pak004_932bdb768b3eeeec3fcd3540acd32aa0.pcap

MD5	932bdb768b3eeeec3fcd3540acd32aa0
Submission Date	2021-10-04 07:56:18
Tags	(not set)

Alert 6

Showing 1-6 of 6 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2012-09-21T07:42:34.494625-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?

2012-09-21T07:42:34.494625-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:36.845858-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:36.845858-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:37.398726-0700
Flow Id	182514582651992
Source IP	80.239.254.72
Source Port	80
Destination IP	172.18.3.11
Destination Port	6512
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 09 Mar 2006 21:32:31 GMT ETag: "9f40d-3a-40e969d2259c0" Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 63 Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive ..........K+.K....Sp.O..M.+./.,I.P.(..Q.T.VH....#KX+... ...:...HTTP/1.1 200 OK Server: Apache Last-Modified: Tue, 28 Aug 2012 10:16:41 GMT ETag: "7572ed-997c-4c850bd04f440" Accept-Ranges: bytes Content-Length: 39292 Content-Type: application/x-shockwave-flash Date: Fri, 21 Sep 2012 14:35:47 GMT Connection: keep-alive CWS.....x..zuT[_.h...%X...[p...@." .$..).w.n..R\.C!P..o..R.X...........z.M.......{.9q.<k..rd.x........V........a.a.... W.....jj...........i........y.ZCw...p...E..X.q...X;;..X.......$e\|\,..`.tV0[8B..wG7........&................s..{. #M'.#.........qrD...H1.K.....i^....x8H1..C.{..C...............................................`x....F.......1)........[......_LL..O.W@........a...pg...E..............r...b`.w.N...............= 0....].......;{.Y........]...Go........Q.......PS.bx......WV.U.................@\|r". E9y.....d.....E...........A.\|......))...[V ..a....[.._.\|..........M.......c....n..B..'..O.ii G.3....._anp/..e7g'..eX..?x......\LHXTAXNXY^....c...7.?Y.}t.....O=..?..,.G.?.....f........_....<..'.K.P...w@./@.O.7._.'......=. ....... . .....a.p.. .?..k.AC.....~.....L..;..?Tl,....C...1.=#.y...:....@../G..k..@..T @B...S.<#.$D.;...[H.........>..B..... .S<f..a.,"6.....o..^lS.E .0...4VQ..H\ ..:.:.:...:...\|..c...._N.....bp..<..q.D....c...1E..'..}S)L/....x..R@t @.0..rL........v....].........'..,CX.........\2...W._k.......yH^o..n@.J......I.K.>.Z....92....3..\...fL...OK!.z..Ds...1....M\vk.).#Q..k .,.r.W..L....X.l..S&........Kg.#..pO...H_n..U...5.,W..e.....m.......u1.\|.I.U^..C.&duK..L.n..%......D.d)5....OY..[.G....M..2...6...Y3A.."T.t(.V..I......L.n.{$>....r..2.....2.....5,. 3R/-.\\....s.,.m_ ZQKO....0...+..d.:o.M..ux...?.C0..r.....b.[.....mO#Tn.....z..X%.{s.#.3........%....f.\|...,...S.?......Rl.s...C..Vj...~....T(.r..........Ik.b ..M./...n.H"Y0.=t.b.e..}.CW.........q)....d,.g.0j"..._g...g.u...%.{..(..j..n.....wl........V..Qq.YF-.B]).}.G...Gx....b.C..........N...4.(..,..2J............i.y...w ...\..../:d.@cYhd..;...?..m...9-.U..G......g.yx.s..>~..>1VX.........%..5'j..9..P...6d..dm8f.L].....iSrF...e:.m.,?(.b.O......U.JdiV.<gP.........._...~7E......?J....c.I....$......7..o5@].ub..\N........c;..2; e.........Ql...o...g.e0...e..-4.....%.%F...O..H.A.-......?C...g.m.@7.w.Z...K7...T0.... ....F..>...j..08.D........u..9...gD..F....=......nY..B..7...2...`4...-...U.W.>.Tj.[...../.7......L...J.G...,.z<.R.%.B~[S.....h.+.7)...(.._.F.~."..w.mPx.$o.O....uc..j.....s~......'.m....K...x.y..................K....>H..(xR.'y...7.?/.L.FWK...Hx&...?.=mK...u..._}H...y...<jR..I.....Z`..v.b]...R..&..E).&plMo....`8.A.B...E..h...Ll...o.... ..u..@yB:.7UB.#.......}.......~FqJ...u.o.............sH".u.[WN.............<.............."wQ...+..b..tu.S2.<...SGUT.Jx.f.K9q8.g.+c.G.......A...T...k...j)>.{s..,OD.....=....9_.}.....{.;................I..2U... B#.)..=.....%

2012-09-21T07:42:37.398726-0700

80.239.254.72

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.445690-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.445690-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:42:39.570006-0700
Flow Id	1700414006947792
Source IP	173.194.41.188
Source Port	80
Destination IP	172.18.3.11
Destination Port	6493
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 200 OK Vary: Accept-Encoding Content-Type: text/javascript Last-Modified: Tue, 08 May 2012 20:09:07 GMT Date: Thu, 20 Sep 2012 14:38:23 GMT Expires: Fri, 21 Sep 2012 14:38:23 GMT X-Content-Type-Options: nosniff Content-Encoding: gzip Server: sffe Content-Length: 321 X-XSS-Protection: 1; mode=block Age: 86241 Cache-Control: public, max-age=86400 ...........RMk.@.=......(-..J..Z......`.1.v.[.5.....?.I........1JD....B.^.............xd3.&{... G.;U.R..%......Y.!.Q.^$D.!(...#.%."....-lQ?...C..3.Jf.r.d..nK.......P....F...uN..q9....y..1.T~..I.......]q.v...[3:t..>...d....@..~}.wzO......a.y..d.....5}.XV.......O....O>...7V6.Z../...~..A....... uV..cpH2...F.hB......!...HTTP/1.1 200 OK Content-Type: application/x-shockwave-flash Last-Modified: Tue, 04 Sep 2012 10:02:29 GMT Date: Fri, 21 Sep 2012 09:17:44 GMT Expires: Sat, 22 Sep 2012 09:17:44 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 41155 X-XSS-Protection: 1; mode=block Age: 19080 Cache-Control: public, max-age=86400 CWS.R...x...u\.../>{.&6..R....t..t.t...... .--...J7 .. JI...\|..9......?......f.5kf.......R.....R...C...Aonn:.0.$..X......p..!.e<..5.m]iu,].. p.....@!HP6..t.z..D.Cz.. .+...+...!.%X$J../.:...V./.0."4..T.;.\... ......K...k.K......+.#. .!.#^:.).+~.~>~!>....+. x;&Nk\...I.p.)...I.J...~\|.-W`..{.......B.....T.4...........h./.T-....jJ.>.....}...K.P....N...........-.c...c.48....X.......N...".@..Y..gk..M..i.)E..@..{..L..z.O..@..$.....R]....g./I$..Pma...{....v.J..."..R.MMq..gi@6D....E.>...e.(.Y.....-........k.HzZ...t......W......W.iG.K.......R. .:...3.yf.v....z....E...#W.4.WJ.Y......c.0... ..ID....-..@.LE.......T..U.]...X.^......@3...;.....Z....._..>f2...\|..A..f.. .1........._J....Mqd;..a........a.......>.#$.$...dq_...V.M...)i@n1&..?. .W ......>.ei.D".@b...E....Ua. `k.....;E..<..lk2.a >..\|~.M..M6..k..b..].^X{..l...v;{...p.X.....^}O?...?l.J.d@........;...[.n..4Bn...h..JaW......;.A......p.c3..mX`...3.0.B.\.`.......0.N...........1n..O.....eVx..\s..'.Z....:o}......:.y)O.....E......y....)...T..........]......v.a......W......._<....3h....%..?F... .[j....w6.\..{Q.E].$J.;.lk.:...~...e!.bG.#..S!&...4..;..d). q_T;...(...Kx._b....l].P.......9u..3.[..i.... .o...D...D.\....`. A~....e...\-@ ..\|.c...U+..4B... ..{.F:.....D..../v..z..l.9.So/.S.1"...J.?.y..3..CD....t....rz.@:[.\|...;.l9.......c./.i@.[.0fY.. ...P..O...Tu...}....&..G%...&....q...v..c...:ydD "F..Y o. ..L....x.D......k.E..R.a$.w...._J...N.....0...fLC........8X.g...=6.0P.h,..h.D.3.....5.. ....vj..7....uAB...v:..vj......$....!..K.{. ..j..I....V.".s.I..ywc"...J]..$.C~.m.p..8...q....gE4.y.Ri..m...H...rAg...P....)`u\..tg;........u..`....D.ZG.IM.`....k....$..g/.......WK.c.=..CM@..M.g...........d.....l..Q....!fD.X...P.v..4.k...g.....M.b. \|.....b..... >WD.g...=...`.t].m...C......4..)OD...b...........a.1X9..6.... .).....#^...i..e..w.M.".ndl.d....G.3..Z8".......D...U........... ...t)......Y... ...T.......;.^...... >....."..R.d.s..M.....G^.{.G.....S.......3.6..Q0.b...ug/..ON......... o...BI.Z.=.y].... ..buc....Y....... ....!tV..=..~.s...f......3.\|f.............H-;...A.S'....j...c.....J....N..G..=..a.aa .j.Q1..x.+U.K ....<C.Iw.,.k..........0.g..B-....@#<....P.....@.B....b.......A..I"2.%..+gf..b...+..{#:.u. !...SD..u^l8}.3.Zr7.....'........0.Z`~_......./.X...U..V..A.....A......Q....%.2.0h.'./.9+............YO. b....s...b..z....... ..x.......b.0... xx.g..;&.~...~...........xp..'.m.{...../.`.)............4..\|...}...5.v...S.e...?......8L..7.@..l...Y.`=..,+.}..#.........~.].aDA ..!.......!...$.u}P.0.....?..V).gG).~.../c.[.#.[...........S.+...G.0....0H.mV..t5....5.xf"..>g#.= .I.D..../.).B*...@.9..u...xI...,..Z..3..5b....e....}L] ..(U;U..;DJ.Q+u..(u........ZF...E.PT.. ...........eDa..#..5r...9...!...F.E#m....P.....D. .................#.p....#..d.....h......0..@....e..........t[.1.........n..~.t..........h.Y....T.R....E..0A.d^\B...^6....c......O-..0v.Vd.ASY-.=......+..1H.."&\|z.@.<X..z..W .f.....b.'v...!..0...#...w...._x.....t.(..L9...0N..}.9#...\.../...........g.^..+..4.E.....-.]....d.H.:.Q2 ."....._S.O...........5w..].E.di..C.Q.yR. .2F.D&]..i^.z....4.....&bvv.......$++...]{..-@.g.D...

2012-09-21T07:42:39.570006-0700

173.194.41.188

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

Timestamp	2012-09-21T07:43:36.151476-0700
Flow Id	1113760125742992
Source IP	80.239.254.42
Source Port	80
Destination IP	172.18.3.11
Destination Port	6435
Protocol	TCP
Alert Signature	ET INFO Observed Interesting Content-Type Inbound (application/x-sh)
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2031747
Payload Printable	HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1 Content-Length: 305 Vary: Accept-Encoding Cache-Control: max-age=269 Expires: Fri, 21 Sep 2012 14:39:23 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://emp.bbci.co.uk/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1">here</a>.</p> </body></html> HTTP/1.1 200 OK Last-Modified: Mon, 14 May 2012 13:04:14 GMT Vary: Accept-Encoding Server: Apache Accept-Ranges: bytes Content-Type: application/x-javascript Content-Encoding: gzip Content-Length: 2621 Cache-Control: max-age=84 Expires: Fri, 21 Sep 2012 14:36:18 GMT Date: Fri, 21 Sep 2012 14:34:54 GMT Connection: keep-alive ............ks.9.....+...{...2q9....YI.....aF..y!i.....ni.`....2.....w..e...$.l.vE'p.B..X.Cx......^bgKbM.B,.......pH.4t.. ..>....<v.!?..+.37...p..^'. ..8...n6..:.J....u.s.TI.F[..I.-Z'n..Q...._.pH.$.$...J.!...AQ%.N.w`..(UO)Of..x9y.8$.}>.b.....@..N../7."x.$......@+....M....l.\%...].)P...(.q2..c2.\e"...H.....A.k~:q.....6...,T..;#...... .H.E. ......g^.g....xH. .?.J_g#@...{C.. .Anh. .....;[..p`q!.1<.X.W.......d...m6\|=...f..........s........G'..r...".+p.d.p[.a.(..6* .;.Q.fe.<...(.................^....-BX}..~...fa.`.......h........h.+.X.X...J..H..fEN:.Llo..3E....= .!x4=fV..t\|<..P.d..f...&.L.......su.r\.wO_....qJ.'.T....X.h.:Z..K..J..`...I.)x.4SHBxF.qi .......>.~.z........a.F......../.SJ..Z.Tp.K.e..N.....S.^..L...Pc..............{.X...N.%...F....cF.eK...S.XN...8g.~..#...._...............-wz.1F.t<8.....i..x..6v_.........C qD.....I..n ..Z#G-.?j...<u....sB...e\8Z\969%.w........."].......R.;.MZ..B..l....I..Gr...- 1.e.....T..~........]&w.6.E..\|......N.l..20&...3.0....7'..a,!A...g[...0.....2...^T. .a.4)...>!...a..p......=.....j.e.4.D...8...1..P...-..........\...:.?. OH...S.I[.fJ.....(...N.tb...J:...../.....<w9.9......6Mc....$.I....}.I../...$...l......9f... C.D.9.%.<C..].K.........x..H.oV.^O.m-..2.U.l.4..l\.._3.YC.\|.7.X....%.b..0J.T$A.:..H6P..a..n\|$......Y/\y...D.r..@Q... )..-.5wf..3G..<o.........A...b...XA.......mp.M.4Kk.....z.)ci ..RQ.... ._...=8..p...&..7..6../...#..........\.1@...PJu..b.u\|i.."X..p.l.]I.~L6"P.....].......[.......o\`}5'...Z.........Q..bw^d.\..U.0..I..7...sQ...Q........`.Q...a..\..s]....s....h...@^..Do...+......n<..4.../..h..9..&P'.7....q:.......8..}.[..J.5.5....... (......R]vgoR..........BZ.d^.L.64.M..h.8..f..8...HXH....I...ZB$N.n......<.2.....2>..XL...-..b.y..&..:w..>..\|p(}..1.}j..8.d......v...Y.q..T..p.7...C].9..v).0....%..9....j....G..,..C.........1v&.8......H.5....7.../.y...o..4....(.._.S.I..y...aH.<._.~BV.Y.o....w..........x......u.<....V?.._@\|.........[.....S...IQ.1._:eO.w....m~.Y.. &.;p)..1....b....".R...............K....Iu.@z...N.\.E ..&=....6r.`x.wP.No.l..l8..2. ...;1.rjB.........P......d.......v..........6..)..u. t...S..._... +..J.7.uv..v.Oe.N.7)R =...q....N~...... .......~.s8.tb(..B...b.. . ..;.!C<4<....%... Q.{....X. ........._.Jrt...Q.......:......"........ ..<9Z.....Y......y...F.......=B...).;........5..}....fpd...PQ.....\|....gO...A.4.~V..k..}1..i7....z.m.......9........Z\|..pV.....Y...G..>..=:-.)...t..v.\|r!....QA..TH.G..}.. I.^T...w.p.c.hG.3.......O....@.c.<u2a....n.>6J>.t..........z9....[w..G.K;.)r..N+.M@.%^.n..<...F....8/..........P1......5'\|h.H.".....4l.j].m....,/.~..~..o.e... .....P^Uc .>..].sqC .s..(...D.....fQ..S...ZC..m.}..M..;........_<.....HTTP/1.1 301 Moved Permanently Server: Apache Content-Type: text/html; charset=iso-8859-1 Location: http://emp.bbci.co.uk/emp/releases/worldwide/revisions/749603_749269_749444_6/embed.js?mediaset=journalism-pc Content-Length: 317 Vary: Accept-Encoding Cache-Control: max-age=238 Expires: Fri, 21 Sep 2012 14:38:53 GMT Date: Fri, 21 Sep 2012 14:34:55 GMT Connection: keep-alive <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <ti

2012-09-21T07:43:36.151476-0700

80.239.254.42

172.18.3.11

ET INFO Observed Interesting Content-Type Inbound (application/x-sh)

DNS 327

Showing 1-20 of 327 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2012-09-21T07:41:39.704863-0700

172.18.3.11

172.18.1.100

query

www.google.co.uk

(not set)

2012-09-21T07:41:40.288015-0700

172.18.3.11

172.18.1.100

query

play.google.com

(not set)

2012-09-21T07:41:40.309850-0700

172.18.3.11

172.18.1.100

query

www.youtube.com

(not set)

2012-09-21T07:41:40.337901-0700

172.18.1.100

172.18.3.11

answer

play.google.com

(not set)

2012-09-21T07:41:40.339156-0700

172.18.3.11

172.18.1.100

query

news.google.co.uk

(not set)

2012-09-21T07:41:40.339186-0700

172.18.3.11

172.18.1.100

query

mail.google.com

(not set)

2012-09-21T07:41:40.339973-0700

172.18.1.100

172.18.3.11

answer

www.youtube.com

(not set)

2012-09-21T07:41:40.339974-0700

172.18.1.100

172.18.3.11

answer

mail.google.com

(not set)

2012-09-21T07:41:40.340579-0700

172.18.3.11

172.18.1.100

query

docs.google.com

(not set)

2012-09-21T07:41:40.341765-0700

172.18.3.11

172.18.1.100

query

books.google.co.uk

(not set)

2012-09-21T07:41:40.342098-0700

172.18.1.100

172.18.3.11

answer

books.google.co.uk

(not set)

2012-09-21T07:41:40.342539-0700

172.18.3.11

172.18.1.100

query

www.blogger.com

(not set)

2012-09-21T07:41:40.363758-0700

172.18.1.100

172.18.3.11

answer

news.google.co.uk

(not set)

2012-09-21T07:41:40.363759-0700

172.18.1.100

172.18.3.11

answer

www.blogger.com

(not set)

2012-09-21T07:41:40.365252-0700

172.18.3.11

172.18.1.100

query

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.380116-0700

172.18.1.100

172.18.3.11

answer

docs.google.com

(not set)

2012-09-21T07:41:40.409792-0700

172.18.1.100

172.18.3.11

answer

picasaweb.google.co.uk

(not set)

2012-09-21T07:41:40.287910-0700

172.18.3.11

172.18.1.100

query

maps.google.co.uk

(not set)

2012-09-21T07:41:40.337900-0700

172.18.1.100

172.18.3.11

answer

maps.google.co.uk

(not set)

2012-09-21T07:41:40.381273-0700

172.18.3.11

172.18.1.100

query

accounts.google.com

(not set)

TLS 8

Showing 1-8 of 8 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2012-09-21T07:42:39.608580-0700

172.18.3.11

173.194.41.168

TLSv1

plusone.google.com

2012-09-21T07:42:39.469797-0700

172.18.3.11

173.194.41.174

TLSv1

apis.google.com

2012-09-21T07:42:39.679741-0700

172.18.3.11

173.194.41.175

TLSv1

ssl.gstatic.com

2012-09-21T07:42:40.459911-0700

172.18.3.11

2.23.130.110

TLSv1

s-static.ak.facebook.com

2012-09-21T07:42:47.097613-0700

172.18.3.11

173.194.41.185

TLSv1

googleads.g.doubleclick.net

2012-09-21T07:42:40.801600-0700

172.18.3.11

173.252.101.16

TLSv1

www.facebook.com

2012-09-21T07:42:59.520623-0700

172.18.3.11

173.194.67.95

TLSv1

ajax.googleapis.com

2012-09-21T07:43:34.176791-0700

172.18.3.11

173.194.41.163

TLSv1

sb-ssl.google.com

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 687

Showing 161-180 of 687 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

161

2012-09-21T07:42:06.659693-0700

172.18.3.11

www.google.co.uk

GET

/s?hl=en&sugexp=les%3B&gs_nf=1&cp=8&gs_id=30&xhr=t&q=The%20key%20&pf=p&output=search&sclient=psy-ab&oq=&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=ff301ef4d48490c5&biw=1680&bih=920&tch=1&ech=8&psi=H3tcUJzaJYWf0QW184CYBw.1348238521751.1

200

162

2012-09-21T07:42:06.706940-0700

172.18.3.11

www.google.co.uk

GET

/s?hl=en&sugexp=les%3B&gs_nf=1&cp=11&gs_id=4g&xhr=t&q=The%20key%20is%20&pf=p&output=search&sclient=psy-ab&oq=&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=ff301ef4d48490c5&biw=1680&bih=920&tch=1&ech=11&psi=H3tcUJzaJYWf0QW184CYBw.1348238521751.1

200

163

2012-09-21T07:41:45.538245-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/img/carousel-prev-next-3.png

200

164

2012-09-21T07:41:45.620655-0700

172.18.3.11

open.live.bbc.co.uk

GET

/wurfldemi/network.jsonp?callback=_demi_mobile_network_cb_0

200

165

2012-09-21T07:41:45.643105-0700

172.18.3.11

node1.bbcimg.co.uk

GET

/glow/glow/1.7.7/widgets/images/darkpanel/ctr.png

200

166

2012-09-21T07:41:54.080921-0700

172.18.3.11

news.bbcimg.co.uk

GET

/view/3_0_2/cream/hi/shared/story.css

200

167

2012-09-21T07:42:12.049128-0700

172.18.3.11

p5-vuomjve4ezg7a-ygiznq2tllkmxoic-759258-i2-v6exp3-v4.metric.gstatic.com

GET

/v6exp3/6.gif

200

168

2012-09-21T07:41:54.116429-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/bump?emp=worldwide&enableClear=1

301

169

2012-09-21T07:42:18.443981-0700

172.18.3.11

www.google.co.uk

GET

/s?hl=en&sugexp=les%3B&gs_nf=1&cp=12&gs_id=at&xhr=t&q=The%20key%20is%20%22&pf=p&output=search&sclient=psy-ab&oq=&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=ff301ef4d48490c5&biw=1680&bih=920&tch=1&ech=12&psi=H3tcUJzaJYWf0QW184CYBw.1348238521751.1

200

170

2012-09-21T07:41:54.184463-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/releases/bump/revisions/872744/embed.js?emp=worldwide&enableClear=1

304

171

2012-09-21T07:41:54.252398-0700

172.18.3.11

stats.bbc.co.uk

GET

/o.gif?~RS~s~RS~News~RS~t~RS~HighWeb_Story~RS~i~RS~19674761~RS~p~RS~99113~RS~a~RS~Domestic~RS~u~RS~/news/technology-19674761~RS~r~RS~http://www.bbc.co.uk/news/technology/~RS~q~RS~~RS~z~RS~04~RS~

200

172

2012-09-21T07:41:54.275052-0700

172.18.3.11

emp.bbci.co.uk

GET

/emp/worldwide/embed.js?mediaset=journalism-pc

301

173

2012-09-21T07:41:45.731110-0700

172.18.3.11

news.bbcimg.co.uk

GET

/js/app/ticker/2_1_1/ticker.js

200

174

2012-09-21T07:41:49.838636-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/63031000/jpg/_63031105_000793140-1.jpg

200

175

2012-09-21T07:41:49.847598-0700

172.18.3.11

news.bbcimg.co.uk

GET

/media/images/62978000/jpg/_62978075_62978004.jpg

200

176

2012-09-21T07:41:49.879909-0700

172.18.3.11

newsimg.bbc.co.uk

GET

/news/special/2012/newsspec_4095/widget/css/style_w.css

200

177

2012-09-21T07:42:20.597822-0700

172.18.3.11

news.google.co.uk

GET

/news/tbn/Zslr3463hrQJ/6.jpg

200

178

2012-09-21T07:42:20.599260-0700

172.18.3.11

www.google.co.uk

GET

/s?hl=en&sugexp=les%3B&gs_nf=1&cp=44&gs_id=da&xhr=t&q=The%20key%20is%20%22ad7b9c14083b52bc532fba5948342b98&pf=p&output=search&sclient=psy-ab&oq=&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=ff301ef4d48490c5&biw=1680&bih=920&tch=1&ech=13&psi=H3tcUJzaJYWf0QW184CYBw.1348238521751.1

200

179

2012-09-21T07:42:20.771452-0700

172.18.3.11

id.google.co.uk

GET

/verify/EAAAAOUmQ06UkEvBLgmOHOaVuYg.gif

200

180

2012-09-21T07:42:20.824447-0700

172.18.3.11

www.google.co.uk

GET

/csi?v=3&s=web&action=&ei=MXtcULqJFYi5hAebh4GYCQ&e=17259,18168,28290,28663,37102,39523,39977,4000116,4000354,4000473,4000519,4000545,4000553,4000833,4000841,4000949,4000974,4001007&cr=c&imp=1&pf=1&pfa=n.10,ttfc.59,ttlc.0,cbt.1&pfm=n.10,ttfc.106,ttlc.0,cbt.52&pmd=max.1,avg.0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1&imn=3&rt=prt.68,pprt.69,ol.69,jsrt.1203,iml.167,kpr.15010,bpl.18917

204

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 405

Showing 121-140 of 405 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

121

2012-09-21T07:43:38.102668-0700

1170760787505764

flow

172.18.3.11

60409

172.18.1.100

UDP

pcapanalyzer

122

2012-09-21T07:43:38.102668-0700

1311528340660177

flow

172.18.3.11

62053

172.18.1.100

UDP

pcapanalyzer

123

2012-09-21T07:43:38.102668-0700

1874628618132601

flow

172.18.3.11

55651

172.18.1.100

UDP

pcapanalyzer

124

2012-09-21T07:43:38.102668-0700

1452469836598561

flow

172.18.3.11

6440

80.239.254.34

TCP

pcapanalyzer

125

2012-09-21T07:43:38.102668-0700

608392802203413

flow

172.18.3.11

60958

172.18.1.100

UDP

pcapanalyzer

126

2012-09-21T07:43:38.102668-0700

467968848027823

flow

172.18.3.11

6587

88.212.196.69

TCP

pcapanalyzer

127

2012-09-21T07:43:38.102668-0700

608736403410179

flow

172.18.3.11

59874

172.18.1.100

UDP

pcapanalyzer

128

2012-09-21T07:43:38.102668-0700

1875592834831896

flow

172.18.3.11

6445

212.58.244.80

TCP

pcapanalyzer

129

2012-09-21T07:43:38.102668-0700

1453431916356911

flow

172.18.3.11

6627

87.249.105.58

TCP

pcapanalyzer

130

2012-09-21T07:43:38.102668-0700

749791715747733

flow

172.18.3.11

6545

98.124.224.243

TCP

pcapanalyzer

131

2012-09-21T07:43:38.102668-0700

186959873907396

flow

172.18.3.11

64916

172.18.1.100

UDP

pcapanalyzer

132

2012-09-21T07:43:38.102668-0700

187853226967336

flow

172.18.3.11

6517

95.172.69.41

TCP

pcapanalyzer

133

2012-09-21T07:43:38.102668-0700

750839691156083

flow

172.18.3.11

64760

172.18.1.100

UDP

pcapanalyzer

134

2012-09-21T07:43:38.102668-0700

188067978916861

flow

172.18.3.11

56541

172.18.1.100

UDP

pcapanalyzer

135

2012-09-21T07:43:38.102668-0700

188222593900141

flow

172.18.3.11

6478

80.239.221.43

TCP

pcapanalyzer

136

2012-09-21T07:43:38.102668-0700

1595657607427743

flow

172.18.3.11

6549

199.59.148.89

TCP

pcapanalyzer

137

2012-09-21T07:43:38.102668-0700

1173610497479961

flow

172.18.3.11

56216

172.18.1.100

UDP

pcapanalyzer

138

2012-09-21T07:43:38.102668-0700

751578421369459

flow

172.18.3.11

58234

172.18.255.255

1947

UDP

pcapanalyzer

139

2012-09-21T07:43:38.102668-0700

892483414682922

flow

172.18.3.11

6570

173.194.41.185

TCP

pcapanalyzer

140

2012-09-21T07:43:38.102668-0700

1174012081346523

flow

172.18.3.11

65442

172.18.1.100

UDP

pcapanalyzer

File 654

Showing 61-80 of 654 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2012-09-21T07:41:44.834048-0700

80.239.217.171

172.18.3.11

/frameworks/barlesque/2.10.0/desktop/3.5/img/blq-search_grey_alpha.png

PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced

188

2012-09-21T07:41:44.979458-0700

80.239.254.24

172.18.3.11

/media/images/63025000/jpg/_63025403_post.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

5117

2012-09-21T07:41:44.868677-0700

80.239.254.24

172.18.3.11

/media/images/63007000/jpg/_63007925_63003380.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

6163

2012-09-21T07:41:45.037413-0700

80.239.254.24

172.18.3.11

/media/images/63012000/jpg/_63012843_lynher_dairies_220511_0465.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

6038

2012-09-21T07:41:45.087322-0700

80.239.254.24

172.18.3.11

/js/map/map_0_0_32.js

ASCII text, with very long lines, with no line terminators

889

2012-09-21T07:41:44.873271-0700

80.239.254.24

172.18.3.11

/media/images/63001000/jpg/_63001711_63001544.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

5968

2012-09-21T07:41:44.834057-0700

80.239.254.34

172.18.3.11

/iplayer/images/episode/b01mxyyc_150_84.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 150x84, frames 3

5292

2012-09-21T07:41:44.905789-0700

80.239.217.171

172.18.3.11

/frameworks/jquery/0.1.8/sharedmodules/jquery-1.6.2.js

ASCII text, with very long lines

133644

2012-09-21T07:41:44.910416-0700

80.239.254.24

172.18.3.11

/media/images/62937000/jpg/_62937264_62934668.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

5200

2012-09-21T07:41:44.843648-0700

80.239.254.24

172.18.3.11

/media/images/63030000/jpg/_63030020_photo(5).jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

6076

2012-09-21T07:41:44.844035-0700

80.239.217.171

172.18.3.11

/frameworks/barlesque/2.10.0/desktop/3.5/script/barlesque.js

UTF-8 Unicode text, with very long lines, with no line terminators

16858

2012-09-21T07:41:44.914523-0700

80.239.254.24

172.18.3.11

/media/images/62960000/jpg/_62960904_62960902.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3, xresolution=50, yresolution=58, resolutionunit=2], baseline, precision 8, 144x81, frames 3

5053

2012-09-21T07:41:44.953927-0700

80.239.254.24

172.18.3.11

/media/images/63025000/jpg/_63025721_trav.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

3974

2012-09-21T07:41:44.847059-0700

80.239.254.24

172.18.3.11

/media/images/63035000/jpg/_63035362_000145217-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

4457

2012-09-21T07:41:44.957724-0700

80.239.254.24

172.18.3.11

/media/images/63014000/jpg/_63014224_jex_1517346_de27-1.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

5087

2012-09-21T07:41:44.850881-0700

80.239.254.24

172.18.3.11

/media/images/63033000/jpg/_63033568_hi016036863.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 144x81, frames 3

4747

2012-09-21T07:41:44.887840-0700

80.239.254.34

172.18.3.11

/glow/glow/1.7.7/core/core.js

ASCII text, with very long lines

98133

2012-09-21T07:41:45.000780-0700

80.239.254.24

172.18.3.11

/media/images/63017000/jpg/_63017897_136238087.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

4520

2012-09-21T07:41:45.128132-0700

80.239.254.24

172.18.3.11

/js/view/0_0_32/view.js

HTML document, ASCII text, with very long lines, with no line terminators

9927

2012-09-21T07:41:45.004622-0700

80.239.254.24

172.18.3.11

/media/images/63021000/jpg/_63021371_eatrich144_getty.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 112x63, frames 3

4997

Comments	(not set)

Update Download PCAP Delete