I will try to make a view of most of the traffic, as just a short SL session have about 4500 packets, This was a login an almost ressing one self over a slow line. I can't explain all packets.
34 52.149720 192.168.20.2 18.104.22.168 DNS Standard query A modularsystems.sl
35 52.160008 192.168.20.2 22.214.171.124 DNS Standard query AAAA modularsystems.sl
36 53.115613 126.96.36.199 192.168.20.2 DNS Standard query response A 188.8.131.52
37 53.162052 192.168.20.2 184.108.40.206 DNS Standard query AAAA modularsystems.sl
38 53.414537 220.127.116.11 192.168.20.2 DNS Standard query response
This tell the computer where modularsystems.sl are, it at the address 18.104.22.168. Next a connections to modularsystem.sl is made and the following data sent and recived:
HEAD /app/login/ HTTP/1.1
Accept-Encoding: deflate, gzip
HTTP/1.1 200 OK
Last-Modified: Tue, 15 Dec 2009 13:00:01 GMT
Date: Tue, 15 Dec 2009 13:13:08 GMT
After this one more http connections is made to the modularsystems server and a few more files downloaded:
GET /app/login/?lang=en-us&firstlogin=TRUE&channel=Emerald%20Viewer&version=1%2E23%2E5%20%28950%29&grid=Agni HTTP/1.1
GET /app/login/images/back.png HTTP/1.1
GET /app/login/images/excla.jpg HTTP/1.1
GET /app/login/images/Error.jpg HTTP/1.1
Feed2js.org is used to make the LL and the Modular system blogs into one list at the login page.
GET //feed2js.php?src=http%3A%2F%2Fwww.rssmix.com%2Fu%2F285120%2Frss.xml&num=6&targ=y&utf=y HTTP/1.1
Once all the normal traffic to lindenlabs have been done, and you allow the viewer to update the clients tag data base the file "GET /app/client_tags/client_list.xml HTTP/1.1" will be downloaded form the server.