merged.pcap

MD5	1cd1ea56484846142e58015720fa6d34
Submission Date	2021-11-22 18:29:01
Tags	(not set)

Alert 35

Showing 1-20 of 35 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

2005-01-14T09:58:08.905094-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:14.907941-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:20.913970-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-05-06T02:42:14.364705-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2005-05-06T02:43:13.717249-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2006-08-25T12:36:08.782873-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:32:21.808007-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:34:05.096863-0700

192.168.1.2

69.114.183.8

ET P2P Kazaa over UDP

2011-09-23T13:11:59.760293-0700

172.16.0.2

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2011-09-23T13:11:59.760432-0700

192.168.43.244

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2017-07-02T15:20:34.110081-0700

192.168.0.106

255.255.255.255

ET POLICY Dropbox Client Broadcasting

2017-07-02T15:20:24.944089-0700

192.168.0.106

109.173.11.109

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:37.241599-0700

10.21.1.45

46.10.22.5

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:57.053088-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:42.881285-0700

10.21.1.88

216.58.202.14

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:43.231299-0700

10.21.1.88

172.217.29.132

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:47.291301-0700

10.21.1.88

110.52.23.134

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:36.788379-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:56:03.244116-0700

10.21.1.88

172.217.29.142

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:34:37.049607-0700

10.21.1.45

172.217.30.100

ET POLICY Python-urllib/ Suspicious User Agent

DNS 1374

Showing 1-20 of 1,374 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2005-07-16T07:29:32.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:33.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.753125-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:36.441602-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:37.271680-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2006-08-25T12:32:21.664799-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

(not set)

2006-08-25T12:32:21.664914-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:21.698599-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

(not set)

2006-08-25T12:32:23.172938-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:23.994435-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:24.673656-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:25.009057-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.174411-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663468-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663826-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:27.152203-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:31:06.890652-0700

192.168.1.2

192.168.1.1

query

2.1.168.192.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.890808-0700

192.168.1.2

192.168.1.1

query

114.214.204.212.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.924944-0700

192.168.1.1

192.168.1.2

answer

2.1.168.192.in-addr.arpa

PTR

(not set)

TLS 64

Showing 1-20 of 64 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2017-07-02T15:20:34.279553-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:33.559648-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:36.867925-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:34.387320-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:35.427278-0700

192.168.0.106

172.217.29.238

TLS 1.2

translate.google.com

2017-07-02T15:20:35.630035-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:37.615894-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:37.624410-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:38.535015-0700

192.168.0.106

52.17.122.61

TLS 1.2

location.services.mozilla.com

2017-07-02T15:20:37.411042-0700

192.168.0.106

172.217.29.100

TLS 1.2

www.google.com

2017-07-02T15:20:37.605273-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:40.202010-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:41.271164-0700

192.168.0.106

52.39.237.157

TLS 1.2

self-repair.mozilla.org

2017-07-02T15:20:38.534966-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:41.836615-0700

192.168.0.106

54.192.227.96

TLS 1.2

normandy-cloudfront.cdn.mozilla.net

2017-07-02T15:21:03.457984-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:04.527394-0700

192.168.0.106

172.217.29.99

TLS 1.2

www.gstatic.com

2017-07-02T15:21:19.971634-0700

192.168.0.106

172.217.29.110

TLS 1.2

sb-ssl.google.com

2017-07-02T15:21:03.143734-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:03.376975-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

TFTP 1

Showing 1-1 of 1 item.

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
1	2013-05-01T05:24:11.972852-0700	192.168.0.253	192.168.0.10	read	rfc1350.txt	octet

HTTP 670

Showing 1-20 of 670 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2005-01-14T09:58:05.638272-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444067-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444203-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.324482-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.756923-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.945685-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945728-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945874-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.444128-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.712327-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.830220-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845352-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.945802-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:05.838948-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.854970-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:07.711059-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:07.845409-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:10.916214-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

2005-01-14T09:58:11.055661-0800

200.57.7.204

200.57.7.194

GET

/cems/META-INF/services/javax.xml.parsers.SAXParserFactory

403

2005-01-14T09:58:16.116227-0800

200.57.7.204

200.57.7.194

POST

/cems/applets/serviceRouter

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 5

Showing 1-5 of 5 items.

Timestamp

Source

Destination

Email From

Email To

Subject

2013-08-22T12:17:56.649185-0700

192.168.0.4

212.227.15.167

DI <digitalinvestigator@networksims.com>

w.buchanan@napier.ac.uk

Testing

2014-01-06T13:20:26.759146-0800

192.168.47.171

192.168.47.134

"Bill" <w.buchanan@napier.ac.uk>

<test@home.com>

Test

2015-12-29T11:13:51.630178-0800

172.16.16.221

172.16.16.231

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2015-12-29T11:14:08.908722-0800

172.16.16.225

172.16.16.221

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2017-07-02T15:20:34.040092-0700

172.16.16.225

172.16.16.221

(not set)

Flow 1143

Showing 1-20 of 1,143 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2002-07-25T23:19:03.543641-0700

47072469784406

flow

10.1.3.143

5000

10.1.6.18

2006

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

161030837428135

flow

10.1.6.18

2007

10.1.3.143

5001

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

47072469838750

flow

10.1.6.18

2006

10.1.3.143

5000

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

1672288094489009

flow

10.1.3.143

32803

10.1.6.18

1720

TCP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

2108609527171034

flow

10.1.3.143

32804

10.1.6.18

1232

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

140879359696387

flow

200.57.7.204

4338

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2113396778721426

flow

200.57.7.202

30000

200.57.7.196

40362

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

990073852147903

flow

200.57.7.204

4573

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1694087709946134

flow

200.57.7.197

2428

200.57.7.199

2424

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1413372943574856

flow

200.57.7.205

4314

200.73.183.213

110

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

991209869738086

flow

200.57.7.204

4558

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1977435293762074

flow

200.57.7.204

1047

207.46.107.165

1863

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

713703442857994

flow

200.57.7.204

4565

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

16550794046159

flow

200.57.7.195

2427

200.57.7.202

9693

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

16576563584556

flow

200.57.7.204

4559

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2133007598353108

flow

200.57.7.195

200.57.7.205

3432

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1571421296763843

flow

200.57.7.204

4563

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1011138518113258

flow

200.57.7.204

4218

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1856065959173428

flow

200.57.7.204

4556

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1293255592435337

flow

200.57.7.204

4372

200.57.7.194

TCP

pcapanalyzer

File 670

Showing 161-180 of 670 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

161

2011-09-23T13:12:11.436278-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/show_panel.png

PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced

404

162

2011-09-23T13:12:09.592988-0700

66.147.240.170

192.168.43.244

/horde/mnemo/themes/screen.css

ASCII text

3618

163

2011-09-23T13:12:11.436439-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/show_panel.png

PNG image data, 16 x 16, 8-bit/color RGB, non-interlaced

404

164

2011-09-23T13:12:11.438538-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/tree/blank.png

PNG image data, 20 x 20, 1-bit colormap, interlaced

150

165

2011-09-23T13:12:11.437594-0700

66.147.240.170

192.168.43.244

/horde/imp/themes/graphics/newmail.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

554

166

2011-09-23T13:12:09.593847-0700

66.147.240.170

172.16.0.2

/horde/mnemo/themes/bluewhite/screen.css

ASCII text

135

167

2011-09-23T13:12:11.438672-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/blank.png

PNG image data, 20 x 20, 1-bit colormap, interlaced

150

168

2011-09-23T13:12:09.594257-0700

66.147.240.170

172.16.0.2

/horde/turba/themes/bluewhite/screen.css

ASCII text

135

169

2011-09-23T13:12:12.050932-0700

66.147.240.170

172.16.0.2

/horde/imp/themes/graphics/folders/inbox.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

334

170

2011-09-23T13:12:12.210138-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/tree/plusbottom.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

214

171

2011-09-23T13:12:12.666066-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/tree/line.png

PNG image data, 20 x 20, 1-bit colormap, interlaced

173

172

2011-09-23T13:12:12.729390-0700

66.147.240.170

172.16.0.2

/horde/kronolith/themes/graphics/new.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

501

173

2011-09-23T13:12:13.279025-0700

66.147.240.170

172.16.0.2

/horde/kronolith/themes/graphics/weekview.png

PNG image data, 16 x 16, 8-bit grayscale, non-interlaced

213

174

2011-09-23T13:12:13.396296-0700

66.147.240.170

172.16.0.2

/horde/nag/themes/graphics/add.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

592

175

2011-09-23T13:12:13.889719-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/logout.png

PNG image data, 16 x 16, 8-bit colormap, non-interlaced

385

176

2011-09-23T13:12:09.669326-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/tree/plusonly.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

213

177

2011-09-23T13:12:09.669451-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/plusonly.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

213

178

2011-09-23T13:12:10.206755-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/tree/nullonly.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

201

179

2011-09-23T13:12:10.206888-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/tree/nullonly.png

PNG image data, 20 x 20, 2-bit colormap, interlaced

201

180

2011-09-23T13:12:10.207965-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/horde.png

PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced

488

Comments	(not set)

Update Download PCAP Delete