Understanding EternalBlue with Wireshark

EternalBlue is an exploit developed by the NSA (leaked by the Shadow Brokers group) that exploits a vulnerability in Windows SMBv1 (port 445), presented in:

Windows XP → Windows 7
Windows Server 2003 → 2008 R2

If you don't have the MS17-010 patch, you are vulnerable.

Here you find an iso with the vulnerability

git clone https://github.com/worawit/MS17-010.git
cd MS17-010

Filter for wireshark::

tcp.port == 445

Debugging in Wireshark then::

Package 1:::

387	1339.261566292	10.0.2.15	10.0.2.16	TCP	74	41619 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79404440 TSecr=0 WS=128

This line in Wireshark shows the start of a TCP connection — more precisely, an attempt to connect to port 445, used by SMB (Server Message Block), which is exactly the protocol exploited by EternalBlue (MS17-010).

Explanation::

387						Número do Package in capture
1339.261...				Timestamp (time since capture started)
10.0.2.15 → 10.0.2.16	Source → Destination IP (Kali → Windows, for example)
TCP						Type protocol
74						Package size
41619 	→ 445			Source (random) port → destination (445 = SMB)
[SYN]					TCP connection initiation (part of 3-way handshake: SYN, SYN-ACK, ACK)
Seq=0					Initial sequence number
Win=64240				Receive window size
MSS=1460				Maximum allowed segment size
SACK_PERM				Allows SACK (Selective ACK)
TSval, TSecr, WS		Used for time management (optional, performance tuning)

💡 What this means in the context of EternalBlue::

The exploit (Kali or attacker) is attempting to initiate a TCP session with the victim on port 445 (SMB).
This is expected and necessary for EternalBlue to work, as it:
Establishes a TCP connection
Sends malformed SMB packets
Executes shellcode on the remote kernel heap

Package 2:::

388	1339.261876956	10.0.2.16	10.0.2.15	TCP	74	445 → 41619 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=257385 TSecr=79404440

Explanation

388						Package Number
1339.261876956			Time since capture started (timestamp)
10.0.2.16 → 10.0.2.15	Source IP (Windows) → Destination (Kali)
TCP						Protocol
74						Package size
445 → 41619	Port 445 (SMB) → Random port used by Kali
[SYN, ACK]				Second stage of the TCP handshake (confirmation of the connection request)
Seq=0					Initial response sequence number
Ack=1					Confirms that it received Seq=0 from the previous packet and is ready to continue
Win=8192				Receive window size
MSS=1460				Maximum TCP segment size
WS=256					Window scale factor
SACK_PERM				Allows selective ACK (optimization)
TSval, TSecr			Timestamps used to measure RTT and congestion control

Package 3:::

389	1339.261891727	10.0.2.15	10.0.2.16	TCP	66	41619 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79404440 TSecr=257385

This line represents the third and final step of the TCP 3-way handshake — that is, the TCP connection has been successfully established between your Kali Linux (attacker) and the Windows machine (target) on port 445 (SMB).

Explanation

389						Package Number
1339.261891727			Timestamp since start of capture
10.0.2.15 → 10.0.2.16	Kali (atacker) → Windows (alvo)
TCP						Used protocol
66						Package Size
41619 → 445				Kali Random Port → Victim SMB Port (445)
[ACK]					Acknowledgment of receipt of previous [SYN, ACK]
Seq=1					Kali's current sequence number
Ack=1					Acknowledgment to Seq=0 in Windows
Win=64256				TCP receive window
Len=0					No useful data yet (just handshake)
TSval, TSecr			Timestamps (RTT measurement, flow control)

This line shows that the TCP handshake has completed, which means:
This is the actual starting point of the EternalBlue exploit — after this line

Next packages:::

SMB Negotiate Protocol Request
Session Setup AndX Request
Tree Connect Request
Trans_Peek_NamedPipe (indicates attempted code execution)
NT_STATUS_INSUFF_SERVER_RESOURCES (exploit in progress)

Package 4:::

390 1339.263629626 10.0.2.15 10.0.2.16 SMB 154 -> Negotiate Protocol Request

Explanation

All lines are the same as the others

Negotiate Protocol Request	SMB Version Negotiation Request

This is the first SMB packet sent by the client (Kali) after the TCP handshake. It proposes a list of SMB versions that the client can use—for example:

SMB 1.0 (LANMAN 2.1, NT LM 0.12) ← required for EternalBlue
SMB 2.0, 2.1, 3.0... (version to the SMB in more modern systems)

Package 5:::
391 1339.264043606 10.0.2.16 10.0.2.15 SMB 197 Negotiate Protocol Response

Explanation

It represents the first real step of SMB communication between your Kali Linux and Windows machine.

...
Negotiate Protocol Request -> SMB Version Negotiation Request

If clicking on the intercepted request you get: Selected Index: 3: NT LM 0.12

This is the sign that Windows still uses SMBv1 and is vulnerable to MS17-010.

Then Kali sends:

Session Setup AndX Request
Tree Connect Request
Trans Named Pipe

Package 6:::

392 1339.264057673 10.0.2.15 10.0.2.16 TCP 66 41619 → 445 [ACK] Seq=89 Ack=132 Win=64128 Len=0 TSval=79404442 TSecr=257385

Explanation

392							Then Kali sends:
1339.264057673				Timestamp (time since capture started)
10.0.2.15 → 10.0.2.16		Kali → Windows
TCP							Protocol
66							Total size Package
41619 → 445					Source port (random) → destination port 445 (SMB)
[ACK]						Package de acknowledgment: confirms that data has been received
Seq=89						Kali's sequence number (where it is in its own transmission)
Ack=132						Acknowledgment: "I received up to byte 131 of your previous response"
Win=64128					TCP receive window
Len=0						There is no data in this Package, it is just control
TSval/TSecr					Timestamp for Congestion Control and RTT

Here we see just a pure ACK

This keeps the TCP connection alive

🔁 And it sets the stage for the next step: sending the "Session Setup AndX Request" from Kali to Windows.

Package 7:::

393 1339.267735769 10.0.2.15 10.0.2.16 SMB 212 Session Setup AndX Request, NTLMSSP_NEGOTIATE

Explanation

393								Package numberr
1339.267...						Timestamp
10.0.2.15 → 10.0.2.16	Kali (atacante) → Windows (alvo)
SMB								SMB Protocol
212								Size Package
Session Setup AndX 				Request SMB authentication request
NTLMSSP_NEGOTIATE				Initial phase of NTLMSSP (Negotiate Security Support Provider) authentication

What's going on here?

This is the second phase of the SMB connection after protocol negotiation.

1. The client (Kali) sends this message to:

• Initiate the SMB session

The attack works even without valid credentials—this step serves only to gain unauthenticated access to vulnerable pipes. In other words, EternalBlue doesn't require full authentication.

The server (Windows) will respond with:

Session Setup AndX Response, NTLMSSP_CHALLENGE

Package 7:::

394 1339.268029953 10.0.2.16 10.0.2.15 SMB 351 Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED

Explanation

This line shows that Windows responded correctly to Kali's SMB authentication attempt. This is expected behavior in the EternalBlue exploit, and it shows you're on the right track.

394											Number do Package
1339.268...									Timestamp
10.0.2.16 → 10.0.2.15	Windows (target) → Kali (attacker)
SMB											SMB Protocol
351											Package Size
Session Setup AndX Response					SMB Session Attempt Response
NTLMSSP_CHALLENGE							Windows sent an NTLM challenge to Kali
Error: STATUS_MORE_PROCESSING_REQUIRED		Authentication not yet complete — expects response with NTLM hash

Complementing:::

What it means STATUS_MORE_PROCESSING_REQUIRED?

This isn't a fatal error. In fact, it's the normal response to NTLM challenge-response:

Kali asked for authentication (NTLMSSP_NEGOTIATE)

👉 Windows responded:

👉 ““Here is my NTLM challenge, I await your response””

-Kali doesn't need to respond with the real password (EternalBlue is pre-authenticated!)

-It will simply continue using the session as long as SMB allows.

-It attempts to access vulnerable pipes without full authentication.

🔑 This is the critical point where the exploit begins to bypass legitimate authentication and abuse SMB's anonymous permissions.

Package 8:::

395	1339.274511187	10.0.2.15	10.0.2.16	SMB	262	Session Setup AndX Request, NTLMSSP_AUTH, User: \

This package is Kali's final response to the NTLM challenge Windows sent earlier. It's what would attempt to authenticate the user—but in the context of EternalBlue, this is usually done with anonymous or fake authentication, just to continue the exploit.

Session Setup AndX Request					SMB authentication attempt

NTLMSSP_AUTH								Final phase of the NTLM protocol (sending the hash)

User: \										Attempting authentication without username (anonymous)

Observation:

EternalBlue does not require valid authentication

The exploit sends an NTLMSSP_AUTH with fake or empty fields

Even if authentication is unsuccessful, SMBv1 allows partial access to certain functions such as:

Named pipes (\pipe\srvsvc)

Trans_PeekNamedPipe -> used to cause heap overflow

In other words: this Package is part of an anonymous SMB session or one that was forged to appear legitimate.

📌 Recap of your attack chain so far:

✅ TCP handshake → established
✅ Negotiate Protocol Request → SMBv1 confirmed
✅ Session Setup (Negotiate) → received NTLMSSP_CHALLENGE
✅ Session Setup (Auth) → sending anonymous NTLMSSP_AUTH
🔜 Tree Connect + Trans_Named_Pipe → EternalBlue exploit begins

Package 9:::

396 1339.275007043 10.0.2.16 10.0.2.15 SMB 183 Session Setup AndX Response

This is Windows' final response to the previous package sent by Kali (NTLMSSP_AUTH). This closes the SMB authentication attempt, even though the exploit does not rely on full authentication.

Explanation

Session Setup AndX Response ->	Response to authentication attempt

Windows can send:
STATUS_SUCCESS or STATUS_ACCESS_DENIED

* Even with STATUS_ACCESS_DENIED EternalBlue can still continue — because it uses SMB functions accessible before full authentication (pre-authenticated).

In my scenario it returned NT Status: STATUS_SUCCESS (0x00000000)

🧪 Why might this have happened?

The target Windows has Guest/Anonymous login enabled (with IPC$ access).
You are exploiting a vulnerable VM pre-configured with relaxed permissions.
The "Guest" account is enabled and has no password.
The exploit used valid empty credentials (user "", password "")

Package 10:::

397 1339.276018314 10.0.2.15 10.0.2.16 SMB 137 Tree Connect AndX Request, Path: \10.0.2.16\IPC$

This is crucial to the EternalBlue exploitation process. It shows that Kali is requesting access to the IPC$ share, which is a prerequisite for interacting with SMB pipes, including those used to trigger the exploit.

Explanation

Tree Connect AndX Request		Requests connection to an SMB network resource (in this case, IPC$)
\\10.0.2.16\IPC$				Resource Path: The Special Inter-Process Share Communication

What is IPC$?

IPC$ is a special share used for remote procedure calls (RPC) and named pipes

It is essential to execute commands such as:

\PIPE\srvsvc
\PIPE\lsarpc
\PIPE\netlogon

These pipes are typical targets of attacks like EternalBlue, because Windows allows limited actions to be performed even without full authentication, especially if Guest or Anonymous login is active.

Package 10:::

399 1339.278741307 10.0.2.15 10.0.2.16 SMB Pipe 144 PeekNamedPipe Request, FID: 0x0000

Explanation

PeekNamedPipe Request			An SMB command that checks the contents of a named pipe
FID: 0x0000						File ID of the open pipe (often forged in the exploit)
144								Package Size
SMB Pipe						SMB protocol used specifically in a pipe connection (via IPC$)

The exploit sends a PeekNamedPipe with malformed parameters, specifically:

• A inválid FID (0x0000 or corrupt)
• SMB fields that result in heap spraying in the kernel
• This forces the srv.sys service (in the Windows kernel) to access already freed memory (use-after-free)

➡️ This behavior triggers the MS17-010 flaw, allowing the attacker to execute arbitrary code in the kernel (full RCE with SYSTEM).

Package 11:::

400 1339.278961620 10.0.2.16 10.0.2.15 SMB 105 Trans Response, Error: STATUS_INSUFF_SERVER_RESOURCES

Explanation

Significa que o EternalBlue foi disparado. Esse Package é o indicador clássico de que o bug MS17-010 (EternalBlue) foi acionado com sucesso no alvo.

Trans Response  ->  Windows Response to Malicious PeekNamedPipe
Error: STATUS_INSUFF_SERVER_RESOURCES (0xC0000205)   ->  A false error, used as the default response when the heap has been internally corrupted

This error isn't realit's a symptom of the heap flaw, and it's what exploits detect to know the target is vulnerable and has been affected.

Why is this error the sign of success?

The exploit sends a malformed PeekNamedPipe.
The srv.sys driver (responsible for SMB in the Windows kernel) attempts to process the message and ends up corrupting the heap.
The system fails internally and responds with: NT_STATUS_INSUFF_SERVER_RESOURCES

🎯 What happens now?

If the exploit is well-structured (like in msfconsole with exploit/windows/smb/ms17_010_eternalblue):

1. 🧠 The shellcode was successfully injected.
2. 🐚 Kali now waits for a reverse connection from Windows (Meterpreter or other payload).
3. ⚙️ The services.exe or svchost.exe process on Windows will execute malicious code with SYSTEM

Package 12:::

411 1339.282718715 10.0.2.15 10.0.2.16 SMB 149 Trans2 Request, SESSION_SETUP

But just to make it clear that everything that was studied here was with the help of artificial intelligence, since today it helps a lot to debug these wireshark packets, however the document was created by myself, every detail was simulated in virtual machines and isolated environments.

Other Packages, we will not see all of them because seeing everything is very time consuming and extensive

411	1339.282718715	10.0.2.15	10.0.2.16	SMB	149	Trans2 Request, SESSION_SETUP
412	1339.282881419	10.0.2.16	10.0.2.15	SMB	105	Trans2 Response, SESSION_SETUP, Error: STATUS_NOT_IMPLEMENTED
413	1339.283299777	10.0.2.15	10.0.2.16	TCP	66	41619 → 445 [FIN, ACK] Seq=663 Ack=662 Win=64128 Len=0 TSval=79404461 TSecr=257387
414	1339.283423674	10.0.2.16	10.0.2.15	TCP	66	445 → 41619 [ACK] Seq=662 Ack=664 Win=65792 Len=0 TSval=257387 TSecr=79404461
415	1339.283623837	10.0.2.16	10.0.2.15	TCP	60	445 → 41619 [RST, ACK] Seq=662 Ack=664 Win=0 Len=0
416	1339.287498546	10.0.2.15	10.0.2.16	TCP	74	44175 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79404466 TSecr=0 WS=12
417	1339.287692844	10.0.2.16	10.0.2.15	TCP	74	445 → 44175 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=257388 TSecr=79404466
418	1339.287706693	10.0.2.15	10.0.2.16	TCP	66	44175 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79404466 TSecr=257388
419	1339.289880699	10.0.2.15	10.0.2.16	SMB	117	Negotiate Protocol Request
420	1339.290150746	10.0.2.16	10.0.2.15	SMB	197	Negotiate Protocol Response
421	1339.290163236	10.0.2.15	10.0.2.16	TCP	66	44175 → 445 [ACK] Seq=52 Ack=132 Win=64128 Len=0 TSval=79404468 TSecr=257388
422	1339.291802496	10.0.2.15	10.0.2.16	SMB	202	Session Setup AndX Request, User: anonymous
423	1339.291991284	10.0.2.16	10.0.2.15	SMB	191	Session Setup AndX Response
424	1339.296043984	10.0.2.15	10.0.2.16	SMB	137	Tree Connect AndX Request, Path: \\10.0.2.16\IPC$
425	1339.296273390	10.0.2.16	10.0.2.15	SMB	124	Tree Connect AndX Response
426	1339.309263453	10.0.2.15	10.0.2.16	SMB	1150	NT Trans Request, <unknown>
427	1339.309514232	10.0.2.16	10.0.2.15	SMB	105	NT Trans Response, <unknown (0)>
428	1339.340254566	10.0.2.15	10.0.2.16	SMB	7306	Trans2 Secondary Request, Data: 5072 of 4096, FID: 0x0000
429	1339.340301483	10.0.2.15	10.0.2.16	SMB	7306	Trans2 Secondary Request, Data: 9168 of 4096, FID: 0x0000Trans2 Secondary Request, Data: 13264 of 4096, FID: 0x0000
430	1339.340635694	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=5496 Win=66560 Len=0 TSval=257393 TSecr=79404518
431	1339.340635861	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=9649 Win=66560 Len=0 TSval=257393 TSecr=79404518
432	1339.340635888	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=13802 Win=66560 Len=0 TSval=257393 TSecr=79404518
433	1339.340635913	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=15823 Win=66560 Len=0 TSval=257393 TSecr=79404518
434	1339.340662499	10.0.2.15	10.0.2.16	SMB	5858	Trans2 Secondary Request, Data: 17360 of 4096, FID: 0x0000
435	1339.340674659	10.0.2.15	10.0.2.16	SMB	8754	Trans2 Secondary Request, Data: 21456 of 4096, FID: 0x0000Trans2 Secondary Request, Data: 25552 of 4096, FID: 0x0000
436	1339.340698406	10.0.2.15	10.0.2.16	SMB	8754	Trans2 Secondary Request, Data: 29648 of 4096, FID: 0x0000Trans2 Secondary Request, Data: 37840 of 4096, FID: 0x0000
437	1339.340704652	10.0.2.15	10.0.2.16	SMB	5858	Trans2 Secondary Request, Data: 41936 of 4096, FID: 0x0000
438	1339.340957348	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=22108 Win=66560 Len=0 TSval=257393 TSecr=79404519
439	1339.340957432	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=26261 Win=66560 Len=0 TSval=257393 TSecr=79404519
440	1339.340957457	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=30414 Win=66560 Len=0 TSval=257393 TSecr=79404519
441	1339.340957483	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=34567 Win=66560 Len=0 TSval=257393 TSecr=79404519
442	1339.340965363	10.0.2.15	10.0.2.16	SMB	11650	Trans2 Secondary Request, Data: 46032 of 4096, FID: 0x0000Trans2 Secondary Request, Data: 54224 of 4096, FID: 0x0000
443	1339.340977852	10.0.2.15	10.0.2.16	SMB	7337	Trans2 Secondary Request, Data: 58320 of 4096, FID: 0x0000Trans2 Secondary Request, Data: 62416 of 4096, FID: 0x0000
444	1339.341029797	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=38720 Win=66560 Len=0 TSval=257393 TSecr=79404519
445	1339.341194159	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=42873 Win=66560 Len=0 TSval=257393 TSecr=79404519
446	1339.341194256	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=47026 Win=66560 Len=0 TSval=257393 TSecr=79404519
447	1339.341194282	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=51179 Win=66560 Len=0 TSval=257393 TSecr=79404519
448	1339.341194308	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=55332 Win=66560 Len=0 TSval=257393 TSecr=79404519
449	1339.341194334	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=59485 Win=66560 Len=0 TSval=257393 TSecr=79404519
450	1339.341334141	10.0.2.16	10.0.2.15	TCP	66	445 → 44175 [ACK] Seq=354 Ack=63638 Win=66560 Len=0 TSval=257393 TSecr=79404519
458	1349.350762131	10.0.2.15	10.0.2.16	SMB	119	Echo Request
459	1349.351144752	10.0.2.16	10.0.2.15	SMB	119	Echo Response
460	1349.356422302	10.0.2.15	10.0.2.16	TCP	74	38733 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414534 TSecr=0 WS=128
461	1349.356739624	10.0.2.16	10.0.2.15	TCP	74	445 → 38733 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258394 TSecr=79414534
462	1349.356753158	10.0.2.15	10.0.2.16	TCP	66	38733 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414535 TSecr=258394
463	1349.357768366	10.0.2.15	10.0.2.16	SMB	117	Negotiate Protocol Request
464	1349.358138522	10.0.2.16	10.0.2.15	SMB	197	Negotiate Protocol Respone
465	1349.358150077	10.0.2.15	10.0.2.16	TCP	66	38733 → 445 [ACK] Seq=52 Ack=132 Win=64128 Len=0 TSval=79414536 TSecr=258394
466	1349.359872535	10.0.2.15	10.0.2.16	SMB	151	Session Setup AndX Request
467	1349.360157677	10.0.2.16	10.0.2.15	SMB	191	Session Setup AndX Response
468	1349.362038409	10.0.2.15	10.0.2.16	TCP	74	35485 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414540 TSecr=0 WS=128
469	1349.362334943	10.0.2.16	10.0.2.15	TCP	74	445 → 35485 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414540
470	1349.362348255	10.0.2.15	10.0.2.16	TCP	66	35485 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414540 TSecr=258395
471	1349.362536267	10.0.2.15	10.0.2.16	TCP	198	35485 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414541 TSecr=258395
472	1349.363018456	10.0.2.15	10.0.2.16	TCP	74	44453 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414541 TSecr=0 WS=128
473	1349.363287550	10.0.2.16	10.0.2.15	TCP	74	445 → 44453 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414541
474	1349.363299284	10.0.2.15	10.0.2.16	TCP	66	44453 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414541 TSecr=258395
475	1349.363473326	10.0.2.15	10.0.2.16	TCP	198	44453 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414542 TSecr=258395
476	1349.363928869	10.0.2.15	10.0.2.16	TCP	74	35823 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414542 TSecr=0 WS=128
477	1349.364327033	10.0.2.16	10.0.2.15	TCP	74	445 → 35823 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414542
478	1349.364339646	10.0.2.15	10.0.2.16	TCP	66	35823 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414542 TSecr=258395
479	1349.364584314	10.0.2.15	10.0.2.16	TCP	198	35823 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414543 TSecr=258395
480	1349.365573240	10.0.2.15	10.0.2.16	TCP	74	34545 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414544 TSecr=0 WS=128
481	1349.365795352	10.0.2.16	10.0.2.15	TCP	74	445 → 34545 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414544
482	1349.365806959	10.0.2.15	10.0.2.16	TCP	66	34545 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414544 TSecr=258395
483	1349.365981935	10.0.2.15	10.0.2.16	TCP	198	34545 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414544 TSecr=258395
484	1349.366442361	10.0.2.15	10.0.2.16	TCP	74	33279 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414544 TSecr=0 WS=128
485	1349.366664289	10.0.2.16	10.0.2.15	TCP	74	445 → 33279 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414544
486	1349.366675889	10.0.2.15	10.0.2.16	TCP	66	33279 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414545 TSecr=258395
487	1349.366846381	10.0.2.15	10.0.2.16	TCP	198	33279 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414545 TSecr=258395
488	1349.367337968	10.0.2.15	10.0.2.16	TCP	74	33079 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414545 TSecr=0 WS=128
489	1349.367587527	10.0.2.16	10.0.2.15	TCP	74	445 → 33079 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414545
490	1349.367599105	10.0.2.15	10.0.2.16	TCP	66	33079 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414546 TSecr=258395
491	1349.367769908	10.0.2.15	10.0.2.16	TCP	198	33079 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414546 TSecr=258395
492	1349.368219847	10.0.2.15	10.0.2.16	TCP	74	45165 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414546 TSecr=0 W=128
493	1349.368430114	10.0.2.16	10.0.2.15	TCP	74	445 → 45165 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414546
494	1349.368441780	10.0.2.15	10.0.2.16	TCP	66	45165 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414546 TSecr=258395
495	1349.368610477	10.0.2.15	10.0.2.16	TCP	198	45165 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414547 TSecr=258395
496	1349.369104274	10.0.2.15	10.0.2.16	TCP	74	35457 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414547 TSecr=0 WS=128
497	1349.369247035	10.0.2.16	10.0.2.15	TCP	74	445 → 35457 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258395 TSecr=79414547
498	1349.369263482	10.0.2.15	10.0.2.16	TCP	66	35457 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414547 TSecr=258395
499	1349.369437463	10.0.2.15	10.0.2.16	TCP	198	35457 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414547 TSecr=258395
500	1349.369899882	10.0.2.15	10.0.2.16	TCP	74	34629 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414548 TSecr=0 WS=128
501	1349.370180534	10.0.2.16	10.0.2.15	TCP	74	445 → 34629 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258396 TSecr=79414548
502	1349.370191538	10.0.2.15	10.0.2.16	TCP	66	34629 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414548 TSecr=258396
503	1349.370408289	10.0.2.15	10.0.2.16	TCP	198	34629 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414548 TSecr=258396
504	1349.370898359	10.0.2.15	10.0.2.16	TCP	74	40935 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414549 TSecr=0 WS=128
505	1349.371185732	10.0.2.16	10.0.2.15	TCP	74	445 → 40935 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258396 TSecr=79414549
506	1349.371195405	10.0.2.15	10.0.2.16	TCP	66	40935 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414549 TSecr=258396
507	1349.371437439	10.0.2.15	10.0.2.16	TCP	198	40935 → 445 [PSH, ACK] Seq=1 Ack=1 Win=64256 Len=132 TSval=79414549 TSecr=258396
508	1349.372495566	10.0.2.15	10.0.2.16	TCP	74	39427 → 445 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM TSval=79414551 TSecr=0 WS=128
509	1349.372716394	10.0.2.16	10.0.2.15	TCP	74	445 → 39427 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM TSval=258396 TSecr=79414551
510	1349.372726252	10.0.2.15	10.0.2.16	TCP	66	39427 → 445 [ACK] Seq=1 Ack=1 Win=64256 Len=0 TSval=79414551 TSecr=258396