A problem here getting winbind traffic to be encrypted using Kerberos.
I have set up a test environment with a pair of servers (actually lxc
containers):
- samba server (ubuntu 16.04, stock samba 4.3.11)
- client machine (ubuntu 16.04) joined with "net ads join" and winbind
The client machine has the following in /etc/samba/smb.conf:
-------
[global]
#netbios name = client-ad
workgroup = AD
security = ADS
realm = AD.EXAMPLE.NET
encrypt passwords = yes
kerberos method = secrets and keytab
idmap config * : backend = autorid
idmap config * : range = 1000000-1999999
idmap config * : rangesize = 100000
idmap config AD:backend = ad
idmap config AD:schema_mode = rfc2307
idmap config AD:range = 2000-9999
winbind nss info = rfc2307
winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
-------
I can resolve names in the directory (e.g. using "id
<username>"). All
good so far.
Now, since the client machine is enrolled and has a kerberos keytab (*),
I would have though that winbind would be able to use this to encrypt
and authenticate all LDAP traffic.
However when I run tcpdump on port 389 on the server - see below (**) -
it's clear that some of the traffic is unencrypted. It looks like
winbind is at least trying to do some sort of negotiation (GSS-SPNEGO)
but then after that is falling back to unencrypted queries.
On the client machine I am able to kinit with the directory
administrator creds and do ldapsearch at the command line with Kerberos
authentication (-Y GSSAPI)
But oddly, I cannot authenticate using the keytab:
root at client-ad:~# kinit -k -t /etc/krb5.keytab
host/client-ad.ad.example.net at AD.EXAMPLE.NET
kinit: Client 'host/client-ad.ad.example.net at AD.EXAMPLE.NET' not
found
in Kerberos database while getting initial credentials
... even though ktutil says that the principal *does* exit in the
keytab. The directory has "servicePrincipalName:
HOST/client-ad.ad.example.net" (note the capitals for HOST)
tcpdump at the time of running kinit shows a single UDP exchange on port
88 (***), followed by DNS queries for non-existent names (returning
NXDOMAIN) being sent to the samba server:
SRV? _kerberos-master._udp.AD.EXAMPLE.NET. (54)
SRV? _kerberos-master._tcp.AD.EXAMPLE.NET. (54)
SRV? _kerberos-master._udp.AD.EXAMPLE.NET. (54)
SRV? _kerberos-master._tcp.AD.EXAMPLE.NET. (54)
There is a winbind_krb5_locator plugin present:
root at client-ad:~# dpkg-query -L winbind | grep -i locator
/usr/lib/x86_64-linux-gnu/plugin/krb5/winbind_krb5_locator.so
/usr/share/man/man7/winbind_krb5_locator.7.gz
But now I'm stumped. Maybe the DNS lookups are a red herring.
I'd quite like to be able to fetch a ticket using the keytab, but more
importantly I want to get winbind to doing kerberized LDAP (after which
I'll be able to disable unencrypted LDAP completely).
Thanks,
Brian.
(*)
root at client-ad:~# ktutil
ktutil: rkt /etc/krb5.keytab
ktutil: l
slot KVNO Principal
---- ----
---------------------------------------------------------------------
1 9 host/client-ad.ad.example.net at AD.EXAMPLE.NET
2 9 host/client-ad.ad.example.net at AD.EXAMPLE.NET
3 9 host/client-ad.ad.example.net at AD.EXAMPLE.NET
4 9 host/client-ad.ad.example.net at AD.EXAMPLE.NET
5 9 host/client-ad.ad.example.net at AD.EXAMPLE.NET
6 9 host/client-ad at AD.EXAMPLE.NET
7 9 host/client-ad at AD.EXAMPLE.NET
8 9 host/client-ad at AD.EXAMPLE.NET
9 9 host/client-ad at AD.EXAMPLE.NET
10 9 host/client-ad at AD.EXAMPLE.NET
11 9 CLIENT-AD$@AD.EXAMPLE.NET
12 9 CLIENT-AD$@AD.EXAMPLE.NET
13 9 CLIENT-AD$@AD.EXAMPLE.NET
14 9 CLIENT-AD$@AD.EXAMPLE.NET
15 9 CLIENT-AD$@AD.EXAMPLE.NET
16 8 host/client-ad.ad.example.net at AD.EXAMPLE.NET
17 8 host/client-ad.ad.example.net at AD.EXAMPLE.NET
18 8 host/client-ad.ad.example.net at AD.EXAMPLE.NET
19 8 host/client-ad.ad.example.net at AD.EXAMPLE.NET
20 8 host/client-ad.ad.example.net at AD.EXAMPLE.NET
21 8 host/client-ad at AD.EXAMPLE.NET
22 8 host/client-ad at AD.EXAMPLE.NET
23 8 host/client-ad at AD.EXAMPLE.NET
24 8 host/client-ad at AD.EXAMPLE.NET
25 8 host/client-ad at AD.EXAMPLE.NET
26 8 CLIENT-AD$@AD.EXAMPLE.NET
27 8 CLIENT-AD$@AD.EXAMPLE.NET
28 8 CLIENT-AD$@AD.EXAMPLE.NET
29 8 CLIENT-AD$@AD.EXAMPLE.NET
30 8 CLIENT-AD$@AD.EXAMPLE.NET
root at client-ad:~# kinit administrator
Password for administrator at AD.EXAMPLE.NET:
Warning: Your password will expire in 35 days on Tue Dec 27 13:26:04 2016
root at client-ad:~# ldapsearch -Y GSSAPI -h smb1.ad.example.net -b
'dc=ad,dc=example,dc=net' '(cn=client-ad)'
SASL/GSSAPI authentication started
SASL username: administrator at AD.EXAMPLE.NET
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=ad,dc=example,dc=net> with scope subtree
# filter: (cn=client-ad)
# requesting: ALL
#
# client-ad, Computers, ad.example.net
dn: CN=client-ad,CN=Computers,DC=ad,DC=example,DC=net
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: client-ad
instanceType: 4
whenCreated: 20161115132901.0Z
uSNCreated: 3771
name: client-ad
objectGUID:: jL/LCkj1J0aOAfBG+Ihiyw=badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
primaryGroupID: 515
objectSid:: AQUAAAAAAAUVAAAAyBbgO04O66k3VaeHTwQAAA=accountExpires:
9223372036854775807
logonCount: 0
sAMAccountName: client-ad$
sAMAccountType: 805306369
objectCategory:
CN=Computer,CN=Schema,CN=Configuration,DC=ad,DC=example,DC=net
isCriticalSystemObject: FALSE
userAccountControl: 69632
dNSHostName: client-ad.ad.example.net
servicePrincipalName: HOST/CLIENT-AD
servicePrincipalName: HOST/client-ad.ad.example.net
lastLogonTimestamp: 131236901423222820
pwdLastSet: 131242176390000000
whenChanged: 20161121160039.0Z
uSNChanged: 3864
lastLogon: 131242198254858430
distinguishedName: CN=client-ad,CN=Computers,DC=ad,DC=example,DC=net
# search reference
ref: ldap://ad.example.net/CN=Configuration,DC=ad,DC=example,DC=net
# search reference
ref: ldap://ad.example.net/DC=DomainDnsZones,DC=ad,DC=example,DC=net
# search reference
ref: ldap://ad.example.net/DC=ForestDnsZones,DC=ad,DC=example,DC=net
# search result
search: 4
result: 0 Success
# numResponses: 5
# numEntries: 1
# numReferences: 3
(**)
16:37:05.449545 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [S],
seq 1115242950, win 29200, options [mss 1460,sackOK,TS val 5433953 ecr
0,nop,wscale 7], length 0
0x0000: 4500 003c aba7 4000 4006 9d82 c0a8 3821 E..<.. at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 41c6 0000 0000 ..8.....ByA.....
0x0020: a002 7210 f1c0 0000 0204 05b4 0402 080a ..r.............
0x0030: 0052 ea61 0000 0000 0103 0307 .R.a........
16:37:05.449634 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [S.],
seq 1871167462, ack 1115242951, win 28960, options [mss 1460,sackOK,TS
val 5433953 ecr 5433953,nop,wscale 7], length 0
0x0000: 4500 003c 0000 4000 4006 492a c0a8 3820 E..<.. at .@.I*..8.
0x0010: c0a8 3821 0185 c10a 6f87 bfe6 4279 41c7 ..8!....o...ByA.
0x0020: a012 7120 f1c0 0000 0204 05b4 0402 080a ..q.............
0x0030: 0052 ea61 0052 ea61 0103 0307 .R.a.R.a....
16:37:05.449657 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 1, win 229, options [nop,nop,TS val 5433954 ecr 5433953], length 0
0x0000: 4500 0034 aba8 4000 4006 9d89 c0a8 3821 E..4.. at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 41c7 6f87 bfe7 ..8.....ByA.o...
0x0020: 8010 00e5 f1b8 0000 0101 080a 0052 ea62 .............R.b
0x0030: 0052 ea61 .R.a
16:37:05.449717 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 1:53, ack 1, win 229, options [nop,nop,TS val 5433954 ecr 5433953],
length 52
0x0000: 4500 0068 aba9 4000 4006 9d54 c0a8 3821 E..h.. at .@..T..8!
0x0010: c0a8 3820 c10a 0185 4279 41c7 6f87 bfe7 ..8.....ByA.o...
0x0020: 8018 00e5 f1ec 0000 0101 080a 0052 ea62 .............R.b
0x0030: 0052 ea61 3032 0201 0163 2d04 000a 0100 .R.a02...c-.....
0x0040: 0a01 0002 0100 0201 0f01 0100 870b 6f62 ..............ob
0x0050: 6a65 6374 636c 6173 7330 0d04 0b63 7572 jectclass0...cur
0x0060: 7265 6e74 5469 6d65 rentTime
16:37:05.449725 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [.],
ack 53, win 227, options [nop,nop,TS val 5433954 ecr 5433954], length 0
0x0000: 4500 0034 5585 4000 4006 f3ac c0a8 3820 E..4U. at .@.....8.
0x0010: c0a8 3821 0185 c10a 6f87 bfe7 4279 41fb ..8!....o...ByA.
0x0020: 8010 00e3 f1b8 0000 0101 080a 0052 ea62 .............R.b
0x0030: 0052 ea62 .R.b
16:37:05.456658 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 1:62, ack 53, win 227, options [nop,nop,TS val 5433955 ecr 5433954],
length 61
0x0000: 4500 0071 5586 4000 4006 f36e c0a8 3820 E..qU. at .@..n..8.
0x0010: c0a8 3821 0185 c10a 6f87 bfe7 4279 41fb ..8!....o...ByA.
0x0020: 8018 00e3 f1f5 0000 0101 080a 0052 ea63 .............R.c
0x0030: 0052 ea62 302d 0201 0164 2804 0030 2430 .R.b0-...d(..0$0
0x0040: 2204 0b63 7572 7265 6e74 5469 6d65 3113 "..currentTime1.
0x0050: 0411 3230 3136 3131 3231 3136 3337 3035 ..20161121163705
0x0060: 2e30 5a30 0c02 0101 6507 0a01 0004 0004 .0Z0....e.......
0x0070: 00 .
16:37:05.456798 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 62, win 229, options [nop,nop,TS val 5433956 ecr 5433955], length 0
0x0000: 4500 0034 abaa 4000 4006 9d87 c0a8 3821 E..4.. at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 41fb 6f87 c024 ..8.....ByA.o..$
0x0020: 8010 00e5 f1b8 0000 0101 080a 0052 ea64 .............R.d
0x0030: 0052 ea63 .R.c
16:37:05.456923 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 53:117, ack 62, win 229, options [nop,nop,TS val 5433956 ecr
5433955], length 64
0x0000: 4500 0074 abab 4000 4006 9d46 c0a8 3821 E..t.. at .@..F..8!
0x0010: c0a8 3820 c10a 0185 4279 41fb 6f87 c024 ..8.....ByA.o..$
0x0020: 8018 00e5 f1f8 0000 0101 080a 0052 ea64 .............R.d
0x0030: 0052 ea63 303e 0201 0263 3904 000a 0100 .R.c0>...c9.....
0x0040: 0a01 0002 0100 0201 0f01 0100 870b 6f62 ..............ob
0x0050: 6a65 6374 636c 6173 7330 1904 1773 7570 jectclass0...sup
0x0060: 706f 7274 6564 5341 534c 4d65 6368 616e portedSASLMechan
0x0070: 6973 6d73 isms
16:37:05.457108 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 62:142, ack 117, win 227, options [nop,nop,TS val 5433956 ecr
5433956], length 80
0x0000: 4500 0084 5587 4000 4006 f35a c0a8 3820 E...U. at .@..Z..8.
0x0010: c0a8 3821 0185 c10a 6f87 c024 4279 423b ..8!....o..$ByB;
0x0020: 8018 00e3 f208 0000 0101 080a 0052 ea64 .............R.d
0x0030: 0052 ea64 3040 0201 0264 3b04 0030 3730 .R.d0 at ...d;..070
0x0040: 3504 1773 7570 706f 7274 6564 5341 534c 5..supportedSASL
0x0050: 4d65 6368 616e 6973 6d73 311a 040a 4753 Mechanisms1...GS
0x0060: 532d 5350 4e45 474f 0406 4753 5341 5049 S-SPNEGO..GSSAPI
0x0070: 0404 4e54 4c4d 300c 0201 0265 070a 0100 ..NTLM0....e....
0x0080: 0400 0400 ....
16:37:05.457239 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 117:143, ack 142, win 229, options [nop,nop,TS val 5433956 ecr
5433956], length 26
0x0000: 4500 004e abac 4000 4006 9d6b c0a8 3821 E..N.. at .@..k..8!
0x0010: c0a8 3820 c10a 0185 4279 423b 6f87 c074 ..8.....ByB;o..t
0x0020: 8018 00e5 f1d2 0000 0101 080a 0052 ea64 .............R.d
0x0030: 0052 ea64 3018 0201 0360 1302 0103 0400 .R.d0....`......
0x0040: a30c 040a 4753 532d 5350 4e45 474f ....GSS-SPNEGO
16:37:05.458316 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 142:254, ack 143, win 227, options [nop,nop,TS val 5433956 ecr
5433956], length 112
0x0000: 4500 00a4 5588 4000 4006 f339 c0a8 3820 E...U. at .@..9..8.
0x0010: c0a8 3821 0185 c10a 6f87 c074 4279 4255 ..8!....o..tByBU
0x0020: 8018 00e3 f228 0000 0101 080a 0052 ea64 .....(.......R.d
0x0030: 0052 ea64 306e 0201 0361 690a 010e 0400 .R.d0n...ai.....
0x0040: 0400 8760 605e 0606 2b06 0105 0502 a054 ...``^..+......T
0x0050: 3052 a024 3022 0609 2a86 4882 f712 0102 0R.$0"..*.H.....
0x0060: 0206 092a 8648 86f7 1201 0202 060a 2b06 ...*.H........+.
0x0070: 0104 0182 3702 020a a32a 3028 a026 1b24 ....7....*0(.&.$
0x0080: 6e6f 745f 6465 6669 6e65 645f 696e 5f52 not_defined_in_R
0x0090: 4643 3431 3738 4070 6c65 6173 655f 6967 FC4178 at please_ig
0x00a0: 6e6f 7265 nore
16:37:05.496321 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 254, win 229, options [nop,nop,TS val 5433966 ecr 5433956], length 0
0x0000: 4500 0034 abad 4000 4006 9d84 c0a8 3821 E..4.. at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 4255 6f87 c0e4 ..8.....ByBUo...
0x0020: 8010 00e5 f1b8 0000 0101 080a 0052 ea6e .............R.n
0x0030: 0052 ea64 .R.d
16:37:05.534568 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 143:2745, ack 254, win 229, options [nop,nop,TS val 5433975 ecr
5433956], length 2602
0x0000: 4500 0a5e abae 4000 4006 9359 c0a8 3821 E..^.. at .@..Y..8!
0x0010: c0a8 3820 c10a 0185 4279 4255 6f87 c0e4 ..8.....ByBUo...
0x0020: 8018 00e5 fbe2 0000 0101 080a 0052 ea77 .............R.w
0x0030: 0052 ea64 3082 0a26 0201 0460 820a 1f02 .R.d0..&...`....
0x0040: 0103 0400 a382 0a16 040a 4753 532d 5350 ..........GSS-SP
0x0050: 4e45 474f 0482 0a06 6082 0a02 0606 2b06 NEGO....`.....+.
0x0060: 0105 0502 a082 09f6 3082 09f2 a018 3016 ........0.....0.
0x0070: 0609 2a86 4882 f712 0102 0206 092a 8648 ..*.H........*.H
0x0080: 86f7 1201 0202 a282 09d4 0482 09d0 6082 ..............`.
0x0090: 09cc 0609 2a86 4886 f712 0102 0201 006e ....*.H........n
0x00a0: 8209 bb30 8209 b7a0 0302 0105 a103 0201 ...0............
0x00b0: 0ea2 0703 0500 2000 0000 a382 03a4 6182 ..............a.
0x00c0: 03a0 3082 039c a003 0201 05a1 101b 0e41 ..0............A
0x00d0: 442e 4558 414d 504c 452e 4e45 54a2 2630 D.EXAMPLE.NET.&0
0x00e0: 24a0 0302 0101 a11d 301b 1b04 6c64 6170 $.......0...ldap
0x00f0: 1b13 736d 6231 2e61 642e 6578 616d 706c ..smb1.ad.exampl
0x0100: 652e 6e65 74a3 8203 5930 8203 55a0 0302 e.net...Y0..U...
0x0110: 0112 a103 0201 01a2 8203 4704 8203 439e ..........G...C.
0x0120: 0b55 e5e1 592a 3d8b f714 1658 e779 413a .U..Y*=....X.yA:
0x0130: 27ba 0a5c ab3d 7410 97e0 bc81 6ee7 ebbc '..\.=t.....n...
0x0140: f79c 57bf d6f0 026b e51e 0fd8 0d7c 5479 ..W....k.....|Ty
0x0150: 2015 e53d a42e a080 09e4 c5a4 a470 c576 ...=.........p.v
0x0160: 27d3 2bdb 3301 31fc 66c0 098e cd9a 666f '.+.3.1.f.....fo
0x0170: 2d85 976e 57d1 010e 22e6 d4a6 ce2b 5371 -..nW..."....+Sq
0x0180: 0c41 f955 20af 683f 9abe 90bf ec73 ec72 .A.U..h?.....s.r
0x0190: 14b6 776a 5767 f3cb fff9 167e 2fa8 d9ac ..wjWg.....~/...
0x01a0: 0fbf d4d9 a017 bb2a f7d9 90da 63ee 6d22 .......*....c.m"
0x01b0: b184 98fa bed3 f32c 2d9e 527a 5aa8 1df6 .......,-.RzZ...
0x01c0: 260b bd11 2db1 5235 45cc e0b4 3504 d650 &...-.R5E...5..P
0x01d0: 544a e6eb 9e3d 49e5 42ea 9b68 c437 026d TJ...=I.B..h.7.m
0x01e0: ce84 8eba 45a0 c1fb 21b2 7f28 5b80 b429 ....E...!..([..)
0x01f0: 6870 978b 464e e606 6caa f4f3 a9ca 0b3d hp..FN..l......
0x0200: 5566 aea5 a874 491c f93d 7b15 c4b4 ce07 Uf...tI..={.....
0x0210: 6bdb 867c e954 761d 9965 7d05 26d9 2623 k..|.Tv..e}.&.&#
0x0220: 4128 7b34 cfe5 f565 006a 2be3 923d c95c A({4...e.j+..=.\
0x0230: d596 b608 88e8 b117 cbbc 66e8 d1b8 f835 ..........f....5
0x0240: 572a bb2b eb7b afba 1a6a b1ab 125e ccea W*.+.{...j...^..
0x0250: d632 5861 d893 c1c8 30c9 a737 33b3 c978 .2Xa....0..73..x
0x0260: 3592 ee3b 7a8d c1c4 29db 736f c0c2 5cf5 5..;z...).so..\.
0x0270: db6f 0ba0 7d9e b056 27b4 7a8a c7a2 8de8 .o..}..V'.z.....
0x0280: 1774 89b7 bd0e 7ab5 ba4d b52b 151f 7377 .t....z..M.+..sw
0x0290: 89ae 2dab 6009 2329 0796 448c ea6c 19cc ..-.`.#)..D..l..
0x02a0: bea0 aa09 f4d8 af1c 4441 060a 2eb6 440d ........DA....D.
0x02b0: 0a0e cf6b 005d 678c 14c0 6fbb 3429 19f6 ...k.]g...o.4)..
0x02c0: 7ad9 795b 3331 506f 898e ef6b 72e6 2526 z.y[31Po...kr.%&
0x02d0: 342b dbd0 15b2 f402 c291 c2e0 ad2e af23 4+.............#
0x02e0: 2378 42c2 6cb8 4076 8058 c381 bea5 69ab #xB.l. at v.X....i.
0x02f0: 99ac 1730 dcab 9904 d685 67f1 8f6a ff6f ...0......g..j.o
0x0300: 3f70 6132 16d5 251d abc4 a8e5 b178 d86e ?pa2..%......x.n
0x0310: cb0c a839 0c03 6638 70a6 b205 d357 9e18 ...9..f8p....W..
0x0320: cf51 470c 026b cd73 2d37 c602 3e9a 627c .QG..k.s-7..>.b|
0x0330: 251a d825 95a4 86a3 428a 371c bbb0 70f7 %..%....B.7...p.
0x0340: 07dc 4da5 83d2 0a90 92ca 1046 d2db e5d5 ..M........F....
0x0350: 6583 9379 789d 41d8 1734 5796 b4ea d97f e..yx.A..4W.....
0x0360: b564 bd31 5cd1 081a 676e bb5f e81d c0b6 .d.1\...gn._....
0x0370: c690 7ab2 6f6b 0a09 1cc1 1105 1580 8bb2 ..z.ok..........
0x0380: 122f cc6e 62a6 e876 462b a50a 9042 f411 ./.nb..vF+...B..
0x0390: 3f65 c114 f2c2 328a 9594 bb05 a057 9314 ?e....2......W..
0x03a0: 135b 0b07 53a1 9def 792c 71cb c9c2 6eff .[..S...y,q...n.
0x03b0: d6ee 1346 d7fd e254 448a 17ba 50d1 6354 ...F...TD...P.cT
0x03c0: 2709 2f38 34d7 8fdd 4ff4 bed5 bdda 8bc1 './84...O.......
0x03d0: dbbd 328f 107d 7a1b d4a8 d7cf 66f2 fee0 ..2..}z.....f...
0x03e0: 328b 0b6f 6606 bfe3 af0c 591f 6b69 269d 2..of.....Y.ki&.
0x03f0: 82ef 891a 8b85 cb38 b088 1eaf 880b 43be .......8......C.
0x0400: 53a5 5f7b 5fe4 790e 6a09 f27b df77 0117 S._{_.y.j..{.w..
0x0410: 53c7 0041 72f0 b80e a3ab 7569 b8eb 7292 S..Ar.....ui..r.
0x0420: ba83 6122 e237 b55e 1f7a 0f37 3462 1f40 ..a".7.^.z.74b.@
0x0430: 7629 fbfe b93c 9d19 aa81 257e 00ac 6631 v)...<....%~..f1
0x0440: 844b 5ccb a407 a08f 9675 6f17 f171 9ee0 .K\......uo..q..
0x0450: 35b3 6ce5 8ea4 6c2a dc5c 30c9 0221 bf05 5.l...l*.\0..!..
0x0460: 2165 a482 05f8 3082 05f4 a003 0201 12a2 !e....0.........
0x0470: 8205 eb04 8205 e705 b5c5 eff2 dd73 0a54 .............s.T
0x0480: 543c d96e bf96 3fcc 7e35 aace f3cf f505 T<.n..?.~5......
0x0490: 23c8 8c3d 4c5d 87d1 d586 2728 c13b 05a1 #..=L]....'(.;..
0x04a0: 4039 d945 1347 8424 aa46 8ad9 6f7b 8ab5 @9.E.G.$.F..o{..
0x04b0: a357 ebba 5466 5ce0 78cf 167e f7ae fc14 .W..Tf\.x..~....
0x04c0: 3ab6 cb7d 4588 61c9 13a7 3448 3b8c 27b3 :..}E.a...4H;.'.
0x04d0: 586a 2586 38f2 0980 4e0b f1f6 b07a 162f Xj%.8...N....z./
0x04e0: bee0 c35e c04d 01f5 5d44 f6ee 1c20 cb7d ...^.M..]D.....}
0x04f0: a057 3f0d cf82 5241 d7b8 8bbd 5e4a fad4 .W?...RA....^J..
0x0500: d16d 0a04 f688 a158 89ac 951e 2051 bbf8 .m.....X.....Q..
0x0510: 2199 a9ed 1c97 4606 b4cc 9863 c5a8 8d06 !.....F....c....
0x0520: 5c69 85a9 2757 a815 4c12 006c accc d5f5 \i..'W..L..l....
0x0530: ebd0 0373 f1f0 248e 7831 f59f ec5f 76f4 ...s..$.x1..._v.
0x0540: 6863 b7df 7e84 fd2a 23f9 87ec c9c0 813a hc..~..*#......:
0x0550: 45e4 3ae4 67a6 15e1 72ae 95ff 232b f9a4 E.:.g...r...#+..
0x0560: 86c6 636c 3164 37e8 e799 6909 3299 c8a1 ..cl1d7...i.2...
0x0570: 9d42 cdf0 320a b2e9 f46a 0c15 37f9 5936 .B..2....j..7.Y6
0x0580: 14d5 8258 4afa d355 ff0f 56a5 e56f 22c5 ...XJ..U..V..o".
0x0590: ba72 07e6 80a2 38a3 db54 3cb5 410f bb85 .r....8..T<.A...
0x05a0: f490 db3c 5a33 6358 e4e0 3da6 aed2 9561 ...<Z3cX..=....a
0x05b0: 919b 7ae2 9dc7 c469 3e88 9957 784b 9774 ..z....i>..WxK.t
0x05c0: 471c 5d66 e0b5 1bd5 c6f7 d374 82b1 160e G.]f.......t....
0x05d0: 69ac 3af8 9c8d 1aa6 b709 9762 0efa 367d i.:........b..6}
0x05e0: 0c7b 47be 8847 331e aca1 829c 5829 dabf .{G..G3.....X)..
0x05f0: e13a d216 dc00 f5d5 4adf ecdf 8aab c6c2 .:......J.......
0x0600: 0c7e de3b d3f3 d16d 80a2 79c8 5a91 c52c .~.;...m..y.Z..,
0x0610: e7bb eb30 1343 599b f4f9 affb 8a89 71e6 ...0.CY.......q.
0x0620: c351 80db 869d 2eda 603e 4b0d 6b25 6151 .Q......`>K.k%aQ
0x0630: 703a c8c3 d7a7 54df 431d 5e3a b91e ea43 p:....T.C.^:...C
0x0640: c5fd 294f aa32 8fab 355c 77fc cf8e 9e4a ..)O.2..5\w....J
0x0650: 2db7 91f9 2cc5 a93b c5d7 267e adfe 9615 -...,..;..&~....
0x0660: 1efc ceb3 38e7 ca78 8759 3459 59d8 5376 ....8..x.Y4YY.Sv
0x0670: 55e2 e667 e37f c099 d61e 0984 5173 db53 U..g........Qs.S
0x0680: 373c 2427 5d85 b122 2af4 f469 b251 4e9b
7<$'].."*..i.QN.
0x0690: fb5f a401 2a03 b37a acd4 49c9 c858 880d ._..*..z..I..X..
0x06a0: fd0c 00fa 3caa 14ac c181 fe26 b282 49a9 ....<......&..I.
0x06b0: f50e 9f1e e4e3 0b5a 92a8 5d8f fcc3 137e .......Z..]....~
0x06c0: e9ae b63b 084c 7baf d6bf 0c71 9c97 540b ...;.L{....q..T.
0x06d0: 0d72 2db2 c718 ab96 4e64 dc1c 5566 4fdf .r-.....Nd..UfO.
0x06e0: 2d7b 6465 cb59 c263 34db 9565 d558 8347 -{de.Y.c4..e.X.G
0x06f0: 17aa d3dd 7252 9cb5 47cc 9473 0689 6607 ....rR..G..s..f.
0x0700: a3a0 da17 adad 8f69 64b0 b445 817e a119 .......id..E.~..
0x0710: 6393 abed fb70 ed26 0000 7949 24b0 012d c....p.&..yI$..-
0x0720: 706b a19c e86c dd44 b486 fbbc 314a 50a1 pk...l.D....1JP.
0x0730: 0a0a 475f 36b1 7fc3 f1c3 5430 ab40 5c4c ..G_6.....T0.@\L
0x0740: c932 a1ca b7b8 5d30 8b2e 4dcd 8df8 f34f .2....]0..M....O
0x0750: 9126 13f1 8727 b41a 53b5 e3d2 2feb 9770 .&...'..S.../..p
0x0760: 4368 8f72 9a37 5847 91c0 93c0 68b9 2464 Ch.r.7XG....h.$d
0x0770: 3fd7 56c2 7428 d107 864c d8cc 0276 1e8f ?.V.t(...L...v..
0x0780: 457a 5b96 2def a5b4 63fd d004 8928 4599 Ez[.-...c....(E.
0x0790: d941 cfcb bc95 5bef 4855 20b9 7eef de99 .A....[.HU..~...
0x07a0: a260 7cd7 1bf2 2af2 0da8 2ff3 2a83 f829 .`|...*.../.*..)
0x07b0: 14be 98f1 e9e8 92c4 5789 fd31 1389 b5f4 ........W..1....
0x07c0: ee34 ab7e d3e9 062f 971f 6387 1f7b 3652 .4.~.../..c..{6R
0x07d0: 799a 0767 e240 87c3 7caa 27ed ca04 7d4f y..g. at ..|.'...}O
0x07e0: dd3a 97f3 cfd8 cee8 d55d c86c dd30 71e3 .:.......].l.0q.
0x07f0: e85b 3f2e daee 60cc 683a 977e 23a5 758f .[?...`.h:.~#.u.
0x0800: 7a8d 2f3f c109 cbe4 8fda aaa8 f694 6e51 z./?..........nQ
0x0810: 8460 cf56 d5c1 4b78 6d57 6831 ba9e 7a50 .`.V..KxmWh1..zP
0x0820: d17b 10f7 f47d a465 37ed 6b81 f059 c28f .{...}.e7.k..Y..
0x0830: 1f00 af7c 21eb f999 a4b5 6dc1 c97b 2f86 ...|!.....m..{/.
0x0840: 0de6 a4d5 85d4 3965 0f70 69f3 75f6 5425 ......9e.pi.u.T%
0x0850: f683 7d78 2f56 154c 0cd4 f98e c541 600e ..}x/V.L.....A`.
0x0860: 56c8 977c eee9 d647 df2c ebbf 6cd4 8305 V..|...G.,..l...
0x0870: b82b 70f1 740c 2574 beb7 6808 29f3 7736 .+p.t.%t..h.).w6
0x0880: 3446 2449 ec63 70d6 bf66 3590 17a8 edd4 4F$I.cp..f5.....
0x0890: 78d3 51e4 8b58 5f31 a224 f329 42e1 b40b x.Q..X_1.$.)B...
0x08a0: f228 4964 1e95 33e2 2e1e 891f a174 ec8c .(Id..3......t..
0x08b0: 1f51 f173 d85d a435 7381 e48b e1d9 61a2 .Q.s.].5s.....a.
0x08c0: 394e abec 79b8 0b28 20b3 7601 1002 cfc0 9N..y..(..v.....
0x08d0: f13c 2678 09a3 dc3f 16e8 a57b 8c1d b8e6 .<&x...?...{....
0x08e0: e8d2 db3e 01b3 fe0e d591 2f48 edc8 8863 ...>....../H...c
0x08f0: c4a2 f0cd c4db b2a3 9078 66d1 aa7c ee01 .........xf..|..
0x0900: 7f75 1224 f253 de1c b90c 608c 9b95 763e .u.$.S....`...v>
0x0910: 9a36 d6b1 3849 2dab 6e19 f4c9 7e23 647d .6..8I-.n...~#d}
0x0920: e689 e733 cf3a 8a61 3436 a75f 38b0 2b38 ...3.:.a46._8.+8
0x0930: e942 89cc 9e56 ba8b 699d faa2 c3b9 86b7 .B...V..i.......
0x0940: 3bb5 12d8 af3a eff1 2d61 88b1 b524 387b ;....:..-a...$8{
0x0950: b81b ccae 1c11 dbf6 226e 52ae 7003 2915 ........"nR.p.).
0x0960: 33d7 ec02 599a 8333 2af1 be89 0365 fdc5 3...Y..3*....e..
0x0970: a0c1 b0bd c3dd 6da5 6063 ca5c ceec 6ee6 ......m.`c.\..n.
0x0980: ecd8 82af 060c 3b0f 11be f08b 609f edea ......;.....`...
0x0990: 9694 81e1 7f71 6196 ee87 0131 d0c3 2ad2 .....qa....1..*.
0x09a0: f3e1 2622 ca10 d769 1dc7 7bf3 d566 b641 ..&"...i..{..f.A
0x09b0: b9be d767 d978 53ae e7c3 15eb cae9 727a ...g.xS.......rz
0x09c0: e9fc e44c 716e c762 87a2 5bc5 2013 a491 ...Lqn.b..[.....
0x09d0: 026b 2963 24ed 3e15 2a28 e86e b62e 3669 .k)c$.>.*(.n..6i
0x09e0: abe4 58e0 b9b5 de4a 1b00 8209 99b5 bc7f ..X....J........
0x09f0: 4c3f 9b1f 7042 7742 a3e1 d653 fbb8 7033 L?..pBwB...S..p3
0x0a00: d727 4627 2304 e30f 8d6e 0515 c026 bc81
.'F'#....n...&..
0x0a10: e537 e562 57ee a305 83b1 d39e b3ed a13e .7.bW..........>
0x0a20: eb00 39f1 cd18 3996 e397 d27b 0925 bad7 ..9...9....{.%..
0x0a30: b3a5 7640 58d3 ca93 c8aa f92c 0100 a6a2 ..v at X......,....
0x0a40: dbf9 2b2c 5cd3 960f 0777 05ea c9d0 1582 ..+,\....w......
0x0a50: 96eb a089 60be 351f ed2c 2297 fb99 ....`.5..,"...
16:37:05.534624 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [.],
ack 2745, win 267, options [nop,nop,TS val 5433975 ecr 5433975], length 0
0x0000: 4500 0034 5589 4000 4006 f3a8 c0a8 3820 E..4U. at .@.....8.
0x0010: c0a8 3821 0185 c10a 6f87 c0e4 4279 4c7f ..8!....o...ByL.
0x0020: 8010 010b f1b8 0000 0101 080a 0052 ea77 .............R.w
0x0030: 0052 ea77 .R.w
16:37:05.544484 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 254:459, ack 2745, win 267, options [nop,nop,TS val 5433977 ecr
5433975], length 205
0x0000: 4500 0101 558a 4000 4006 f2da c0a8 3820 E...U. at .@.....8.
0x0010: c0a8 3821 0185 c10a 6f87 c0e4 4279 4c7f ..8!....o...ByL.
0x0020: 8018 010b f285 0000 0101 080a 0052 ea79 .............R.y
0x0030: 0052 ea77 3081 ca02 0104 6181 c40a 0100 .R.w0.....a.....
0x0040: 0400 0400 8781 baa1 81b7 3081 b4a0 030a ..........0.....
0x0050: 0100 a10b 0609 2a86 4882 f712 0102 02a2 ......*.H.......
0x0060: 819f 0481 9c60 8199 0609 2a86 4886 f712 .....`....*.H...
0x0070: 0102 0202 006f 8189 3081 86a0 0302 0105 .....o..0.......
0x0080: a103 0201 0fa2 7a30 78a0 0302 0112 a271 ......z0x......q
0x0090: 046f dd5f f147 1ae3 65d2 f2b8 efce df05 .o._.G..e.......
0x00a0: 3749 e012 6064 55ce 00f4 4a2f e2db 3486 7I..`dU...J/..4.
0x00b0: c65b 136d d7d2 fd3e 8ee9 f03e 3581 e3e3 .[.m...>...>5...
0x00c0: 0509 7c7f 8d3a 5943 44b6 af89 e29a 2af0 ..|..:YCD.....*.
0x00d0: 71a2 7bbe 8be5 d23c b2da c14e bc64 5d99 q.{....<...N.d].
0x00e0: 1663 8dac a34b 96b0 742d 061a 186d 8300 .c...K..t-...m..
0x00f0: adc5 cc71 6094 585a baa7 4364 4460 0222 ...q`.XZ..CdD`."
0x0100: f8 .
16:37:05.544581 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 459, win 237, options [nop,nop,TS val 5433977 ecr 5433977], length 0
0x0000: 4500 0034 abb0 4000 4006 9d81 c0a8 3821 E..4.. at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 4c7f 6f87 c1b1 ..8.....ByL.o...
0x0020: 8010 00ed f1b8 0000 0101 080a 0052 ea79 .............R.y
0x0030: 0052 ea79 .R.y
16:37:05.544937 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 2745:2908, ack 459, win 237, options [nop,nop,TS val 5433978 ecr
5433977], length 163
0x0000: 4500 00d7 abb1 4000 4006 9cdd c0a8 3821 E..... at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 4c7f 6f87 c1b1 ..8.....ByL.o...
0x0020: 8018 00ed f25b 0000 0101 080a 0052 ea7a .....[.......R.z
0x0030: 0052 ea79 0000 009f 0504 04ff 000c 000c .R.y............
0x0040: 0000 0000 12bf 074b 14fd 1f31 4a18 b884 .......K...1J...
0x0050: 75fa bf38 3081 8002 0105 6335 0400 0a01 u..80.....c5....
0x0060: 000a 0100 0201 0002 010f 0101 0087 0b6f ...............o
0x0070: 626a 6563 7463 6c61 7373 3015 0413 6869 bjectclass0...hi
0x0080: 6768 6573 7443 6f6d 6d69 7474 6564 5553 ghestCommittedUS
0x0090: 4ea0 4430 1b04 1731 2e32 2e38 3430 2e31 N.D0...1.2.840.1
0x00a0: 3133 3535 362e 312e 342e 3133 3339 0400 13556.1.4.1339..
0x00b0: 3025 0416 312e 322e 3834 302e 3131 3335 0%..1.2.840.1135
0x00c0: 3536 2e31 2e34 2e33 3139 0101 ff04 0830 56.1.4.319.....0
0x00d0: 0602 0203 e804 00 .......
16:37:05.545556 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 459:547, ack 2908, win 290, options [nop,nop,TS val 5433978 ecr
5433978], length 88
0x0000: 4500 008c 558b 4000 4006 f34e c0a8 3820 E...U. at .@..N..8.
0x0010: c0a8 3821 0185 c10a 6f87 c1b1 4279 4d22 ..8!....o...ByM"
0x0020: 8018 0122 f210 0000 0101 080a 0052 ea7a ...".........R.z
0x0030: 0052 ea7a 0000 0054 0504 05ff 000c 000c .R.z...T........
0x0040: 0000 0000 2362 f4c8 a58d 29cb 2e08 4f01 ....#b....)...O.
0x0050: 9ea0 cb8f 3028 0201 0564 2304 0030 1f30 ....0(...d#..0.0
0x0060: 1d04 1368 6967 6865 7374 436f 6d6d 6974 ...highestCommit
0x0070: 7465 6455 534e 3106 0404 3338 3735 300c tedUSN1...38750.
0x0080: 0201 0565 070a 0100 0400 0400 ...e........
16:37:05.553889 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 2908:3106, ack 547, win 237, options [nop,nop,TS val 5433980 ecr
5433978], length 198
0x0000: 4500 00fa abb2 4000 4006 9cb9 c0a8 3821 E..... at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 4d22 6f87 c209 ..8.....ByM"o...
0x0020: 8018 00ed f27e 0000 0101 080a 0052 ea7c .....~.......R.|
0x0030: 0052 ea7a 0000 00c2 0504 04ff 000c 000c .R.z............
0x0040: 0000 0000 12bf 074c 4d70 f42b d883 5c13 .......LMp.+..\.
0x0050: e0bb 4f34 3081 a302 0106 6358 0417 6463 ..O40.....cX..dc
0x0060: 3d41 442c 6463 3d45 5841 4d50 4c45 2c64 =AD,dc=EXAMPLE,d
0x0070: 633d 4e45 540a 0102 0a01 0002 0100 0201 c=NET...........
0x0080: 0f01 0100 a329 0409 6f62 6a65 6374 5369 .....)..objectSi
0x0090: 6404 1c01 0500 0000 0000 0515 0000 00c8 d...............
0x00a0: 16e0 3b4e 0eeb a937 55a7 8752 0400 0030 ..;N...7U..R...0
0x00b0: 0304 012a a044 301b 0417 312e 322e 3834 ...*.D0...1.2.84
0x00c0: 302e 3131 3335 3536 2e31 2e34 2e31 3333 0.113556.1.4.133
0x00d0: 3904 0030 2504 1631 2e32 2e38 3430 2e31 9..0%..1.2.840.1
0x00e0: 3133 3535 362e 312e 342e 3331 3901 01ff 13556.1.4.319...
0x00f0: 0408 3006 0202 03e8 0400 ..0.......
16:37:05.557941 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 547:1731, ack 3106, win 313, options [nop,nop,TS val 5433981 ecr
5433980], length 1184
0x0000: 4500 04d4 558c 4000 4006 ef05 c0a8 3820 E...U. at .@.....8.
0x0010: c0a8 3821 0185 c10a 6f87 c209 4279 4de8 ..8!....o...ByM.
0x0020: 8018 0139 f658 0000 0101 080a 0052 ea7d ...9.X.......R.}
0x0030: 0052 ea7c 0000 049c 0504 05ff 000c 000c .R.|............
0x0040: 0000 0000 2362 f4c9 1ccd 3b10 bc84 b8b3 ....#b....;.....
0x0050: 7f15 2d41 3082 0449 0201 0664 8204 4204 ..-A0..I...d..B.
0x0060: 2943 4e3d 7573 6572 322c 434e 3d55 7365 )CN=user2,CN=Use
0x0070: 7273 2c44 433d 6164 2c44 433d 6578 616d rs,DC=ad,DC=exam
0x0080: 706c 652c 4443 3d6e 6574 3082 0413 300d ple,DC=net0...0.
0x0090: 0402 636e 3107 0405 7573 6572 3230 1304 ..cn1...user20..
0x00a0: 0c69 6e73 7461 6e63 6554 7970 6531 0304 .instanceType1..
0x00b0: 0134 3022 040b 7768 656e 4372 6561 7465 .40"..whenCreate
0x00c0: 6431 1304 1132 3031 3631 3132 3131 3130 d1...20161121110
0x00d0: 3030 362e 305a 3014 040a 7553 4e43 7265 006.0Z0...uSNCre
0x00e0: 6174 6564 3106 0404 3338 3133 300f 0404 ated1...38130...
0x00f0: 6e61 6d65 3107 0405 7573 6572 3230 2004 name1...user20..
0x0100: 0a6f 626a 6563 7447 5549 4431 1204 108a .objectGUID1....
0x0110: d701 78d8 ced9 4eb5 99c1 d171 9dcf ef30 ..x...N....q...0
0x0120: 1204 0b62 6164 5077 6443 6f75 6e74 3103 ...badPwdCount1.
0x0130: 0401 3030 0f04 0863 6f64 6550 6167 6531 ..00...codePage1
0x0140: 0304 0130 3012 040b 636f 756e 7472 7943 ...00...countryC
0x0150: 6f64 6531 0304 0130 3016 040f 6261 6450 ode1...00...badP
0x0160: 6173 7377 6f72 6454 696d 6531 0304 0130 asswordTime1...0
0x0170: 3011 040a 6c61 7374 4c6f 676f 6666 3103 0...lastLogoff1.
0x0180: 0401 3030 2b04 096f 626a 6563 7453 6964 ..00+..objectSid
0x0190: 311e 041c 0105 0000 0000 0005 1500 0000 1...............
0x01a0: c816 e03b 4e0e eba9 3755 a787 5204 0000 ...;N...7U..R...
0x01b0: 3027 040e 6163 636f 756e 7445 7870 6972 0'..accountExpir
0x01c0: 6573 3115 0413 3932 3233 3337 3230 3336 es1...9223372036
0x01d0: 3835 3437 3735 3830 3730 1104 0a6c 6f67 8547758070...log
0x01e0: 6f6e 436f 756e 7431 0304 0130 3019 040e onCount1...00...
0x01f0: 7341 4d41 6363 6f75 6e74 4e61 6d65 3107 sAMAccountName1.
0x0200: 0405 7573 6572 3230 1d04 0e73 414d 4163 ..user20...sAMAc
0x0210: 636f 756e 7454 7970 6531 0b04 0938 3035 countType1...805
0x0220: 3330 3633 3638 302b 0411 7573 6572 5072 3063680+..userPr
0x0230: 696e 6369 7061 6c4e 616d 6531 1604 1475 incipalName1...u
0x0240: 7365 7232 4061 642e 6578 616d 706c 652e ser2 at ad.example.
0x0250: 6e65 7430 5004 0e6f 626a 6563 7443 6174 net0P..objectCat
0x0260: 6567 6f72 7931 3e04 3c43 4e3d 5065 7273 egory1>.<CN=Pers
0x0270: 6f6e 2c43 4e3d 5363 6865 6d61 2c43 4e3d on,CN=Schema,CN
0x0280: 436f 6e66 6967 7572 6174 696f 6e2c 4443 Configuration,DC
0x0290: 3d61 642c 4443 3d65 7861 6d70 6c65 2c44 =ad,DC=example,D
0x02a0: 433d 6e65 7430 1904 0a6c 6f67 696e 5368 C=net0...loginSh
0x02b0: 656c 6c31 0b04 092f 6269 6e2f 6261 7368 ell1.../bin/bash
0x02c0: 3022 0411 756e 6978 486f 6d65 4469 7265 0"..unixHomeDire
0x02d0: 6374 6f72 7931 0d04 0b2f 686f 6d65 2f75 ctory1.../home/u
0x02e0: 7365 7232 3046 040b 6f62 6a65 6374 436c ser20F..objectCl
0x02f0: 6173 7331 3704 0374 6f70 040c 706f 7369 ass17..top..posi
0x0300: 7841 6363 6f75 6e74 0406 7065 7273 6f6e xAccount..person
0x0310: 0414 6f72 6761 6e69 7a61 7469 6f6e 616c ..organizational
0x0320: 5065 7273 6f6e 0404 7573 6572 301b 0412 Person..user0...
0x0330: 7573 6572 4163 636f 756e 7443 6f6e 7472 userAccountContr
0x0340: 6f6c 3105 0403 3531 3230 2204 0a70 7764 ol1...5120"..pwd
0x0350: 4c61 7374 5365 7431 1404 1231 3331 3234 LastSet1...13124
0x0360: 3139 3936 3137 3030 3030 3030 3030 1304 19961700000000..
0x0370: 0975 6964 4e75 6d62 6572 3106 0404 3230 .uidNumber1...20
0x0380: 3032 3039 0408 6d65 6d62 6572 4f66 312d 0209..memberOf1-
0x0390: 042b 434e 3d73 7564 6f5f 6164 2c43 4e3d .+CN=sudo_ad,CN
0x03a0: 5573 6572 732c 4443 3d61 642c 4443 3d65 Users,DC=ad,DC=e
0x03b0: 7861 6d70 6c65 2c44 433d 6e65 7430 1704 xample,DC=net0..
0x03c0: 0e70 7269 6d61 7279 4772 6f75 7049 4431 .primaryGroupID1
0x03d0: 0504 0335 3133 302a 0412 6c61 7374 4c6f ...5130*..lastLo
0x03e0: 676f 6e54 696d 6573 7461 6d70 3114 0412 gonTimestamp1...
0x03f0: 3133 3132 3432 3130 3432 3934 3639 3833 1312421042946983
0x0400: 3330 3022 040b 7768 656e 4368 616e 6765 300"..whenChange
0x0410: 6431 1304 1132 3031 3631 3132 3131 3433 d1...20161121143
0x0420: 3032 302e 305a 3014 040a 7553 4e43 6861 020.0Z0...uSNCha
0x0430: 6e67 6564 3106 0404 3338 3630 3021 0409 nged1...38600!..
0x0440: 6c61 7374 4c6f 676f 6e31 1404 1231 3331 lastLogon1...131
0x0450: 3234 3231 3235 3230 3939 3133 3936 3030 2421252099139600
0x0460: 4004 1164 6973 7469 6e67 7569 7368 6564 @..distinguished
0x0470: 4e61 6d65 312b 0429 434e 3d75 7365 7232 Name1+.)CN=user2
0x0480: 2c43 4e3d 5573 6572 732c 4443 3d61 642c ,CN=Users,DC=ad,
0x0490: 4443 3d65 7861 6d70 6c65 2c44 433d 6e65 DC=example,DC=ne
0x04a0: 7430 3102 0106 6507 0a01 0004 0004 00a0 t01...e.........
0x04b0: 2330 2104 1631 2e32 2e38 3430 2e31 3133 #0!..1.2.840.113
0x04c0: 3535 362e 312e 342e 3331 3904 0730 0502 556.1.4.319..0..
0x04d0: 0100 0400 ....
16:37:05.585669 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [S],
seq 784440821, win 29200, options [mss 1460,sackOK,TS val 5433988 ecr
0,nop,wscale 7], length 0
0x0000: 4500 003c 7771 4000 4006 d1b8 c0a8 3821 E..<wq at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9df5 0000 0000 ..8.............
0x0020: a002 7210 f1c0 0000 0204 05b4 0402 080a ..r.............
0x0030: 0052 ea84 0000 0000 0103 0307 .R..........
16:37:05.585723 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [S.],
seq 425846953, ack 784440822, win 28960, options [mss 1460,sackOK,TS val
5433988 ecr 5433988,nop,wscale 7], length 0
0x0000: 4500 003c 0000 4000 4006 492a c0a8 3820 E..<.. at .@.I*..8.
0x0010: c0a8 3821 0185 c110 1961 e8a9 2ec1 9df6 ..8!.....a......
0x0020: a012 7120 f1c0 0000 0204 05b4 0402 080a ..q.............
0x0030: 0052 ea84 0052 ea84 0103 0307 .R...R......
16:37:05.585745 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [.],
ack 1, win 229, options [nop,nop,TS val 5433988 ecr 5433988], length 0
0x0000: 4500 0034 7772 4000 4006 d1bf c0a8 3821 E..4wr at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9df6 1961 e8aa ..8..........a..
0x0020: 8010 00e5 f1b8 0000 0101 080a 0052 ea84 .............R..
0x0030: 0052 ea84 .R..
16:37:05.585802 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 1:53, ack 1, win 229, options [nop,nop,TS val 5433988 ecr 5433988],
length 52
0x0000: 4500 0068 7773 4000 4006 d18a c0a8 3821 E..hws at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9df6 1961 e8aa ..8..........a..
0x0020: 8018 00e5 f1ec 0000 0101 080a 0052 ea84 .............R..
0x0030: 0052 ea84 3032 0201 0163 2d04 000a 0100 .R..02...c-.....
0x0040: 0a01 0002 0100 0201 0f01 0100 870b 6f62 ..............ob
0x0050: 6a65 6374 636c 6173 7330 0d04 0b63 7572 jectclass0...cur
0x0060: 7265 6e74 5469 6d65 rentTime
16:37:05.585811 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [.],
ack 53, win 227, options [nop,nop,TS val 5433988 ecr 5433988], length 0
0x0000: 4500 0034 022e 4000 4006 4704 c0a8 3820 E..4.. at .@.G...8.
0x0010: c0a8 3821 0185 c110 1961 e8aa 2ec1 9e2a ..8!.....a.....*
0x0020: 8010 00e3 f1b8 0000 0101 080a 0052 ea84 .............R..
0x0030: 0052 ea84 .R..
16:37:05.596262 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 1731, win 260, options [nop,nop,TS val 5433991 ecr 5433981], length 0
0x0000: 4500 0034 abb3 4000 4006 9d7e c0a8 3821 E..4.. at .@..~..8!
0x0010: c0a8 3820 c10a 0185 4279 4de8 6f87 c6a9 ..8.....ByM.o...
0x0020: 8010 0104 f1b8 0000 0101 080a 0052 ea87 .............R..
0x0030: 0052 ea7d .R.}
16:37:05.600903 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 1:62, ack 53, win 227, options [nop,nop,TS val 5433992 ecr 5433988],
length 61
0x0000: 4500 0071 022f 4000 4006 46c6 c0a8 3820 E..q./@. at .F...8.
0x0010: c0a8 3821 0185 c110 1961 e8aa 2ec1 9e2a ..8!.....a.....*
0x0020: 8018 00e3 f1f5 0000 0101 080a 0052 ea88 .............R..
0x0030: 0052 ea84 302d 0201 0164 2804 0030 2430 .R..0-...d(..0$0
0x0040: 2204 0b63 7572 7265 6e74 5469 6d65 3113 "..currentTime1.
0x0050: 0411 3230 3136 3131 3231 3136 3337 3035 ..20161121163705
0x0060: 2e30 5a30 0c02 0101 6507 0a01 0004 0004 .0Z0....e.......
0x0070: 00 .
16:37:05.600963 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [.],
ack 62, win 229, options [nop,nop,TS val 5433992 ecr 5433992], length 0
0x0000: 4500 0034 7774 4000 4006 d1bd c0a8 3821 E..4wt at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9e2a 1961 e8e7 ..8........*.a..
0x0020: 8010 00e5 f1b8 0000 0101 080a 0052 ea88 .............R..
0x0030: 0052 ea88 .R..
16:37:05.601186 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 53:117, ack 62, win 229, options [nop,nop,TS val 5433992 ecr
5433992], length 64
0x0000: 4500 0074 7775 4000 4006 d17c c0a8 3821 E..twu at .@..|..8!
0x0010: c0a8 3820 c110 0185 2ec1 9e2a 1961 e8e7 ..8........*.a..
0x0020: 8018 00e5 f1f8 0000 0101 080a 0052 ea88 .............R..
0x0030: 0052 ea88 303e 0201 0263 3904 000a 0100 .R..0>...c9.....
0x0040: 0a01 0002 0100 0201 0f01 0100 870b 6f62 ..............ob
0x0050: 6a65 6374 636c 6173 7330 1904 1773 7570 jectclass0...sup
0x0060: 706f 7274 6564 5341 534c 4d65 6368 616e portedSASLMechan
0x0070: 6973 6d73 isms
16:37:05.602955 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 62:142, ack 117, win 227, options [nop,nop,TS val 5433992 ecr
5433992], length 80
0x0000: 4500 0084 0230 4000 4006 46b2 c0a8 3820 E....0 at .@.F...8.
0x0010: c0a8 3821 0185 c110 1961 e8e7 2ec1 9e6a ..8!.....a.....j
0x0020: 8018 00e3 f208 0000 0101 080a 0052 ea88 .............R..
0x0030: 0052 ea88 3040 0201 0264 3b04 0030 3730 .R..0 at ...d;..070
0x0040: 3504 1773 7570 706f 7274 6564 5341 534c 5..supportedSASL
0x0050: 4d65 6368 616e 6973 6d73 311a 040a 4753 Mechanisms1...GS
0x0060: 532d 5350 4e45 474f 0406 4753 5341 5049 S-SPNEGO..GSSAPI
0x0070: 0404 4e54 4c4d 300c 0201 0265 070a 0100 ..NTLM0....e....
0x0080: 0400 0400 ....
16:37:05.603255 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 117:143, ack 142, win 229, options [nop,nop,TS val 5433992 ecr
5433992], length 26
0x0000: 4500 004e 7776 4000 4006 d1a1 c0a8 3821 E..Nwv at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9e6a 1961 e937 ..8........j.a.7
0x0020: 8018 00e5 f1d2 0000 0101 080a 0052 ea88 .............R..
0x0030: 0052 ea88 3018 0201 0360 1302 0103 0400 .R..0....`......
0x0040: a30c 040a 4753 532d 5350 4e45 474f ....GSS-SPNEGO
16:37:05.604776 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 142:254, ack 143, win 227, options [nop,nop,TS val 5433993 ecr
5433992], length 112
0x0000: 4500 00a4 0231 4000 4006 4691 c0a8 3820 E....1 at .@.F...8.
0x0010: c0a8 3821 0185 c110 1961 e937 2ec1 9e84 ..8!.....a.7....
0x0020: 8018 00e3 f228 0000 0101 080a 0052 ea89 .....(.......R..
0x0030: 0052 ea88 306e 0201 0361 690a 010e 0400 .R..0n...ai.....
0x0040: 0400 8760 605e 0606 2b06 0105 0502 a054 ...``^..+......T
0x0050: 3052 a024 3022 0609 2a86 4882 f712 0102 0R.$0"..*.H.....
0x0060: 0206 092a 8648 86f7 1201 0202 060a 2b06 ...*.H........+.
0x0070: 0104 0182 3702 020a a32a 3028 a026 1b24 ....7....*0(.&.$
0x0080: 6e6f 745f 6465 6669 6e65 645f 696e 5f52 not_defined_in_R
0x0090: 4643 3431 3738 4070 6c65 6173 655f 6967 FC4178 at please_ig
0x00a0: 6e6f 7265 nore
16:37:05.611806 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 143:2745, ack 254, win 229, options [nop,nop,TS val 5433994 ecr
5433993], length 2602
0x0000: 4500 0a5e 7777 4000 4006 c790 c0a8 3821 E..^ww at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 9e84 1961 e9a7 ..8..........a..
0x0020: 8018 00e5 fbe2 0000 0101 080a 0052 ea8a .............R..
0x0030: 0052 ea89 3082 0a26 0201 0460 820a 1f02 .R..0..&...`....
0x0040: 0103 0400 a382 0a16 040a 4753 532d 5350 ..........GSS-SP
0x0050: 4e45 474f 0482 0a06 6082 0a02 0606 2b06 NEGO....`.....+.
0x0060: 0105 0502 a082 09f6 3082 09f2 a018 3016 ........0.....0.
0x0070: 0609 2a86 4882 f712 0102 0206 092a 8648 ..*.H........*.H
0x0080: 86f7 1201 0202 a282 09d4 0482 09d0 6082 ..............`.
0x0090: 09cc 0609 2a86 4886 f712 0102 0201 006e ....*.H........n
0x00a0: 8209 bb30 8209 b7a0 0302 0105 a103 0201 ...0............
0x00b0: 0ea2 0703 0500 2000 0000 a382 03a4 6182 ..............a.
0x00c0: 03a0 3082 039c a003 0201 05a1 101b 0e41 ..0............A
0x00d0: 442e 4558 414d 504c 452e 4e45 54a2 2630 D.EXAMPLE.NET.&0
0x00e0: 24a0 0302 0101 a11d 301b 1b04 6c64 6170 $.......0...ldap
0x00f0: 1b13 736d 6231 2e61 642e 6578 616d 706c ..smb1.ad.exampl
0x0100: 652e 6e65 74a3 8203 5930 8203 55a0 0302 e.net...Y0..U...
0x0110: 0112 a103 0201 01a2 8203 4704 8203 439e ..........G...C.
0x0120: 0b55 e5e1 592a 3d8b f714 1658 e779 413a .U..Y*=....X.yA:
0x0130: 27ba 0a5c ab3d 7410 97e0 bc81 6ee7 ebbc '..\.=t.....n...
0x0140: f79c 57bf d6f0 026b e51e 0fd8 0d7c 5479 ..W....k.....|Ty
0x0150: 2015 e53d a42e a080 09e4 c5a4 a470 c576 ...=.........p.v
0x0160: 27d3 2bdb 3301 31fc 66c0 098e cd9a 666f '.+.3.1.f.....fo
0x0170: 2d85 976e 57d1 010e 22e6 d4a6 ce2b 5371 -..nW..."....+Sq
0x0180: 0c41 f955 20af 683f 9abe 90bf ec73 ec72 .A.U..h?.....s.r
0x0190: 14b6 776a 5767 f3cb fff9 167e 2fa8 d9ac ..wjWg.....~/...
0x01a0: 0fbf d4d9 a017 bb2a f7d9 90da 63ee 6d22 .......*....c.m"
0x01b0: b184 98fa bed3 f32c 2d9e 527a 5aa8 1df6 .......,-.RzZ...
0x01c0: 260b bd11 2db1 5235 45cc e0b4 3504 d650 &...-.R5E...5..P
0x01d0: 544a e6eb 9e3d 49e5 42ea 9b68 c437 026d TJ...=I.B..h.7.m
0x01e0: ce84 8eba 45a0 c1fb 21b2 7f28 5b80 b429 ....E...!..([..)
0x01f0: 6870 978b 464e e606 6caa f4f3 a9ca 0b3d hp..FN..l......
0x0200: 5566 aea5 a874 491c f93d 7b15 c4b4 ce07 Uf...tI..={.....
0x0210: 6bdb 867c e954 761d 9965 7d05 26d9 2623 k..|.Tv..e}.&.&#
0x0220: 4128 7b34 cfe5 f565 006a 2be3 923d c95c A({4...e.j+..=.\
0x0230: d596 b608 88e8 b117 cbbc 66e8 d1b8 f835 ..........f....5
0x0240: 572a bb2b eb7b afba 1a6a b1ab 125e ccea W*.+.{...j...^..
0x0250: d632 5861 d893 c1c8 30c9 a737 33b3 c978 .2Xa....0..73..x
0x0260: 3592 ee3b 7a8d c1c4 29db 736f c0c2 5cf5 5..;z...).so..\.
0x0270: db6f 0ba0 7d9e b056 27b4 7a8a c7a2 8de8 .o..}..V'.z.....
0x0280: 1774 89b7 bd0e 7ab5 ba4d b52b 151f 7377 .t....z..M.+..sw
0x0290: 89ae 2dab 6009 2329 0796 448c ea6c 19cc ..-.`.#)..D..l..
0x02a0: bea0 aa09 f4d8 af1c 4441 060a 2eb6 440d ........DA....D.
0x02b0: 0a0e cf6b 005d 678c 14c0 6fbb 3429 19f6 ...k.]g...o.4)..
0x02c0: 7ad9 795b 3331 506f 898e ef6b 72e6 2526 z.y[31Po...kr.%&
0x02d0: 342b dbd0 15b2 f402 c291 c2e0 ad2e af23 4+.............#
0x02e0: 2378 42c2 6cb8 4076 8058 c381 bea5 69ab #xB.l. at v.X....i.
0x02f0: 99ac 1730 dcab 9904 d685 67f1 8f6a ff6f ...0......g..j.o
0x0300: 3f70 6132 16d5 251d abc4 a8e5 b178 d86e ?pa2..%......x.n
0x0310: cb0c a839 0c03 6638 70a6 b205 d357 9e18 ...9..f8p....W..
0x0320: cf51 470c 026b cd73 2d37 c602 3e9a 627c .QG..k.s-7..>.b|
0x0330: 251a d825 95a4 86a3 428a 371c bbb0 70f7 %..%....B.7...p.
0x0340: 07dc 4da5 83d2 0a90 92ca 1046 d2db e5d5 ..M........F....
0x0350: 6583 9379 789d 41d8 1734 5796 b4ea d97f e..yx.A..4W.....
0x0360: b564 bd31 5cd1 081a 676e bb5f e81d c0b6 .d.1\...gn._....
0x0370: c690 7ab2 6f6b 0a09 1cc1 1105 1580 8bb2 ..z.ok..........
0x0380: 122f cc6e 62a6 e876 462b a50a 9042 f411 ./.nb..vF+...B..
0x0390: 3f65 c114 f2c2 328a 9594 bb05 a057 9314 ?e....2......W..
0x03a0: 135b 0b07 53a1 9def 792c 71cb c9c2 6eff .[..S...y,q...n.
0x03b0: d6ee 1346 d7fd e254 448a 17ba 50d1 6354 ...F...TD...P.cT
0x03c0: 2709 2f38 34d7 8fdd 4ff4 bed5 bdda 8bc1 './84...O.......
0x03d0: dbbd 328f 107d 7a1b d4a8 d7cf 66f2 fee0 ..2..}z.....f...
0x03e0: 328b 0b6f 6606 bfe3 af0c 591f 6b69 269d 2..of.....Y.ki&.
0x03f0: 82ef 891a 8b85 cb38 b088 1eaf 880b 43be .......8......C.
0x0400: 53a5 5f7b 5fe4 790e 6a09 f27b df77 0117 S._{_.y.j..{.w..
0x0410: 53c7 0041 72f0 b80e a3ab 7569 b8eb 7292 S..Ar.....ui..r.
0x0420: ba83 6122 e237 b55e 1f7a 0f37 3462 1f40 ..a".7.^.z.74b.@
0x0430: 7629 fbfe b93c 9d19 aa81 257e 00ac 6631 v)...<....%~..f1
0x0440: 844b 5ccb a407 a08f 9675 6f17 f171 9ee0 .K\......uo..q..
0x0450: 35b3 6ce5 8ea4 6c2a dc5c 30c9 0221 bf05 5.l...l*.\0..!..
0x0460: 2165 a482 05f8 3082 05f4 a003 0201 12a2 !e....0.........
0x0470: 8205 eb04 8205 e7c9 a066 9488 2cf5 971a .........f..,...
0x0480: 44aa 0ad5 f99e a439 fc17 fa0f 32fd a641 D......9....2..A
0x0490: d85f 9d69 7e00 672b bf3f 0d62 eb06 2cca ._.i~.g+.?.b..,.
0x04a0: c100 54bb 0536 bd16 4862 ea33 e515 ed87 ..T..6..Hb.3....
0x04b0: c2c7 4c29 2662 1fb1 6b1d a064 64c5 c1a4 ..L)&b..k..dd...
0x04c0: f0d4 4ecc b00b 83de 0390 5951 dc78 a643 ..N.......YQ.x.C
0x04d0: 14a1 9c42 39f2 07a4 3827 2819 ab48 0191 ...B9...8'(..H..
0x04e0: 18c9 9625 cf1f a6e4 9520 6761 7088 f878 ...%......gap..x
0x04f0: 9169 0dfd b553 4b26 3074 ba6a 2e9b 93ef .i...SK&0t.j....
0x0500: e93a 84c0 0c9c 7aba bd2b 248a 96fc a765 .:....z..+$....e
0x0510: e2cb d7fa 8db7 ffb9 e69d 96fd 657d 0a4c ............e}.L
0x0520: 91d2 c872 71cb 9a6e 25f5 07dd dd4a bcb3 ...rq..n%....J..
0x0530: a953 b6b0 5d49 63f8 623d ff17 b977 95f7 .S..]Ic.b=...w..
0x0540: 1c51 3860 584c 9519 8d32 b9bb f6f0 666f .Q8`XL...2....fo
0x0550: f921 e2d7 ea6a d549 5ff0 f6b8 534b b04f .!...j.I_...SK.O
0x0560: 21b9 80e3 b268 d903 7b36 235a 9fc8 a369 !....h..{6#Z...i
0x0570: 7547 bb89 d0b6 89a6 37dc 65bd a184 9f2e uG......7.e.....
0x0580: c985 0d7f d307 9ab8 50bf 164f a487 10dd ........P..O....
0x0590: a354 7788 53d2 15eb f8b3 7fc4 9fd4 8ba6 .Tw.S...........
0x05a0: 37c9 832d 447a 4a71 3ce2 ddd1 e754 0982 7..-DzJq<....T..
0x05b0: e12d 01b6 ebdd 6e36 d250 9619 0af2 63cf .-....n6.P....c.
0x05c0: 700c 73ef dfd6 fe06 94c4 cef7 553d b175 p.s.........U=.u
0x05d0: 4936 7681 ffc6 13b2 1756 ba48 f8c3 3ade I6v......V.H..:.
0x05e0: 306a aee9 eeb6 acd7 8d94 0504 788b 3c7c 0j..........x.<|
0x05f0: 1dc0 4466 db5a 2cde aa4b 0b27 0d7c 2bd0 ..Df.Z,..K.'.|+.
0x0600: 240f 7b76 4fce 3c17 8e8a 6118 f468 d9bc $.{vO.<...a..h..
0x0610: 8cc8 9940 af25 15ec 3542 01f0 793e 18a6 ... at .%..5B..y>..
0x0620: f7c2 0668 9d2f 2b53 b8d2 5922 09d9 decc ...h./+S..Y"....
0x0630: 5caa 676d daa5 ee87 74fa 6db1 fa99 0e5f \.gm....t.m...._
0x0640: f0c6 c1fa 5afd 9cd6 22cb 7b14 a9f3 f4c2 ....Z...".{.....
0x0650: 6417 a0da 0932 4090 96ad 037e 08dc 0af7 d....2 at ....~....
0x0660: 5c43 f09b b347 556d ad85 35c1 07b9 55a6 \C...GUm..5...U.
0x0670: b55f 20ae b2b7 3a8a 6afc 89e3 5516 35c9 ._....:.j...U.5.
0x0680: 9303 7389 f539 0776 ee6f 4eb2 d1df aad8 ..s..9.v.oN.....
0x0690: 35bc 5b18 cbfd be8a 78b6 a559 f6ea 7455 5.[.....x..Y..tU
0x06a0: 332f cb63 f205 30fa a6c4 3226 59da 557e 3/.c..0...2&Y.U~
0x06b0: df7c 5441 3890 8164 a7a5 aee0 3213 e439 .|TA8..d....2..9
0x06c0: c00f 723c 2118 c27c 9570 9a4b 824f 1a58 ..r<!..|.p.K.O.X
0x06d0: 3f14 7159 ccb3 d89a 1aee db5b 3fd2 f68a ?.qY.......[?...
0x06e0: 2b79 82a9 4bec b5fc 1bb3 0167 b97e a0e8 +y..K......g.~..
0x06f0: d2b3 4b6d f34d c597 b182 627a dc83 3fdd ..Km.M....bz..?.
0x0700: 4ff7 7d71 1a00 352b d8b0 a634 26e0 41e4 O.}q..5+...4&.A.
0x0710: 5f6a 3c50 278e 38fe abe2 e633 39c2 9b20 _j<P'.8....39...
0x0720: d068 3306 33ab 0a98 524c 9d6b 28ab 0ea0 .h3.3...RL.k(...
0x0730: d010 ff03 4284 bf49 4569 21ea 6b55 f3d1 ....B..IEi!.kU..
0x0740: a273 f580 9128 5448 5138 e2a0 cd17 f9a8 .s...(THQ8......
0x0750: 25b2 c309 c009 cd6f 60fa c669 9acf f6a9 %......o`..i....
0x0760: ceba 2362 bf9a c6fd 4583 8cb3 bacb aa23 ..#b....E......#
0x0770: 380a d166 7053 5cbb a7da ebe7 6093 26c9 8..fpS\.....`.&.
0x0780: 973c 449a 8410 3897 1d09 6f49 7e48 dfea .<D...8...oI~H..
0x0790: f246 db9e c105 51ae e49b 8931 9552 5c69 .F....Q....1.R\i
0x07a0: 5c58 a766 031b 1c78 b41e 88d8 a9ca ca14 \X.f...x........
0x07b0: 799d 05f0 bcbe 1cdb f612 6c93 72f6 a087 y.........l.r...
0x07c0: bf95 c6e3 2987 b285 6936 eea4 9623 cbb9 ....)...i6...#..
0x07d0: 2730 e006 a420 debe 2ef4 db6e e8c9 c603 '0.........n....
0x07e0: 179e de92 0b0c e85c 19bf 0b6d 5cad 2330 .......\...m\.#0
0x07f0: 6543 2810 5a71 715d 8cd5 224c e731 ad1e eC(.Zqq].."L.1..
0x0800: 29fc fcc5 0209 fa0f d9d8 0a57 24be 99ea )..........W$...
0x0810: fca1 f93c f76c c5b5 0908 d65d 922b 1404 ...<.l.....].+..
0x0820: 182d 70b9 747e 08ea 95a0 57ed 1d48 4690 .-p.t~....W..HF.
0x0830: a203 7f36 fc71 4f03 08f5 9428 695b 4dd0 ...6.qO....(i[M.
0x0840: e90a 634b 9eba 2687 3323 8220 ab85 3f4c ..cK..&.3#....?L
0x0850: 67b9 5024 3ec7 7606 6c4e 80b3 ae4a 2657 g.P$>.v.lN...J&W
0x0860: 53b4 d9ea 49dd 023d 0a6e c32e 64f1 e5c5 S...I..=.n..d...
0x0870: 8e09 aeb6 b3f9 7b08 32dc 70aa eafc e546 ......{.2.p....F
0x0880: 9d4f 9a63 3122 3803 d15b 07db 1221 da30 .O.c1"8..[...!.0
0x0890: 0974 cd79 19fe 946e de67 2024 6173 7d36 .t.y...n.g.$as}6
0x08a0: f0af ed38 2162 7124 2cf2 7f61 0afb d165 ...8!bq$,..a...e
0x08b0: 0fcf c3ca 1aa8 a48c 0d34 1a92 6ee6 aaa1 .........4..n...
0x08c0: 7ed3 4a60 0272 5a38 c45f c77e 45b3 cfd3 ~.J`.rZ8._.~E...
0x08d0: cf9b 42e8 0f51 485b 9dcc 7754 bae5 f3ef ..B..QH[..wT....
0x08e0: 8ee9 2f84 1ff5 3533 aea8 3ef1 2d52 ad18 ../...53..>.-R..
0x08f0: a564 375b 0440 4030 7266 addf b6b4 bd1a .d7[.@@0rf......
0x0900: 874d 58dc a0f6 c670 bd02 0a51 0a39 6ba0 .MX....p...Q.9k.
0x0910: 9ccc e591 2542 4e34 40f4 4042 f9db b4ad ....%BN4 at .@B....
0x0920: 048e 0b61 1759 c6a0 9498 9c65 cb05 093e ...a.Y.....e...>
0x0930: bc3d 4dc0 af61 5d5b 870f ccd3 069f aacc .=M..a][........
0x0940: 092a 92f8 8c0c 3239 0135 2260 c8aa a1b4 .*....29.5"`....
0x0950: cf20 522d 89e3 28ae 45fc 1f37 e90a dae6 ..R-..(.E..7....
0x0960: 09d4 65e1 3a9d 6c0c a26b c0bd 429f 55c6 ..e.:.l..k..B.U.
0x0970: 0eef b0e1 3a04 49d4 3441 de66 0c39 b226 ....:.I.4A.f.9.&
0x0980: 1064 c072 f234 f393 e1b2 deae 7163 3fb7 .d.r.4......qc?.
0x0990: fdc3 811b e090 9392 fe8e a312 e042 7e52 .............B~R
0x09a0: d331 3e7d e15d 42fe 5a7a a5a4 e28c 6c5b .1>}.]B.Zz....l[
0x09b0: 9e14 d9d2 f7e8 e063 d5e1 832b fc3d f0f3 .......c...+.=..
0x09c0: d94a 750c c650 312e f124 07cd 52f4 0383 .Ju..P1..$..R...
0x09d0: 66c8 ed59 31b3 4bea 4088 fb32 9edb c8df f..Y1.K. at ..2....
0x09e0: 5abf 5d79 a693 4f3f fdca fba5 78c8 f462 Z.]y..O?....x..b
0x09f0: e221 527f 3604 802f 6203 ab43 230e 6a60 .!R.6../b..C#.j`
0x0a00: c6c2 0367 cb24 52ae 668a e365 cadf 01d7 ...g.$R.f..e....
0x0a10: 9855 da99 d9d7 bc20 250b abfc 64c1 54ff .U......%...d.T.
0x0a20: 24b8 6db4 5a4f 0a6a 63e8 8862 c158 0bcd $.m.ZO.jc..b.X..
0x0a30: 7f0c 47a1 2b1b 7347 9cad 26e1 8865 7e09 ..G.+.sG..&..e~.
0x0a40: 988f 0e09 b720 ea75 e3ca b32d 1c8d 790c .......u...-..y.
0x0a50: ae14 5594 2909 a6a5 22d7 db30 b174 ..U.)..."..0.t
16:37:05.611857 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [.],
ack 2745, win 267, options [nop,nop,TS val 5433994 ecr 5433994], length 0
0x0000: 4500 0034 0232 4000 4006 4700 c0a8 3820 E..4.2 at .@.G...8.
0x0010: c0a8 3821 0185 c110 1961 e9a7 2ec1 a8ae ..8!.....a......
0x0020: 8010 010b f1b8 0000 0101 080a 0052 ea8a .............R..
0x0030: 0052 ea8a .R..
16:37:05.618662 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 254:459, ack 2745, win 267, options [nop,nop,TS val 5433996 ecr
5433994], length 205
0x0000: 4500 0101 0233 4000 4006 4632 c0a8 3820 E....3 at .@.F2..8.
0x0010: c0a8 3821 0185 c110 1961 e9a7 2ec1 a8ae ..8!.....a......
0x0020: 8018 010b f285 0000 0101 080a 0052 ea8c .............R..
0x0030: 0052 ea8a 3081 ca02 0104 6181 c40a 0100 .R..0.....a.....
0x0040: 0400 0400 8781 baa1 81b7 3081 b4a0 030a ..........0.....
0x0050: 0100 a10b 0609 2a86 4882 f712 0102 02a2 ......*.H.......
0x0060: 819f 0481 9c60 8199 0609 2a86 4886 f712 .....`....*.H...
0x0070: 0102 0202 006f 8189 3081 86a0 0302 0105 .....o..0.......
0x0080: a103 0201 0fa2 7a30 78a0 0302 0112 a271 ......z0x......q
0x0090: 046f 3f16 b99e 4b57 e8d4 dc93 f4c6 0bda .o?...KW........
0x00a0: d2cf 3234 7f89 e27a ddfb da81 0fe8 23ff ..24...z......#.
0x00b0: b8ce 7cf5 d28b 61db 2438 5d13 0e31 5a8d ..|...a.$8]..1Z.
0x00c0: f500 14bb 5a50 9bc0 7916 16fb a1bb 1c15 ....ZP..y.......
0x00d0: 2eda d039 2757 e5e8 2de7 0eff 8481 457f ...9'W..-.....E.
0x00e0: 6194 bb44 f144 8f94 c691 e6d8 7666 f9e3 a..D.D......vf..
0x00f0: 4097 586c ca63 aa8c fa12 63a6 516f 592f @.Xl.c....c.QoY/
0x0100: 19 .
16:37:05.619766 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 2745:2837, ack 459, win 237, options [nop,nop,TS val 5433996 ecr
5433996], length 92
0x0000: 4500 0090 7779 4000 4006 d15c c0a8 3821 E...wy at .@..\..8!
0x0010: c0a8 3820 c110 0185 2ec1 a8ae 1961 ea74 ..8..........a.t
0x0020: 8018 00ed f214 0000 0101 080a 0052 ea8c .............R..
0x0030: 0052 ea8c 0000 0058 0504 04ff 000c 000c .R.....X........
0x0040: 0000 0000 2b60 066b c703 39e8 8855 450d ....+`.k..9..UE.
0x0050: d23c 07f5 303a 0201 0563 3504 000a 0100 .<..0:...c5.....
0x0060: 0a01 0002 0100 0201 0f01 0100 870b 6f62 ..............ob
0x0070: 6a65 6374 636c 6173 7330 1504 1373 6368 jectclass0...sch
0x0080: 656d 614e 616d 696e 6743 6f6e 7465 7874 emaNamingContext
16:37:05.621212 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 459:593, ack 2837, win 267, options [nop,nop,TS val 5433997 ecr
5433996], length 134
0x0000: 4500 00ba 0234 4000 4006 4678 c0a8 3820 E....4 at .@.Fx..8.
0x0010: c0a8 3821 0185 c110 1961 ea74 2ec1 a90a ..8!.....a.t....
0x0020: 8018 010b f23e 0000 0101 080a 0052 ea8d .....>.......R..
0x0030: 0052 ea8c 0000 0082 0504 05ff 000c 000c .R..............
0x0040: 0000 0000 1876 ced1 881a c3c7 001c 7937 .....v........y7
0x0050: 1254 4924 3056 0201 0564 5104 0030 4d30 .TI$0V...dQ..0M0
0x0060: 4b04 1373 6368 656d 614e 616d 696e 6743 K..schemaNamingC
0x0070: 6f6e 7465 7874 3134 0432 434e 3d53 6368 ontext14.2CN=Sch
0x0080: 656d 612c 434e 3d43 6f6e 6669 6775 7261 ema,CN=Configura
0x0090: 7469 6f6e 2c44 433d 6164 2c44 433d 6578 tion,DC=ad,DC=ex
0x00a0: 616d 706c 652c 4443 3d6e 6574 300c 0201 ample,DC=net0...
0x00b0: 0565 070a 0100 0400 0400 .e........
16:37:05.623860 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 2837:3254, ack 593, win 245, options [nop,nop,TS val 5433997 ecr
5433997], length 417
0x0000: 4500 01d5 777a 4000 4006 d016 c0a8 3821 E...wz at .@.....8!
0x0010: c0a8 3820 c110 0185 2ec1 a90a 1961 eafa ..8..........a..
0x0020: 8018 00f5 f359 0000 0101 080a 0052 ea8d .....Y.......R..
0x0030: 0052 ea8d 0000 019d 0504 04ff 000c 000c .R..............
0x0040: 0000 0000 2b60 066c a93a 7348 2c91 97e1 ....+`.l.:sH,...
0x0050: 253b 9e09 3082 017d 0201 0663 8201 3004 %;..0..}...c..0.
0x0060: 3243 4e3d 5363 6865 6d61 2c43 4e3d 436f 2CN=Schema,CN=Co
0x0070: 6e66 6967 7572 6174 696f 6e2c 4443 3d61 nfiguration,DC=a
0x0080: 642c 4443 3d65 7861 6d70 6c65 2c44 433d d,DC=example,DC
0x0090: 6e65 740a 0102 0a01 0002 0100 0201 0f01 net.............
0x00a0: 0100 a181 caa3 1e04 0b61 7474 7269 6275 .........attribu
0x00b0: 7465 4964 040f 312e 332e 362e 312e 312e teId..1.3.6.1.1.
0x00c0: 312e 312e 30a3 1e04 0b61 7474 7269 6275 1.1.0....attribu
0x00d0: 7465 4964 040f 312e 332e 362e 312e 312e teId..1.3.6.1.1.
0x00e0: 312e 312e 31a3 1e04 0b61 7474 7269 6275 1.1.1....attribu
0x00f0: 7465 4964 040f 312e 332e 362e 312e 312e teId..1.3.6.1.1.
0x0100: 312e 312e 33a3 1e04 0b61 7474 7269 6275 1.1.3....attribu
0x0110: 7465 4964 040f 312e 332e 362e 312e 312e teId..1.3.6.1.1.
0x0120: 312e 312e 34a3 1e04 0b61 7474 7269 6275 1.1.4....attribu
0x0130: 7465 4964 040f 312e 332e 362e 312e 312e teId..1.3.6.1.1.
0x0140: 312e 312e 32a3 2804 0b61 7474 7269 6275 1.1.2.(..attribu
0x0150: 7465 4964 0419 302e 392e 3233 3432 2e31 teId..0.9.2342.1
0x0160: 3932 3030 3330 302e 3130 302e 312e 3130 9200300.100.1.10
0x0170: 1e04 0f6c 4441 5044 6973 706c 6179 4e61 ...lDAPDisplayNa
0x0180: 6d65 040b 6174 7472 6962 7574 6549 64a0 me..attributeId.
0x0190: 4430 1b04 1731 2e32 2e38 3430 2e31 3133 D0...1.2.840.113
0x01a0: 3535 362e 312e 342e 3133 3339 0400 3025 556.1.4.1339..0%
0x01b0: 0416 312e 322e 3834 302e 3131 3335 3536 ..1.2.840.113556
0x01c0: 2e31 2e34 2e33 3139 0101 ff04 0830 0602 .1.4.319.....0..
0x01d0: 0203 e804 00 .....
16:37:05.664635 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [.],
ack 3254, win 290, options [nop,nop,TS val 5434008 ecr 5433997], length 0
0x0000: 4500 0034 0235 4000 4006 46fd c0a8 3820 E..4.5 at .@.F...8.
0x0010: c0a8 3821 0185 c110 1961 eafa 2ec1 aaab ..8!.....a......
0x0020: 8010 0122 f1b8 0000 0101 080a 0052 ea98 ...".........R..
0x0030: 0052 ea8d .R..
16:37:05.711464 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 593:1535, ack 3254, win 290, options [nop,nop,TS val 5434019 ecr
5433997], length 942
0x0000: 4500 03e2 0236 4000 4006 434e c0a8 3820 E....6 at .@.CN..8.
0x0010: c0a8 3821 0185 c110 1961 eafa 2ec1 aaab ..8!.....a......
0x0020: 8018 0122 f566 0000 0101 080a 0052 eaa3 ...".f.......R..
0x0030: 0052 ea8d 0000 03aa 0504 05ff 000c 000c .R..............
0x0040: 0000 0000 1876 ced2 16ec 45d3 5a6c 46ca .....v....E.ZlF.
0x0050: ea6f 1589 3081 8b02 0106 6481 8504 3f43 .o..0.....d...?C
0x0060: 4e3d 5569 644e 756d 6265 722c 434e 3d53 N=UidNumber,CN=S
0x0070: 6368 656d 612c 434e 3d43 6f6e 6669 6775 chema,CN=Configu
0x0080: 7261 7469 6f6e 2c44 433d 6164 2c44 433d ration,DC=ad,DC
0x0090: 6578 616d 706c 652c 4443 3d6e 6574 3042 example,DC=net0B
0x00a0: 3020 040b 6174 7472 6962 7574 6549 4431 0...attributeID1
0x00b0: 1104 0f31 2e33 2e36 2e31 2e31 2e31 2e31 ...1.3.6.1.1.1.1
0x00c0: 2e30 301e 040f 6c44 4150 4469 7370 6c61 .00...lDAPDispla
0x00d0: 794e 616d 6531 0b04 0975 6964 4e75 6d62 yName1...uidNumb
0x00e0: 6572 3081 8b02 0106 6481 8504 3f43 4e3d er0.....d...?CN
0x00f0: 4769 644e 756d 6265 722c 434e 3d53 6368 GidNumber,CN=Sch
0x0100: 656d 612c 434e 3d43 6f6e 6669 6775 7261 ema,CN=Configura
0x0110: 7469 6f6e 2c44 433d 6164 2c44 433d 6578 tion,DC=ad,DC=ex
0x0120: 616d 706c 652c 4443 3d6e 6574 3042 3020 ample,DC=net0B0.
0x0130: 040b 6174 7472 6962 7574 6549 4431 1104 ..attributeID1..
0x0140: 0f31 2e33 2e36 2e31 2e31 2e31 2e31 2e31 .1.3.6.1.1.1.1.1
0x0150: 301e 040f 6c44 4150 4469 7370 6c61 794e 0...lDAPDisplayN
0x0160: 616d 6531 0b04 0967 6964 4e75 6d62 6572 ame1...gidNumber
0x0170: 3081 8d02 0106 6481 8704 4043 4e3d 4c6f 0.....d... at CN=Lo
0x0180: 6769 6e53 6865 6c6c 2c43 4e3d 5363 6865 ginShell,CN=Sche
0x0190: 6d61 2c43 4e3d 436f 6e66 6967 7572 6174 ma,CN=Configurat
0x01a0: 696f 6e2c 4443 3d61 642c 4443 3d65 7861 ion,DC=ad,DC=exa
0x01b0: 6d70 6c65 2c44 433d 6e65 7430 4330 2004 mple,DC=net0C0..
0x01c0: 0b61 7474 7269 6275 7465 4944 3111 040f .attributeID1...
0x01d0: 312e 332e 362e 312e 312e 312e 312e 3430 1.3.6.1.1.1.1.40
0x01e0: 1f04 0f6c 4441 5044 6973 706c 6179 4e61 ...lDAPDisplayNa
0x01f0: 6d65 310c 040a 6c6f 6769 6e53 6865 6c6c me1...loginShell
0x0200: 3081 9b02 0106 6481 9504 4743 4e3d 556e 0.....d...GCN=Un
0x0210: 6978 486f 6d65 4469 7265 6374 6f72 792c ixHomeDirectory,
0x0220: 434e 3d53 6368 656d 612c 434e 3d43 6f6e CN=Schema,CN=Con
0x0230: 6669 6775 7261 7469 6f6e 2c44 433d 6164 figuration,DC=ad
0x0240: 2c44 433d 6578 616d 706c 652c 4443 3d6e ,DC=example,DC=n
0x0250: 6574 304a 3020 040b 6174 7472 6962 7574 et0J0...attribut
0x0260: 6549 4431 1104 0f31 2e33 2e36 2e31 2e31 eID1...1.3.6.1.1
0x0270: 2e31 2e31 2e33 3026 040f 6c44 4150 4469 .1.1.30&..lDAPDi
0x0280: 7370 6c61 794e 616d 6531 1304 1175 6e69 splayName1...uni
0x0290: 7848 6f6d 6544 6972 6563 746f 7279 3081 xHomeDirectory0.
0x02a0: 8902 0106 6481 8304 3943 4e3d 7569 642c ....d...9CN=uid,
0x02b0: 434e 3d53 6368 656d 612c 434e 3d43 6f6e CN=Schema,CN=Con
0x02c0: 6669 6775 7261 7469 6f6e 2c44 433d 6164 figuration,DC=ad
0x02d0: 2c44 433d 6578 616d 706c 652c 4443 3d6e ,DC=example,DC=n
0x02e0: 6574 3046 302a 040b 6174 7472 6962 7574 et0F0*..attribut
0x02f0: 6549 4431 1b04 1930 2e39 2e32 3334 322e eID1...0.9.2342.
0x0300: 3139 3230 3033 3030 2e31 3030 2e31 2e31 19200300.100.1.1
0x0310: 3018 040f 6c44 4150 4469 7370 6c61 794e 0...lDAPDisplayN
0x0320: 616d 6531 0504 0375 6964 3081 8202 0106 ame1...uid0.....
0x0330: 647d 043b 434e 3d47 6563 6f73 2c43 4e3d d}.;CN=Gecos,CN
0x0340: 5363 6865 6d61 2c43 4e3d 436f 6e66 6967 Schema,CN=Config
0x0350: 7572 6174 696f 6e2c 4443 3d61 642c 4443 uration,DC=ad,DC
0x0360: 3d65 7861 6d70 6c65 2c44 433d 6e65 7430 =example,DC=net0
0x0370: 3e30 2004 0b61 7474 7269 6275 7465 4944 >0...attributeID
0x0380: 3111 040f 312e 332e 362e 312e 312e 312e 1...1.3.6.1.1.1.
0x0390: 312e 3230 1a04 0f6c 4441 5044 6973 706c 1.20...lDAPDispl
0x03a0: 6179 4e61 6d65 3107 0405 6765 636f 7330 ayName1...gecos0
0x03b0: 3102 0106 6507 0a01 0004 0004 00a0 2330 1...e.........#0
0x03c0: 2104 1631 2e32 2e38 3430 2e31 3133 3535 !..1.2.840.11355
0x03d0: 362e 312e 342e 3331 3904 0730 0502 0100 6.1.4.319..0....
0x03e0: 0400 ..
16:37:05.712262 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [P.],
seq 3254:3499, ack 1535, win 260, options [nop,nop,TS val 5434019 ecr
5434019], length 245
0x0000: 4500 0129 777b 4000 4006 d0c1 c0a8 3821 E..)w{@. at .....8!
0x0010: c0a8 3820 c110 0185 2ec1 aaab 1961 eea8 ..8..........a..
0x0020: 8018 0104 f2ad 0000 0101 080a 0052 eaa3 .............R..
0x0030: 0052 eaa3 0000 00f1 0504 04ff 000c 000c .R..............
0x0040: 0000 0000 2b60 066d ffff 7652 14c3 f878 ....+`.m..vR...x
0x0050: 01f0 4447 3081 d202 0107 6381 8604 1764 ..DG0.....c....d
0x0060: 633d 4144 2c64 633d 4558 414d 504c 452c c=AD,dc=EXAMPLE,
0x0070: 6463 3d4e 4554 0a01 020a 0100 0201 0002 dc=NET..........
0x0080: 010f 0101 00a3 2904 096f 626a 6563 7453 ......)..objectS
0x0090: 6964 041c 0105 0000 0000 0005 1500 0000 id..............
0x00a0: c816 e03b 4e0e eba9 3755 a787 5204 0000 ...;N...7U..R...
0x00b0: 3031 0411 756e 6978 486f 6d65 4469 7265 01..unixHomeDire
0x00c0: 6374 6f72 7904 0a6c 6f67 696e 5368 656c ctory..loginShel
0x00d0: 6c04 0567 6563 6f73 0409 6769 644e 756d l..gecos..gidNum
0x00e0: 6265 72a0 4430 1b04 1731 2e32 2e38 3430 ber.D0...1.2.840
0x00f0: 2e31 3133 3535 362e 312e 342e 3133 3339 .113556.1.4.1339
0x0100: 0400 3025 0416 312e 322e 3834 302e 3131 ..0%..1.2.840.11
0x0110: 3335 3536 2e31 2e34 2e33 3139 0101 ff04 3556.1.4.319....
0x0120: 0830 0602 0203 e804 00 .0.......
16:37:05.712279 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [.],
ack 3499, win 313, options [nop,nop,TS val 5434019 ecr 5434019], length 0
0x0000: 4500 0034 0237 4000 4006 46fb c0a8 3820 E..4.7 at .@.F...8.
0x0010: c0a8 3821 0185 c110 1961 eea8 2ec1 aba0 ..8!.....a......
0x0020: 8010 0139 f1b8 0000 0101 080a 0052 eaa3 ...9.........R..
0x0030: 0052 eaa3 .R..
16:37:05.714588 IP 192.168.56.32.389 > 192.168.56.33.49424: Flags [P.],
seq 1535:1733, ack 3499, win 313, options [nop,nop,TS val 5434020 ecr
5434019], length 198
0x0000: 4500 00fa 0238 4000 4006 4634 c0a8 3820 E....8 at .@.F4..8.
0x0010: c0a8 3821 0185 c110 1961 eea8 2ec1 aba0 ..8!.....a......
0x0020: 8018 0139 f27e 0000 0101 080a 0052 eaa4 ...9.~.......R..
0x0030: 0052 eaa3 0000 00c2 0504 05ff 000c 000c .R..............
0x0040: 0000 0000 1876 ced3 8e8c 624a ea90 8e8c .....v....bJ....
0x0050: 8b98 e8da 3071 0201 0764 6c04 2943 4e3d ....0q...dl.)CN
0x0060: 7573 6572 322c 434e 3d55 7365 7273 2c44 user2,CN=Users,D
0x0070: 433d 6164 2c44 433d 6578 616d 706c 652c C=ad,DC=example,
0x0080: 4443 3d6e 6574 303f 3019 040a 6c6f 6769 DC=net0?0...logi
0x0090: 6e53 6865 6c6c 310b 0409 2f62 696e 2f62 nShell1.../bin/b
0x00a0: 6173 6830 2204 1175 6e69 7848 6f6d 6544 ash0"..unixHomeD
0x00b0: 6972 6563 746f 7279 310d 040b 2f68 6f6d irectory1.../hom
0x00c0: 652f 7573 6572 3230 3102 0107 6507 0a01 e/user201...e...
0x00d0: 0004 0004 00a0 2330 2104 1631 2e32 2e38 ......#0!..1.2.8
0x00e0: 3430 2e31 3133 3535 362e 312e 342e 3331 40.113556.1.4.31
0x00f0: 3904 0730 0502 0100 0400 9..0......
16:37:05.731813 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [P.],
seq 3106:3339, ack 1731, win 260, options [nop,nop,TS val 5434024 ecr
5433981], length 233
0x0000: 4500 011d abb4 4000 4006 9c94 c0a8 3821 E..... at .@.....8!
0x0010: c0a8 3820 c10a 0185 4279 4de8 6f87 c6a9 ..8.....ByM.o...
0x0020: 8018 0104 f2a1 0000 0101 080a 0052 eaa8 .............R..
0x0030: 0052 ea7d 0000 00e5 0504 04ff 000c 000c .R.}............
0x0040: 0000 0000 12bf 074d 94b4 cebc aa16 e16b .......M.......k
0x0050: dff1 ef34 3081 c602 0107 637b 043e 3c53 ...40.....c{.><S
0x0060: 4944 3d30 3130 3530 3030 3030 3030 3030 ID=0105000000000
0x0070: 3030 3531 3530 3030 3030 3043 3831 3645 00515000000C816E
0x0080: 3033 4234 4530 4545 4241 3933 3735 3541 03B4E0EEBA93755A
0x0090: 3738 3735 3230 3430 3030 303e 0a01 000a 78752040000>....
0x00a0: 0100 0201 0002 010f 0101 0087 0b6f 626a .............obj
0x00b0: 6563 7463 6c61 7373 301d 040b 746f 6b65 ectclass0...toke
0x00c0: 6e47 726f 7570 7304 0e70 7269 6d61 7279 nGroups..primary
0x00d0: 4772 6f75 7049 44a0 4430 1b04 1731 2e32 GroupID.D0...1.2
0x00e0: 2e38 3430 2e31 3133 3535 362e 312e 342e .840.113556.1.4.
0x00f0: 3133 3339 0400 3025 0416 312e 322e 3834 1339..0%..1.2.84
0x0100: 302e 3131 3335 3536 2e31 2e34 2e33 3139 0.113556.1.4.319
0x0110: 0101 ff04 0830 0602 0203 e804 00 .....0.......
16:37:05.740651 IP 192.168.56.32.389 > 192.168.56.33.49418: Flags [P.],
seq 1731:1988, ack 3339, win 335, options [nop,nop,TS val 5434027 ecr
5434024], length 257
0x0000: 4500 0135 558d 4000 4006 f2a3 c0a8 3820 E..5U. at .@.....8.
0x0010: c0a8 3821 0185 c10a 6f87 c6a9 4279 4ed1 ..8!....o...ByN.
0x0020: 8018 014f f2b9 0000 0101 080a 0052 eaab ...O.........R..
0x0030: 0052 eaa8 0000 00fd 0504 05ff 000c 000c .R..............
0x0040: 0000 0000 2362 f4ca 7a2b ff79 9e86 a69e ....#b..z+.y....
0x0050: 9d9f 9c65 3081 ab02 0107 6481 a504 2943 ...e0.....d...)C
0x0060: 4e3d 7573 6572 322c 434e 3d55 7365 7273 N=user2,CN=Users
0x0070: 2c44 433d 6164 2c44 433d 6578 616d 706c ,DC=ad,DC=exampl
0x0080: 652c 4443 3d6e 6574 3078 3017 040e 7072 e,DC=net0x0...pr
0x0090: 696d 6172 7947 726f 7570 4944 3105 0403 imaryGroupID1...
0x00a0: 3531 3330 5d04 0b74 6f6b 656e 4772 6f75 5130]..tokenGrou
0x00b0: 7073 314e 041c 0105 0000 0000 0005 1500 ps1N............
0x00c0: 0000 c816 e03b 4e0e eba9 3755 a787 5504 .....;N...7U..U.
0x00d0: 0000 041c 0105 0000 0000 0005 1500 0000 ................
0x00e0: c816 e03b 4e0e eba9 3755 a787 0102 0000 ...;N...7U......
0x00f0: 0410 0102 0000 0000 0005 2000 0000 2102 ..............!.
0x0100: 0000 3031 0201 0765 070a 0100 0400 0400 ..01...e........
0x0110: a023 3021 0416 312e 322e 3834 302e 3131 .#0!..1.2.840.11
0x0120: 3335 3536 2e31 2e34 2e33 3139 0407 3005 3556.1.4.319..0.
0x0130: 0201 0004 00 .....
16:37:05.740701 IP 192.168.56.33.49418 > 192.168.56.32.389: Flags [.],
ack 1988, win 278, options [nop,nop,TS val 5434027 ecr 5434027], length 0
0x0000: 4500 0034 abb5 4000 4006 9d7c c0a8 3821 E..4.. at .@..|..8!
0x0010: c0a8 3820 c10a 0185 4279 4ed1 6f87 c7aa ..8.....ByN.o...
0x0020: 8010 0116 f1b8 0000 0101 080a 0052 eaab .............R..
0x0030: 0052 eaab .R..
16:37:05.757733 IP 192.168.56.33.49424 > 192.168.56.32.389: Flags [.],
ack 1733, win 275, options [nop,nop,TS val 5434031 ecr 5434020], length 0
0x0000: 4500 0034 777c 4000 4006 d1b5 c0a8 3821 E..4w|@. at .....8!
0x0010: c0a8 3820 c110 0185 2ec1 aba0 1961 ef6e ..8..........a.n
0x0020: 8010 0113 f1b8 0000 0101 080a 0052 eaaf .............R..
0x0030: 0052 eaa4 .R..
(***)
17:18:50.417288 IP 192.168.56.33.53237 > 192.168.56.32.88: v5
0x0000: 4500 00e0 a65e 4000 4011 a21c c0a8 3821 E....^@. at .....8!
0x0010: c0a8 3820 cff5 0058 00cc f26f 6a81 c130 ..8....X...oj..0
0x0020: 81be a103 0201 05a2 0302 010a a30e 300c ..............0.
0x0030: 300a a104 0202 0095 a202 0400 a481 a130 0..............0
0x0040: 819e a007 0305 0000 0000 10a1 2b30 29a0 ............+0).
0x0050: 0302 0101 a122 3020 1b04 686f 7374 1b18 ....."0...host..
0x0060: 636c 6965 6e74 2d61 642e 6164 2e65 7861 client-ad.ad.exa
0x0070: 6d70 6c65 2e6e 6574 a210 1b0e 4144 2e45 mple.net....AD.E
0x0080: 5841 4d50 4c45 2e4e 4554 a323 3021 a003 XAMPLE.NET.#0!..
0x0090: 0201 02a1 1a30 181b 066b 7262 7467 741b .....0...krbtgt.
0x00a0: 0e41 442e 4558 414d 504c 452e 4e45 54a5 .AD.EXAMPLE.NET.
0x00b0: 1118 0f32 3031 3631 3132 3231 3731 3835 ...2016112217185
0x00c0: 305a a706 0204 72a2 af72 a814 3012 0201 0Z....r..r..0...
0x00d0: 1202 0111 0201 1702 0110 0201 1902 011a ................
17:18:50.419282 IP 192.168.56.32.88 > 192.168.56.33.53237:
0x0000: 4500 00c1 df8c 4000 4011 690d c0a8 3820 E..... at .@.i...8.
0x0010: c0a8 3821 0058 cff5 00ad f250 7e81 a230 ..8!.X.....P~..0
0x0020: 819f a003 0201 05a1 0302 011e a411 180f ................
0x0030: 3230 3136 3131 3231 3137 3138 3530 5aa5 20161121171850Z.
0x0040: 0502 0306 65af a603 0201 06a7 101b 0e41 ....e..........A
0x0050: 442e 4558 414d 504c 452e 4e45 54a8 2b30 D.EXAMPLE.NET.+0
0x0060: 29a0 0302 0101 a122 3020 1b04 686f 7374 )......"0...host
0x0070: 1b18 636c 6965 6e74 2d61 642e 6164 2e65 ..client-ad.ad.e
0x0080: 7861 6d70 6c65 2e6e 6574 a910 1b0e 4144 xample.net....AD
0x0090: 2e45 5841 4d50 4c45 2e4e 4554 aa23 3021 .EXAMPLE.NET.#0!
0x00a0: a003 0201 02a1 1a30 181b 066b 7262 7467 .......0...krbtg
0x00b0: 741b 0e41 442e 4558 414d 504c 452e 4e45 t..AD.EXAMPLE.NE
0x00c0: 54 T