I will try to make a view of most of the traffic, as just a short SL session have about 4500 packets, This was a login an almost ressing one self over a slow line. I can't explain all packets.
34 52.149720 192.168.20.2 220.127.116.11 DNS Standard query A modularsystems.sl
35 52.160008 192.168.20.2 18.104.22.168 DNS Standard query AAAA modularsystems.sl
36 53.115613 22.214.171.124 192.168.20.2 DNS Standard query response A 126.96.36.199
37 53.162052 192.168.20.2 188.8.131.52 DNS Standard query AAAA modularsystems.sl
38 53.414537 184.108.40.206 192.168.20.2 DNS Standard query response
This tell the computer where modularsystems.sl are, it at the address 220.127.116.11. Next a connections to modularsystem.sl is made and the following data sent and recived:
HEAD /app/login/ HTTP/1.1
Accept-Encoding: deflate, gzip
HTTP/1.1 200 OK
Last-Modified: Tue, 15 Dec 2009 13:00:01 GMT
Date: Tue, 15 Dec 2009 13:13:08 GMT
After this one more http connections is made to the modularsystems server and a few more files downloaded:
GET /app/login/?lang=en-us&firstlogin=TRUE&channel=Emerald%20Viewer&version=1%2E23%2E5%20%28950%29&grid=Agni HTTP/1.1
GET /app/login/images/back.png HTTP/1.1
GET /app/login/images/excla.jpg HTTP/1.1
GET /app/login/images/Error.jpg HTTP/1.1
Feed2js.org is used to make the LL and the Modular system blogs into one list at the login page.
GET //feed2js.php?src=http%3A%2F%2Fwww.rssmix.com%2Fu%2F285120%2Frss.xml&num=6&targ=y&utf=y HTTP/1.1
Once all the normal traffic to lindenlabs have been done, and you allow the viewer to update the clients tag data base the file "GET /app/client_tags/client_list.xml HTTP/1.1" will be downloaded form the server.