 845c 201b U....EJ.`5'..\..
0x00b0: 7a23 e3b2 249f 5adf 48a7 14f8 51aa f439 z#..$.Z.H...Q..9
0x00c0: e9a5 9add 0000 aa55
Packet structure:
- 4500: IPv4, UDP
- 00c8: total length
- 060f: identification
- 0000: flags + framentation offset
- ff11: time-to-live + protocol
- f27d: header checksum
- c0a8 01f0: source address = 192.168.0.240
- ffff ffff: destination address = 255.255.255.255
- c001 1a0b: options + padding
- 00b4 f1e8: ???
- 0000 55aa: payload data
Turn ON
Turn ON the lamp: (captured with tcpdump -i wlan0 host 192.168.1.240 -X)
20:40:56.712025 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [P.], seq 137:208, ack 173, win 65535, length 71
0x0000: 4500 006f 9522 4000 4006 2074 c0a8 01b2 E..o."@.@..t....
0x0010: c0a8 01f0 a23a 1a0c fa68 52cc 0000 948d .....:...hR.....
0x0020: 5018 ffff e352 0000 0000 55aa 0000 0002 P....R....U.....
0x0030: 0000 000d 0000 0037 332e 3300 0000 0000 .......73.3.....
0x0040: 0000 0700 0920 d832 0d91 0fb0 41e1 240d .......2....A.$.
0x0050: c133 b03e c6da 47a5 9b4f bcd1 e4b9 8a03 .3.>..G..O......
0x0060: dee7 2c3f cc02 5a2b 04c4 af00 00aa 55 ..,?..Z+......U
20:40:56.712085 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [P.], seq 137:208, ack 173, win 65535, length 71
0x0000: 4500 006f 9522 4000 4006 2074 c0a8 01b2 E..o."@.@..t....
0x0010: c0a8 01f0 a23a 1a0c fa68 52cc 0000 948d .....:...hR.....
0x0020: 5018 ffff e352 0000 0000 55aa 0000 0002 P....R....U.....
0x0030: 0000 000d 0000 0037 332e 3300 0000 0000 .......73.3.....
0x0040: 0000 0700 0920 d832 0d91 0fb0 41e1 240d .......2....A.$.
0x0050: c133 b03e c6da 47a5 9b4f bcd1 e4b9 8a03 .3.>..G..O......
0x0060: dee7 2c3f cc02 5a2b 04c4 af00 00aa 55 ..,?..Z+......U
20:40:56.720005 IP 192.168.1.240.49153 > ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886: Flags [P.], seq 138:319, ack 139, win 2368, length 181
0x0000: 4500 00dd 03d4 0000 ff06 078b c0a8 01f0 E...............
0x0010: 12b9 da6a c001 22b6 0000 3e44 4a38 df8e ...j.."...>DJ8..
0x0020: 5018 0940 d7e8 0000 1703 0300 b042 416f P..@.........BAo
0x0030: 6862 6d64 3661 4739 3149 4652 31f8 e4a1 hbmd6aG91IFR1...
0x0040: 84ce d52e bdc1 a36d 84e3 43e1 10e9 0b16 .......m..C.....
0x0050: 2702 bc93 e1f1 aad3 fa06 3ec4 fa3d b2fa '.........>..=..
0x0060: 8238 7687 6f05 8abf 140b 4da3 5cee c8b8 .8v.o.....M.\...
0x0070: aa4f cd1f c989 1ca9 1d0c 795f c06a d484 .O........y_.j..
0x0080: 2a6f 924b 2cf8 c2a1 7585 a85b a136 5cc1 *o.K,...u..[.6\.
0x0090: 80ac 1404 4850 2881 4a8a b76b 411a ae59 ....HP(.J..kA..Y
0x00a0: 1b7a bbb8 aba7 4ff1 3783 7bc1 de48 72cd .z....O.7.{..Hr.
0x00b0: 9a98 e1b9 457c 81c1 9254 d377 27eb ed3c ....E|...T.w'..<
0x00c0: 9fe4 263e 41ca fc6e 1526 ef33 e7f8 88be ..&>A..n.&.3....
0x00d0: e92b 6456 f8a2 c599 797b 7a8e 1f .+dV....y{z..
20:40:56.720845 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 173:264, ack 208, win 2713, length 91
0x0000: 4500 0083 03d5 0000 ff06 32ad c0a8 01f0 E.........2.....
0x0010: c0a8 01b2 1a0c a23a 0000 948d fa68 5313 .......:.....hS.
0x0020: 5018 0a99 d5e4 0000 0000 55aa 0000 0000 P.........U.....
0x0030: 0000 0008 0000 004b 0000 0000 332e 3300 .......K....3.3.
0x0040: 0000 0000 0000 1c00 0000 0132 0d91 0fb0 ...........2....
0x0050: 41e1 240d c133 b03e c6da 47be e5c9 a66a A.$..3.>..G....j
0x0060: a6b6 5174 6eee e672 bac9 d94f 0c58 6945 ..Qtn..r...O.XiE
0x0070: 347a 49aa 4b75 0d05 5c3c e11e 07fb 7a00 4zI.Ku..\<....z.
0x0080: 00aa 55 ..U
20:40:56.720905 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 173:264, ack 208, win 2713, length 91
0x0000: 4500 0083 03d5 0000 ff06 32ad c0a8 01f0 E.........2.....
0x0010: c0a8 01b2 1a0c a23a 0000 948d fa68 5313 .......:.....hS.
0x0020: 5018 0a99 d5e4 0000 0000 55aa 0000 0000 P.........U.....
0x0030: 0000 0008 0000 004b 0000 0000 332e 3300 .......K....3.3.
0x0040: 0000 0000 0000 1c00 0000 0132 0d91 0fb0 ...........2....
0x0050: 41e1 240d c133 b03e c6da 47be e5c9 a66a A.$..3.>..G....j
0x0060: a6b6 5174 6eee e672 bac9 d94f 0c58 6945 ..Qtn..r...O.XiE
0x0070: 347a 49aa 4b75 0d05 5c3c e11e 07fb 7a00 4zI.Ku..\<....z.
0x0080: 00aa 55 ..U
20:40:56.740665 IP ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886 > 192.168.1.240.49153: Flags [P.], seq 139:208, ack 319, win 33768, length 69
0x0000: 4500 006d 0d3c 4000 ed06 d092 12b9 da6a E..m.<@........j
0x0010: c0a8 01f0 22b6 c001 4a38 df8e 0000 3ef9 ...."...J8....>.
0x0020: 5018 83e8 27fd 0000 1703 0300 400e 80aa P...'.......@...
0x0030: 276e 5c0b 606e c30e 255a 5290 f2e9 2cf9 'n\.`n..%ZR...,.
0x0040: 77b4 d09c 582d fe23 8bb9 cfec 78fc 906c w...X-.#....x..l
0x0050: 615b cc88 6e71 dd85 af36 0f14 e973 3649 a[..nq...6...s6I
0x0060: 7c5e 19a3 f7ba 1607 369f 25f5 93 |^......6.%..
20:40:56.823365 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 264, win 65535, length 0
0x0000: 4500 0028 9523 4000 4006 20ba c0a8 01b2 E..(.#@.@.......
0x0010: c0a8 01f0 a23a 1a0c fa68 5313 0000 94e8 .....:...hS.....
0x0020: 5010 ffff 8c36 0000 P....6..
20:40:56.823505 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 264, win 65535, length 0
0x0000: 4500 0028 9523 4000 4006 20ba c0a8 01b2 E..(.#@.@.......
0x0010: c0a8 01f0 a23a 1a0c fa68 5313 0000 94e8 .....:...hS.....
0x0020: 5010 ffff 8c36 0000 P....6..
20:40:56.825725 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 264:292, ack 208, win 2713, length 28
0x0000: 4500 0044 03d6 0000 ff06 32eb c0a8 01f0 E..D......2.....
0x0010: c0a8 01b2 1a0c a23a 0000 94e8 fa68 5313 .......:.....hS.
0x0020: 5018 0a99 a438 0000 0000 55aa 0000 0002 P....8....U.....
0x0030: 0000 000d 0000 000c 0000 0000 8de1 4f44 ..............OD
0x0040: 0000 aa55 ...U
20:40:56.825785 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 264:292, ack 208, win 2713, length 28
0x0000: 4500 0044 03d6 0000 ff06 32eb c0a8 01f0 E..D......2.....
0x0010: c0a8 01b2 1a0c a23a 0000 94e8 fa68 5313 .......:.....hS.
0x0020: 5018 0a99 a438 0000 0000 55aa 0000 0002 P....8....U.....
0x0030: 0000 000d 0000 000c 0000 0000 8de1 4f44 ..............OD
0x0040: 0000 aa55 ...U
20:40:56.829005 IP 192.168.1.240.49153 > ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886: Flags [.], ack 208, win 2299, length 0
0x0000: 4500 0028 03d7 0000 ff06 083d c0a8 01f0 E..(.......=....
0x0010: 12b9 da6a c001 22b6 0000 3ef9 4a38 dfd3 ...j.."...>.J8..
0x0020: 5010 08fb ab60 0000 P....`..
20:40:56.927465 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 292, win 65535, length 0
0x0000: 4500 0028 9524 4000 4006 20b9 c0a8 01b2 E..(.$@.@.......
0x0010: c0a8 01f0 a23a 1a0c fa68 5313 0000 9504 .....:...hS.....
0x0020: 5010 ffff 8c1a 0000 P.......
20:40:56.927545 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 292, win 65535, length 0
0x0000: 4500 0028 9524 4000 4006 20b9 c0a8 01b2 E..(.$@.@.......
0x0010: c0a8 01f0 a23a 1a0c fa68 5313 0000 9504 .....:...hS.....
0x0020: 5010 ffff 8c1a 0000 P.......
Turn off
root@LEDE:~# tcpdump -i wlan0 host 192.168.1.240 -X tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 20:41:40.762601 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [P.], seq 4201141059:4201141130, ack 38204, win 65535, length 71 0x0000: 4500 006f 9529 4000 4006 206d c0a8 01b2 E..o.)@.@..m.... 0x0010: c0a8 01f0 a23a 1a0c fa68 5343 0000 953c .....:...hSC...< 0x0020: 5018 ffff e696 0000 0000 55aa 0000 0003 P.........U..... 0x0030: 0000 000d 0000 0037 332e 3300 0000 0000 .......73.3..... 0x0040: 0000 0800 0920 d8a8 5b7e 1c66 c995 c4fa ........[~.f.... 0x0050: 49ba 3815 3f33 2863 f141 c27e 0295 4406 I.8.?3(c.A.~..D. 0x0060: c8d5 b6ad 8b11 0084 bfe8 f400 00aa 55 ..............U 20:41:40.762661 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [P.], seq 0:71, ack 1, win 65535, length 71 0x0000: 4500 006f 9529 4000 4006 206d c0a8 01b2 E..o.)@.@..m.... 0x0010: c0a8 01f0 a23a 1a0c fa68 5343 0000 953c .....:...hSC...< 0x0020: 5018 ffff e696 0000 0000 55aa 0000 0003 P.........U..... 0x0030: 0000 000d 0000 0037 332e 3300 0000 0000 .......73.3..... 0x0040: 0000 0800 0920 d8a8 5b7e 1c66 c995 c4fa ........[~.f.... 0x0050: 49ba 3815 3f33 2863 f141 c27e 0295 4406 I.8.?3(c.A.~..D. 0x0060: c8d5 b6ad 8b11 0084 bfe8 f400 00aa 55 ..............U 20:41:40.769801 IP 192.168.1.240.49153 > ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886: Flags [P.], seq 16190:16371, ack 1245241368, win 2230, length 181 0x0000: 4500 00dd 03e5 0000 ff06 077a c0a8 01f0 E..........z.... 0x0010: 12b9 da6a c001 22b6 0000 3f3e 4a38 e018 ...j.."...?>J8.. 0x0020: 5018 08b6 decb 0000 1703 0300 b042 416f P............BAo 0x0030: 6862 6d64 3661 4739 3149 4652 31f8 e4a1 hbmd6aG91IFR1... 0x0040: 84ce d52e bdc1 a36d 84e3 43e1 10e9 0b16 .......m..C..... 0x0050: 2702 bc93 e1f1 aad3 fa06 3ec4 fad5 6d54 '.........>...mT 0x0060: ae1f 4737 24ea 45e7 83ad 1c44 97aa ae01 ..G7$.E....D.... 0x0070: dcd4 2763 273c 4951 5c5f 1672 3183 c8c7 ..'c'<IQ\_.r1... 0x0080: a5cb e55a f359 2c63 b582 04d5 65ec b63b ...Z.Y,c....e..; 0x0090: 0833 1c0f 78b9 b1f0 d85a b345 2cc6 90dc .3..x....Z.E,... 0x00a0: c289 087c 4291 a6f7 183a a960 4dcd 8cbe ...|B....:.`M... 0x00b0: 5f1e f70b 0139 0647 c382 95a9 4b2e 8de3 _....9.G....K... 0x00c0: 5a45 282d 74e6 8dbe bd28 321c 41a0 46ed ZE(-t....(2.A.F. 0x00d0: a2ce c9a4 6ba6 53c4 0eea 4179 92 ....k.S...Ay. 20:41:40.771661 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 1:92, ack 71, win 2594, length 91 0x0000: 4500 0083 03e6 0000 ff06 329c c0a8 01f0 E.........2..... 0x0010: c0a8 01b2 1a0c a23a 0000 953c fa68 538a .......:...<.hS. 0x0020: 5018 0a22 c1c4 0000 0000 55aa 0000 0000 P.."......U..... 0x0030: 0000 0008 0000 004b 0000 0000 332e 3300 .......K....3.3. 0x0040: 0000 0000 0000 1d00 0000 01a8 5b7e 1c66 ............[~.f 0x0050: c995 c4fa 49ba 3815 3f33 2859 e9bc a724 ....I.8.?3(Y...$ 0x0060: 276a 8b68 656a 48ca 92af ebe9 437a 4039 'j.hejH.....Cz@9 0x0070: f372 d4c8 e56d 2833 2f49 fbfe ef76 ba00 .r...m(3/I...v.. 0x0080: 00aa 55 ..U 20:41:40.771721 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 1:92, ack 71, win 2594, length 91 0x0000: 4500 0083 03e6 0000 ff06 329c c0a8 01f0 E.........2..... 0x0010: c0a8 01b2 1a0c a23a 0000 953c fa68 538a .......:...<.hS. 0x0020: 5018 0a22 c1c4 0000 0000 55aa 0000 0000 P.."......U..... 0x0030: 0000 0008 0000 004b 0000 0000 332e 3300 .......K....3.3. 0x0040: 0000 0000 0000 1d00 0000 01a8 5b7e 1c66 ............[~.f 0x0050: c995 c4fa 49ba 3815 3f33 2859 e9bc a724 ....I.8.?3(Y...$ 0x0060: 276a 8b68 656a 48ca 92af ebe9 437a 4039 'j.hejH.....Cz@9 0x0070: f372 d4c8 e56d 2833 2f49 fbfe ef76 ba00 .r...m(3/I...v.. 0x0080: 00aa 55 ..U 20:41:40.791841 IP ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886 > 192.168.1.240.49153: Flags [P.], seq 1:70, ack 181, win 34840, length 69 0x0000: 4500 006d 0d3e 4000 ed06 d090 12b9 da6a E..m.>@........j 0x0010: c0a8 01f0 22b6 c001 4a38 e018 0000 3ff3 ...."...J8....?. 0x0020: 5018 8818 fb92 0000 1703 0300 40f3 4fc9 P...........@.O. 0x0030: 8454 7861 b2f3 5c87 3d62 ccd3 4368 8549 .Txa..\.=b..Ch.I 0x0040: 8a6b 08fe b857 6482 14c3 34fb 3caf 99fb .k...Wd...4.<... 0x0050: fffc 03b1 ddb0 b5f8 2d13 e8ad 1193 6530 ........-.....e0 0x0060: 682c 00e0 4ad5 4c8d 0374 6ddf 3f h,..J.L..tm.? 20:41:40.949741 IP 192.168.1.240.49153 > ec2-18-185-218-106.eu-central-1.compute.amazonaws.com.8886: Flags [.], ack 70, win 2161, length 0 0x0000: 4500 0028 03e7 0000 ff06 082d c0a8 01f0 E..(.......-.... 0x0010: 12b9 da6a c001 22b6 0000 3ff3 4a38 e05d ...j.."...?.J8.] 0x0020: 5010 0871 aa66 0000 P..q.f.. 20:41:41.061321 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 92, win 65535, length 0 0x0000: 4500 0028 952a 4000 4006 20b3 c0a8 01b2 E..(.*@.@....... 0x0010: c0a8 01f0 a23a 1a0c fa68 538a 0000 9597 .....:...hS..... 0x0020: 5010 ffff 8b10 0000 P....... 20:41:41.061381 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 92, win 65535, length 0 0x0000: 4500 0028 952a 4000 4006 20b3 c0a8 01b2 E..(.*@.@....... 0x0010: c0a8 01f0 a23a 1a0c fa68 538a 0000 9597 .....:...hS..... 0x0020: 5010 ffff 8b10 0000 P....... 20:41:41.063021 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 92:120, ack 71, win 2594, length 28 0x0000: 4500 0044 03e8 0000 ff06 32d9 c0a8 01f0 E..D......2..... 0x0010: c0a8 01b2 1a0c a23a 0000 9597 fa68 538a .......:.....hS. 0x0020: 5018 0a22 9975 0000 0000 55aa 0000 0003 P..".u....U..... 0x0030: 0000 000d 0000 000c 0000 0000 5077 96c1 ............Pw.. 0x0040: 0000 aa55 ...U 20:41:41.063081 IP 192.168.1.240.6668 > 192.168.1.178.41530: Flags [P.], seq 92:120, ack 71, win 2594, length 28 0x0000: 4500 0044 03e8 0000 ff06 32d9 c0a8 01f0 E..D......2..... 0x0010: c0a8 01b2 1a0c a23a 0000 9597 fa68 538a .......:.....hS. 0x0020: 5018 0a22 9975 0000 0000 55aa 0000 0003 P..".u....U..... 0x0030: 0000 000d 0000 000c 0000 0000 5077 96c1 ............Pw.. 0x0040: 0000 aa55 ...U 20:41:41.662042 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 120, win 65535, length 0 0x0000: 4500 0028 952b 4000 4006 20b2 c0a8 01b2 E..(.+@.@....... 0x0010: c0a8 01f0 a23a 1a0c fa68 538a 0000 95b3 .....:...hS..... 0x0020: 5010 ffff 8af4 0000 P....... 20:41:41.662102 IP 192.168.1.178.41530 > 192.168.1.240.6668: Flags [.], ack 120, win 65535, length 0 0x0000: 4500 0028 952b 4000 4006 20b2 c0a8 01b2 E..(.+@.@....... 0x0010: c0a8 01f0 a23a 1a0c fa68 538a 0000 95b3 .....:...hS..... 0x0020: 5010 ffff 8af4 0000 P.......