merged.pcap

MD5	1cd1ea56484846142e58015720fa6d34
Submission Date	2021-11-22 18:29:01
Tags	(not set)

Alert 35

Showing 1-20 of 35 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

2005-01-14T09:58:08.905094-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:14.907941-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:20.913970-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-05-06T02:42:14.364705-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2005-05-06T02:43:13.717249-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2006-08-25T12:36:08.782873-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:32:21.808007-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:34:05.096863-0700

192.168.1.2

69.114.183.8

ET P2P Kazaa over UDP

2011-09-23T13:11:59.760293-0700

172.16.0.2

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2011-09-23T13:11:59.760432-0700

192.168.43.244

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2017-07-02T15:20:34.110081-0700

192.168.0.106

255.255.255.255

ET POLICY Dropbox Client Broadcasting

2017-07-02T15:20:24.944089-0700

192.168.0.106

109.173.11.109

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:37.241599-0700

10.21.1.45

46.10.22.5

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:57.053088-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:42.881285-0700

10.21.1.88

216.58.202.14

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:43.231299-0700

10.21.1.88

172.217.29.132

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:47.291301-0700

10.21.1.88

110.52.23.134

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:36.788379-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:56:03.244116-0700

10.21.1.88

172.217.29.142

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:34:37.049607-0700

10.21.1.45

172.217.30.100

ET POLICY Python-urllib/ Suspicious User Agent

DNS 1374

Showing 1-20 of 1,374 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2005-07-16T07:29:32.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:33.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.753125-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:36.441602-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:37.271680-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2006-08-25T12:32:21.664799-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

(not set)

2006-08-25T12:32:21.664914-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:21.698599-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

(not set)

2006-08-25T12:32:23.172938-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:23.994435-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:24.673656-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:25.009057-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.174411-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663468-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663826-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:27.152203-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:31:06.890652-0700

192.168.1.2

192.168.1.1

query

2.1.168.192.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.890808-0700

192.168.1.2

192.168.1.1

query

114.214.204.212.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.924944-0700

192.168.1.1

192.168.1.2

answer

2.1.168.192.in-addr.arpa

PTR

(not set)

TLS 64

Showing 1-20 of 64 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2017-07-02T15:20:34.279553-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:33.559648-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:36.867925-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:34.387320-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:35.427278-0700

192.168.0.106

172.217.29.238

TLS 1.2

translate.google.com

2017-07-02T15:20:35.630035-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:37.615894-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:37.624410-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:38.535015-0700

192.168.0.106

52.17.122.61

TLS 1.2

location.services.mozilla.com

2017-07-02T15:20:37.411042-0700

192.168.0.106

172.217.29.100

TLS 1.2

www.google.com

2017-07-02T15:20:37.605273-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:40.202010-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:41.271164-0700

192.168.0.106

52.39.237.157

TLS 1.2

self-repair.mozilla.org

2017-07-02T15:20:38.534966-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:41.836615-0700

192.168.0.106

54.192.227.96

TLS 1.2

normandy-cloudfront.cdn.mozilla.net

2017-07-02T15:21:03.457984-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:04.527394-0700

192.168.0.106

172.217.29.99

TLS 1.2

www.gstatic.com

2017-07-02T15:21:19.971634-0700

192.168.0.106

172.217.29.110

TLS 1.2

sb-ssl.google.com

2017-07-02T15:21:03.143734-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:03.376975-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

TFTP 1

Showing 1-1 of 1 item.

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
1	2013-05-01T05:24:11.972852-0700	192.168.0.253	192.168.0.10	read	rfc1350.txt	octet

HTTP 670

Showing 1-20 of 670 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2005-01-14T09:58:05.638272-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444067-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444203-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.324482-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.756923-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.945685-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945728-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945874-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444128-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.712327-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.830220-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845352-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945802-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.838948-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.854970-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.711059-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845409-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.916214-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:11.055661-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:16.116227-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 5

Showing 1-5 of 5 items.

Timestamp

Source

Destination

Email From

Email To

Subject

2013-08-22T12:17:56.649185-0700

192.168.0.4

212.227.15.167

DI <digitalinvestigator@networksims.com>

w.buchanan@napier.ac.uk

Testing

2014-01-06T13:20:26.759146-0800

192.168.47.171

192.168.47.134

"Bill" <w.buchanan@napier.ac.uk>

<test@home.com>

Test

2015-12-29T11:13:51.630178-0800

172.16.16.221

172.16.16.231

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2015-12-29T11:14:08.908722-0800

172.16.16.225

172.16.16.221

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2017-07-02T15:20:34.040092-0700

172.16.16.225

172.16.16.221

(not set)

Flow 1143

Showing 101-120 of 1,143 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

101

2006-08-25T12:31:20.388422-0700

2050727058172945

flow

81.131.67.131

41730

151.37.67.40

6346

UDP

pcapanalyzer

102

2006-08-25T12:31:20.388422-0700

222466854143777

flow

81.131.67.131

41730

218.72.89.80

6346

UDP

pcapanalyzer

103

2006-08-25T12:31:20.388422-0700

786920046538949

flow

81.131.67.131

41730

85.135.146.10

6346

UDP

pcapanalyzer

104

2006-08-25T12:31:20.388422-0700

1928765018663518

flow

24.102.197.177

4917

81.131.67.131

41730

UDP

pcapanalyzer

105

2006-08-25T12:31:20.388422-0700

1647848388196333

flow

81.131.67.131

6348

69.227.71.60

6346

UDP

pcapanalyzer

106

2006-08-25T12:31:20.388422-0700

2075156832993394

flow

81.131.67.131

2821

69.224.47.236

14280

TCP

pcapanalyzer

107

2006-08-25T12:31:20.388422-0700

1936981292158005

flow

81.131.67.131

41730

84.84.15.199

15492

UDP

pcapanalyzer

108

2006-08-25T12:31:20.388422-0700

113578695834437

flow

81.131.67.131

41730

213.54.85.41

6346

UDP

pcapanalyzer

109

2006-08-25T12:31:20.388422-0700

681248818571546

flow

81.131.67.131

41730

82.92.21.6

6346

UDP

pcapanalyzer

110

2006-08-25T12:31:20.388422-0700

1949597758365435

flow

81.131.67.131

2815

80.186.123.15

6346

TCP

pcapanalyzer

111

2006-08-25T12:31:20.388422-0700

824971309291789

flow

81.131.67.131

41730

68.6.198.57

6347

UDP

pcapanalyzer

112

2006-08-25T12:31:20.388422-0700

1959130437443202

flow

81.131.67.131

41730

62.193.101.150

6346

UDP

pcapanalyzer

113

2006-08-25T12:31:20.388422-0700

580901208338517

flow

81.131.67.131

41730

82.53.134.82

6347

UDP

pcapanalyzer

114

2006-08-25T12:31:20.388422-0700

1855963182053376

flow

81.131.67.131

41730

81.11.204.41

6346

UDP

pcapanalyzer

115

2006-08-25T12:31:20.388422-0700

454831027171090

flow

81.131.67.131

41730

84.56.231.176

6346

UDP

pcapanalyzer

116

2006-08-25T12:31:20.388422-0700

1442529623862299

flow

81.131.67.131

41730

80.171.9.79

6346

UDP

pcapanalyzer

117

2006-08-25T12:31:20.388422-0700

1306976161205418

flow

81.131.67.131

41730

82.216.238.111

28046

UDP

pcapanalyzer

118

2006-08-25T12:31:20.388422-0700

340275659537033

flow

81.131.67.131

41730

84.149.148.25

6346

UDP

pcapanalyzer

119

2006-08-25T12:31:20.388422-0700

1623257559051300

flow

81.131.67.131

41730

81.133.140.169

6346

UDP

pcapanalyzer

120

2006-08-25T12:31:20.388422-0700

1393923485301495

flow

81.131.67.131

41730

84.190.183.182

6347

UDP

pcapanalyzer

File 670

Showing 181-200 of 670 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

181

2011-09-23T13:12:10.207998-0700

66.147.240.170

172.16.0.2

/horde/dimp/themes/graphics/dimp.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

334

182

2011-09-23T13:12:10.280095-0700

66.147.240.170

172.16.0.2

/horde/ingo/themes/graphics/ingo.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

155

183

2011-09-23T13:12:10.280205-0700

66.147.240.170

192.168.43.244

/horde/ingo/themes/graphics/ingo.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

155

184

2011-09-23T13:12:16.046864-0700

66.147.240.170

172.16.0.2

/horde/imp/js/redbox.js

ASCII text, with very long lines, with no line terminators

1980

185

2011-09-23T13:12:16.050017-0700

66.147.240.170

172.16.0.2

/horde/imp/themes/graphics/folders/folder_open.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

333

186

2011-09-23T13:12:12.050359-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/search.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

795

187

2011-09-23T13:12:10.821816-0700

66.147.240.170

172.16.0.2

/horde/kronolith/themes/graphics/kronolith.png

PNG image data, 16 x 16, 8-bit grayscale, non-interlaced

241

188

2011-09-23T13:12:12.051043-0700

66.147.240.170

192.168.43.244

/horde/imp/themes/graphics/folders/inbox.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

334

189

2011-09-23T13:12:10.821961-0700

66.147.240.170

192.168.43.244

/horde/kronolith/themes/graphics/kronolith.png

PNG image data, 16 x 16, 8-bit grayscale, non-interlaced

241

190

2011-09-23T13:12:10.822436-0700

66.147.240.170

172.16.0.2

/horde/mnemo/themes/graphics/mnemo.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

564

191

2011-09-23T13:12:16.696729-0700

66.147.240.170

172.16.0.2

/horde/imp/themes/graphics/filters.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

152

192

2011-09-23T13:12:12.164798-0700

66.147.240.170

192.168.43.244

/horde/imp/themes/graphics/folders/folder.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

368

193

2011-09-23T13:12:10.825205-0700

66.147.240.170

172.16.0.2

/horde/turba/themes/graphics/turba.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

393

194

2011-09-23T13:12:12.210253-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/plusbottom.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

214

195

2011-09-23T13:12:16.697281-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/az.png

PNG image data, 9 x 9, 2-bit colormap, non-interlaced

117

196

2011-09-23T13:12:12.666234-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/plus.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

213

197

2011-09-23T13:12:12.666293-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/line.png

PNG image data, 20 x 20, 1-bit colormap, interlaced

173

198

2011-09-23T13:12:12.666397-0700

66.147.240.170

192.168.43.244

/horde/turba/themes/graphics/menu/new.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

452

199

2011-09-23T13:12:12.729498-0700

66.147.240.170

192.168.43.244

/horde/kronolith/themes/graphics/new.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

501

200

2011-09-23T13:12:13.279127-0700

66.147.240.170

192.168.43.244

/horde/kronolith/themes/graphics/workweekview.png

PNG image data, 16 x 16, 8-bit grayscale, non-interlaced

223

Comments	(not set)

Update Download PCAP Delete