Frame 1: Packet, 101 bytes on wire (808 bits), 101 bytes captured (808 bits) on interface enp0s31f6, id 0 Section number: 1 Interface id: 0 (enp0s31f6) Interface name: enp0s31f6 Encapsulation type: Ethernet (1) Arrival Time: Sep 27, 2026 16:55:29.665702707 EDT UTC Arrival Time: Sep 27, 2026 20:55:29.665702707 UTC Epoch Arrival Time: 1790542529.665702707 [Time shift for this packet: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 101 bytes (808 bits) Capture Length: 101 bytes (808 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Character encoding: ASCII (0) Ethernet II, Src: Dell_5d:2b:8f (90:8d:6e:5d:2b:8f), Dst: PaloAltoNetw_b7:d0:45 (34:e5:ec:b7:d0:45) Destination: PaloAltoNetw_b7:d0:45 (34:e5:ec:b7:d0:45) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Dell_5d:2b:8f (90:8d:6e:5d:2b:8f) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Internet Protocol Version 4, Src: 132.177.11.131, Dst: 8.8.8.8 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 87 Identification: 0x1fa5 (8101) 000. .... = Flags: 0x0 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 64 Protocol: UDP (17) Header Checksum: 0xbaad [validation disabled] [Header checksum status: Unverified] Source Address: 132.177.11.131 Destination Address: 8.8.8.8 [Stream index: 0] User Datagram Protocol, Src Port: 45026, Dst Port: 53 Source Port: 45026 Destination Port: 53 Length: 67 Checksum: 0xa098 [unverified] [Checksum Status: Unverified] [Stream index: 0] [Stream Packet Number: 1] [Timestamps] [Time since first frame: 0.000000000 seconds] [Time since previous frame: 0.000000000 seconds] UDP payload (59 bytes) Domain Name System (query) Transaction ID: 0xd083 Flags: 0x0120 Standard query 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Standard query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... .0.. .... = Z: reserved (0) .... .... ..1. .... = AD bit: Set .... .... ...0 .... = Non-authenticated data: Unacceptable Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 1 Queries mask.apple-dns.net: type A, class IN Name: mask.apple-dns.net [Name Length: 18] [Label Count: 3] Type: A (1) (Host Address) Class: IN (0x0001) Additional records : type OPT Name: Type: OPT (41) UDP payload size: 1232 Higher bits in extended RCODE: 0x00 EDNS0 version: 0 Z: 0x0000 0... .... .... .... = DO bit: Cannot handle DNSSEC security RRs .000 0000 0000 0000 = Reserved: 0x0000 Data length: 12 Option: COOKIE Option Code: COOKIE (10) Option Length: 8 Option Data: 7be68846b70586c9 Client Cookie: 7be68846b70586c9 Server Cookie: Frame 2: Packet, 94 bytes on wire (752 bits), 94 bytes captured (752 bits) on interface enp0s31f6, id 0 Section number: 1 Interface id: 0 (enp0s31f6) Interface name: enp0s31f6 Encapsulation type: Ethernet (1) Arrival Time: Sep 27, 2026 16:55:29.666474151 EDT UTC Arrival Time: Sep 27, 2026 20:55:29.666474151 UTC Epoch Arrival Time: 1790542529.666474151 [Time shift for this packet: 0.000000000 seconds] [Time delta from previous captured frame: 771.444 microseconds] [Time delta from previous displayed frame: 771.444 microseconds] [Time since reference or first frame: 771.444 microseconds] Frame Number: 2 Frame Length: 94 bytes (752 bits) Capture Length: 94 bytes (752 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ip:udp:dns] Character encoding: ASCII (0) Ethernet II, Src: PaloAltoNetw_b7:d0:45 (34:e5:ec:b7:d0:45), Dst: Dell_5d:2b:8f (90:8d:6e:5d:2b:8f) Destination: Dell_5d:2b:8f (90:8d:6e:5d:2b:8f) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: PaloAltoNetw_b7:d0:45 (34:e5:ec:b7:d0:45) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IPv4 (0x0800) [Stream index: 0] Internet Protocol Version 4, Src: 8.8.8.8, Dst: 132.177.11.131 0100 .... = Version: 4 .... 0101 = Header Length: 20 bytes (5) Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT) 0000 00.. = Differentiated Services Codepoint: Default (0) .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0) Total Length: 80 Identification: 0x24fc (9468) 000. .... = Flags: 0x0 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set ...0 0000 0000 0000 = Fragment Offset: 0 Time to Live: 61 Protocol: UDP (17) Header Checksum: 0xb85d [validation disabled] [Header checksum status: Unverified] Source Address: 8.8.8.8 Destination Address: 132.177.11.131 [Stream index: 0] User Datagram Protocol, Src Port: 53, Dst Port: 45026 Source Port: 53 Destination Port: 45026 Length: 60 Checksum: 0xf0e5 [unverified] [Checksum Status: Unverified] [Stream index: 0] [Stream Packet Number: 2] [Timestamps] [Time since first frame: 771.444 microseconds] [Time since previous frame: 771.444 microseconds] UDP payload (52 bytes) Domain Name System (response) Transaction ID: 0xd083 Flags: 0x8100 Standard query response, No error 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Standard query (0) .... .0.. .... .... = Authoritative: Server is not an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...1 .... .... = Recursion desired: Do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... .0.. .... = Z: reserved (0) .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server .... .... ...0 .... = Non-authenticated data: Unacceptable .... .... .... 0000 = Reply code: No error (0) Questions: 1 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Queries mask.apple-dns.net: type A, class IN Name: mask.apple-dns.net [Name Length: 18] [Label Count: 3] Type: A (1) (Host Address) Class: IN (0x0001) Answers mask.apple-dns.net: type A, class IN, addr 132.177.102.27 Name: mask.apple-dns.net Type: A (1) (Host Address) Class: IN (0x0001) Time to live: 1 (1 second) Data length: 4 Address: 132.177.102.27 [Request In: 1] [Time: 771.444 microseconds]