Path: utzoo!attcan!uunet!systech!johnr
From: johnr@systech.uucp (John Reed)
Newsgroups: comp.windows.x
Subject: X protocol packets
Keywords: etherfind,X protocol
Message-ID: <106@systech.uucp>
Date: 14 Dec 88 23:10:50 GMT
Organization: Systech Corp., San Diego
Lines: 50

The following data was gathered from "etherfind -x"
It shows the ethernet packets that were being transferred between
an X terminal and a host.

At the time, I was simply running vi in an xterm window.  The output
shows the packets that were transferred when a single character ('k')
was typed on the terminal.

The first data packet is a "KeyPress" event, and is generated from
the terminal.

The 2nd data packet is a "ImageText8" packet, and is generated from
the client host.

I understand that the first 54 bytes of data are the ethernet header
and the tcp stuff.  I am not concerned with this junk.

Can anyone provide me an explanation of the data within the X protocol
message itself?  Like where is the 'k' encoded??
I just do not understand the format of the data within these X message.

Also, what are the last 8 bytes of data in each packet for.  Is this
some kind of tcp trailer??

Using interface ie0
 0.00 TCP from systec.vis.6000 to systec.sun3.2431 seq 616AFE02, ack 9C4E512,
 window 2828, 32 bytes data
 08 00 20 01 c8 7c 00 00 22 ff 00 0b 08 00 45 00
 00 48 8e 46 00 00 3c 06 3e 50 c0 06 99 09 c0 06
 99 03 17 70 09 7f 61 6a fe 02 09 c4 e5 12 50 18
 0b 0c c4 25 00 00 02 12 12 23 0a 7e 9b 16 00 08
 00 6b 00 10 00 09 00 00 00 00 01 5f 00 cd 01 47
 00 65 00 00 01 00 0d 0a 65 61 6c 69 6e 67

 0.01 TCP from systec.sun3.2431 to systec.vis.6000 seq 9C4E512, ack 616AFE22,
 window 4096, 60 bytes data
 00 00 22 ff 00 0b 08 00 20 01 c8 7c 08 00 45 00
 00 64 68 d9 00 00 0f 06 90 a1 c0 06 99 03 c0 06
 99 09 09 7f 17 70 09 c4 e5 12 61 6a fe 22 50 18
 10 00 e9 de 00 00 4c 01 00 05 00 10 00 09 00 10
 00 0a 00 02 01 2a 20 02 00 2a 4c 01 00 05 00 10
 00 09 00 10 00 0a 00 02 01 2a 6b c0 00 14 4c 01
 00 05 00 10 00 09 00 10 00 0c 00 0e 01 2a 20 01
 00 05 0d 0a 65 20 20 79 6f 75


Thanks in advance for anyone willing to help.

John Reed
{uunet,ucsd}!systech!johnr