merged.pcap

MD5	1cd1ea56484846142e58015720fa6d34
Submission Date	2021-11-22 18:29:01
Tags	(not set)

Alert 35

Showing 1-20 of 35 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

2005-01-14T09:58:08.905094-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:14.907941-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:20.913970-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-05-06T02:42:14.364705-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2005-05-06T02:43:13.717249-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2006-08-25T12:36:08.782873-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:32:21.808007-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:34:05.096863-0700

192.168.1.2

69.114.183.8

ET P2P Kazaa over UDP

2011-09-23T13:11:59.760293-0700

172.16.0.2

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2011-09-23T13:11:59.760432-0700

192.168.43.244

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2017-07-02T15:20:34.110081-0700

192.168.0.106

255.255.255.255

ET POLICY Dropbox Client Broadcasting

2017-07-02T15:20:24.944089-0700

192.168.0.106

109.173.11.109

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:37.241599-0700

10.21.1.45

46.10.22.5

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:57.053088-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:42.881285-0700

10.21.1.88

216.58.202.14

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:43.231299-0700

10.21.1.88

172.217.29.132

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:47.291301-0700

10.21.1.88

110.52.23.134

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:36.788379-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:56:03.244116-0700

10.21.1.88

172.217.29.142

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:34:37.049607-0700

10.21.1.45

172.217.30.100

ET POLICY Python-urllib/ Suspicious User Agent

DNS 1374

Showing 1-20 of 1,374 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2005-07-16T07:29:32.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:33.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.753125-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:36.441602-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:37.271680-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2006-08-25T12:32:21.664799-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

(not set)

2006-08-25T12:32:21.664914-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:21.698599-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

(not set)

2006-08-25T12:32:23.172938-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:23.994435-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:24.673656-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:25.009057-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.174411-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663468-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663826-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:27.152203-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:31:06.890652-0700

192.168.1.2

192.168.1.1

query

2.1.168.192.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.890808-0700

192.168.1.2

192.168.1.1

query

114.214.204.212.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.924944-0700

192.168.1.1

192.168.1.2

answer

2.1.168.192.in-addr.arpa

PTR

(not set)

TLS 64

Showing 1-20 of 64 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2017-07-02T15:20:34.279553-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:33.559648-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:36.867925-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:34.387320-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:35.427278-0700

192.168.0.106

172.217.29.238

TLS 1.2

translate.google.com

2017-07-02T15:20:35.630035-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:37.615894-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:37.624410-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:38.535015-0700

192.168.0.106

52.17.122.61

TLS 1.2

location.services.mozilla.com

2017-07-02T15:20:37.411042-0700

192.168.0.106

172.217.29.100

TLS 1.2

www.google.com

2017-07-02T15:20:37.605273-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:40.202010-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:41.271164-0700

192.168.0.106

52.39.237.157

TLS 1.2

self-repair.mozilla.org

2017-07-02T15:20:38.534966-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:41.836615-0700

192.168.0.106

54.192.227.96

TLS 1.2

normandy-cloudfront.cdn.mozilla.net

2017-07-02T15:21:03.457984-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:04.527394-0700

192.168.0.106

172.217.29.99

TLS 1.2

www.gstatic.com

2017-07-02T15:21:19.971634-0700

192.168.0.106

172.217.29.110

TLS 1.2

sb-ssl.google.com

2017-07-02T15:21:03.143734-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:03.376975-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

TFTP 1

Showing 1-1 of 1 item.

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
1	2013-05-01T05:24:11.972852-0700	192.168.0.253	192.168.0.10	read	rfc1350.txt	octet

HTTP 670

Showing 1-20 of 670 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2005-01-14T09:58:05.638272-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444067-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444203-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.324482-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.756923-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.945685-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945728-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945874-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444128-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.712327-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.830220-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845352-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945802-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.838948-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.854970-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.711059-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845409-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.916214-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:11.055661-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:16.116227-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 5

Showing 1-5 of 5 items.

Timestamp

Source

Destination

Email From

Email To

Subject

2013-08-22T12:17:56.649185-0700

192.168.0.4

212.227.15.167

DI <digitalinvestigator@networksims.com>

w.buchanan@napier.ac.uk

Testing

2014-01-06T13:20:26.759146-0800

192.168.47.171

192.168.47.134

"Bill" <w.buchanan@napier.ac.uk>

<test@home.com>

Test

2015-12-29T11:13:51.630178-0800

172.16.16.221

172.16.16.231

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2015-12-29T11:14:08.908722-0800

172.16.16.225

172.16.16.221

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2017-07-02T15:20:34.040092-0700

172.16.16.225

172.16.16.221

(not set)

Flow 1143

Showing 201-220 of 1,143 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

201

2006-08-25T12:31:20.388422-0700

2140032312592074

flow

81.131.67.131

41730

82.10.189.102

6346

UDP

pcapanalyzer

202

2006-08-25T12:31:20.388422-0700

32232014767216

flow

81.131.67.131

41730

212.194.202.220

6346

UDP

pcapanalyzer

203

2006-08-25T12:31:20.388422-0700

1442529632990691

flow

81.131.67.131

41730

80.171.9.79

6346

UDP

pcapanalyzer

204

2006-08-25T12:31:20.388422-0700

1585113956793383

flow

81.131.67.131

41730

81.178.122.194

18035

UDP

pcapanalyzer

205

2006-08-25T12:31:20.388422-0700

1585470430215653

flow

81.131.67.131

6348

68.45.204.224

6346

UDP

pcapanalyzer

206

2006-08-25T12:31:20.388422-0700

1304126458385511

flow

81.131.67.131

41730

219.149.233.209

6346

UDP

pcapanalyzer

207

2006-08-25T12:31:20.388422-0700

1587117559021342

flow

83.192.41.164

6346

81.131.67.131

41730

UDP

pcapanalyzer

208

2006-08-25T12:31:20.388422-0700

1165152053935588

flow

81.131.67.131

41730

62.195.221.46

6346

UDP

pcapanalyzer

209

2006-08-25T12:31:20.388422-0700

1588053853253394

flow

81.131.67.131

41730

62.205.109.173

6346

UDP

pcapanalyzer

210

2006-08-25T12:31:20.388422-0700

746815789330943

flow

81.131.67.131

41730

213.224.41.203

6346

UDP

pcapanalyzer

211

2006-08-25T12:31:20.388422-0700

606220042385398

flow

81.131.67.131

41730

82.120.166.143

15219

UDP

pcapanalyzer

212

2006-08-25T12:31:20.388422-0700

324800900193607

flow

218.83.155.75

50303

81.131.67.131

1026

UDP

pcapanalyzer

213

2006-08-25T12:31:20.388422-0700

1732742718546529

flow

81.229.210.114

6346

81.131.67.131

41730

UDP

pcapanalyzer

214

2006-08-25T12:31:20.388422-0700

185959632432145

flow

81.131.67.131

41730

80.125.99.71

6346

UDP

pcapanalyzer

215

2006-08-25T12:31:20.388422-0700

187014052786706

flow

81.131.67.131

41730

83.203.140.221

6346

UDP

pcapanalyzer

216

2006-08-25T12:31:20.388422-0700

47519959648042

flow

81.131.67.131

41730

83.116.155.57

6346

UDP

pcapanalyzer

217

2006-08-25T12:31:20.388422-0700

1736457864404305

flow

84.159.23.80

62082

81.131.67.131

41730

UDP

pcapanalyzer

218

2006-08-25T12:31:20.388422-0700

1877841739719913

flow

81.131.67.131

41730

84.101.247.219

6346

UDP

pcapanalyzer

219

2006-08-25T12:31:20.388422-0700

1738083503131832

flow

81.131.67.131

41730

85.96.110.115

6346

UDP

pcapanalyzer

220

2006-08-25T12:31:20.388422-0700

2020988710634577

flow

213.22.134.120

19408

81.131.67.131

41730

UDP

pcapanalyzer

File 670

Showing 21-40 of 670 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2005-01-14T09:58:07.711059-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

5560

2005-01-14T09:58:07.845409-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:10.910334-0800

200.57.7.204

200.57.7.194

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

292

2005-01-14T09:58:10.916214-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

4748

2005-01-14T09:58:11.055661-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:16.112626-0800

200.57.7.204

200.57.7.194

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

292

2005-01-14T09:58:16.116227-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

4748

2005-01-14T09:58:16.272325-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:16.071665-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:21.273434-0800

200.57.7.204

200.57.7.194

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

292

2005-01-14T09:58:21.314567-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

4748

2005-01-14T09:58:21.327794-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:21.288394-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:26.500827-0800

200.57.7.204

200.57.7.194

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

292

2005-01-14T09:58:26.505108-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:26.520837-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

4748

2005-01-14T09:58:26.705737-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:36.838213-0800

200.57.7.194

200.57.7.204

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

HTML document, ASCII text

1157

2005-01-14T09:58:31.713280-0800

200.57.7.204

200.57.7.194

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

292

2005-01-14T09:58:31.716990-0800

200.57.7.194

200.57.7.204

/cems/applets/serviceRouter

XML 1.0 document, ASCII text, with CRLF, LF line terminators

4748

Comments	(not set)

Update Download PCAP Delete