merged.pcap

MD5	1cd1ea56484846142e58015720fa6d34
Submission Date	2021-11-22 18:29:01
Tags	(not set)

Alert 35

Showing 1-20 of 35 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

2005-01-14T09:58:08.905094-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:14.907941-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:20.913970-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-05-06T02:42:14.364705-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2005-05-06T02:43:13.717249-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2006-08-25T12:36:08.782873-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:32:21.808007-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:34:05.096863-0700

192.168.1.2

69.114.183.8

ET P2P Kazaa over UDP

2011-09-23T13:11:59.760293-0700

172.16.0.2

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2011-09-23T13:11:59.760432-0700

192.168.43.244

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2017-07-02T15:20:34.110081-0700

192.168.0.106

255.255.255.255

ET POLICY Dropbox Client Broadcasting

2017-07-02T15:20:24.944089-0700

192.168.0.106

109.173.11.109

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:37.241599-0700

10.21.1.45

46.10.22.5

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:57.053088-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:42.881285-0700

10.21.1.88

216.58.202.14

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:43.231299-0700

10.21.1.88

172.217.29.132

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:47.291301-0700

10.21.1.88

110.52.23.134

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:36.788379-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:56:03.244116-0700

10.21.1.88

172.217.29.142

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:34:37.049607-0700

10.21.1.45

172.217.30.100

ET POLICY Python-urllib/ Suspicious User Agent

DNS 1374

Showing 181-200 of 1,374 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

181

2006-08-25T12:32:23.142566-0700

192.168.1.2

192.168.1.1

query

b-248-49.dsl.kpy.customers.dnainternet.fi

(not set)

182

2006-08-25T12:32:23.142598-0700

192.168.1.2

192.168.1.1

query

cpe-66-67-61-44.rochester.res.rr.com

(not set)

183

2006-08-25T12:32:23.142633-0700

192.168.1.2

192.168.1.1

query

student-halls-boddington-pc125-169.leeds.ac.uk

(not set)

184

2006-08-25T12:32:23.142666-0700

192.168.1.2

192.168.1.1

query

CPE0016ec35ac27-CM00159a41912e.cpe.net.cable.rogers.com

(not set)

185

2006-08-25T12:32:23.142698-0700

192.168.1.2

192.168.1.1

query

c-24-61-5-13.hsd1.ma.comcast.net

(not set)

186

2006-08-25T12:32:23.142730-0700

192.168.1.2

192.168.1.1

query

adsl-145-3-159.mia.bellsouth.net

(not set)

187

2006-08-25T12:32:23.148362-0700

192.168.1.1

192.168.1.2

answer

ip-83-147-171-206.lmk.metro.digiweb.ie

(not set)

188

2006-08-25T12:32:23.151537-0700

192.168.1.1

192.168.1.2

answer

lns-bzn-30-82-253-163-244.adsl.proxad.net

(not set)

189

2006-08-25T12:32:23.154559-0700

192.168.1.1

192.168.1.2

answer

ACCFBED9.ipt.aol.com

(not set)

190

2006-08-25T12:32:23.157689-0700

192.168.1.1

192.168.1.2

answer

aapm219.neoplus.adsl.tpnet.pl

(not set)

191

2006-08-25T12:32:23.160889-0700

192.168.1.1

192.168.1.2

answer

IGLD-83-130-238-168.inter.net.il

(not set)

192

2006-08-25T12:32:23.163933-0700

192.168.1.1

192.168.1.2

answer

cpe-24-242-109-92.sport.res.rr.com

(not set)

193

2006-08-25T12:32:23.167232-0700

192.168.1.1

192.168.1.2

answer

c-67-190-60-125.hsd1.co.comcast.net

(not set)

194

2006-08-25T12:32:23.170486-0700

192.168.1.1

192.168.1.2

answer

b-248-49.dsl.kpy.customers.dnainternet.fi

(not set)

195

2006-08-25T12:32:23.174175-0700

192.168.1.1

192.168.1.2

answer

cpe-66-67-61-44.rochester.res.rr.com

(not set)

196

2006-08-25T12:32:23.177409-0700

192.168.1.1

192.168.1.2

answer

student-halls-boddington-pc125-169.leeds.ac.uk

(not set)

197

2006-08-25T12:32:23.180891-0700

192.168.1.1

192.168.1.2

answer

CPE0016ec35ac27-CM00159a41912e.cpe.net.cable.rogers.com

(not set)

198

2006-08-25T12:32:23.184059-0700

192.168.1.1

192.168.1.2

answer

c-24-61-5-13.hsd1.ma.comcast.net

(not set)

199

2006-08-25T12:32:23.187432-0700

192.168.1.1

192.168.1.2

answer

adsl-145-3-159.mia.bellsouth.net

(not set)

200

2006-08-25T12:32:23.190774-0700

192.168.1.1

192.168.1.2

answer

82.221.107.24.in-addr.arpa

PTR

(not set)

TLS 64

Showing 1-20 of 64 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2017-07-02T15:20:34.279553-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:33.559648-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:36.867925-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:34.387320-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:35.427278-0700

192.168.0.106

172.217.29.238

TLS 1.2

translate.google.com

2017-07-02T15:20:35.630035-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:37.615894-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:37.624410-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:38.535015-0700

192.168.0.106

52.17.122.61

TLS 1.2

location.services.mozilla.com

2017-07-02T15:20:37.411042-0700

192.168.0.106

172.217.29.100

TLS 1.2

www.google.com

2017-07-02T15:20:37.605273-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:40.202010-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:41.271164-0700

192.168.0.106

52.39.237.157

TLS 1.2

self-repair.mozilla.org

2017-07-02T15:20:38.534966-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:41.836615-0700

192.168.0.106

54.192.227.96

TLS 1.2

normandy-cloudfront.cdn.mozilla.net

2017-07-02T15:21:03.457984-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:04.527394-0700

192.168.0.106

172.217.29.99

TLS 1.2

www.gstatic.com

2017-07-02T15:21:19.971634-0700

192.168.0.106

172.217.29.110

TLS 1.2

sb-ssl.google.com

2017-07-02T15:21:03.143734-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:03.376975-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

TFTP 1

Showing 1-1 of 1 item.

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
1	2013-05-01T05:24:11.972852-0700	192.168.0.253	192.168.0.10	read	rfc1350.txt	octet

HTTP 670

Showing 121-140 of 670 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

121

2011-09-23T13:12:08.057382-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/login.php?frameset_loaded=1

200

122

2011-09-23T13:12:08.057514-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/services/javascript.php?file=tree.js&app=horde

200

123

2011-09-23T13:12:08.669845-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/imp/themes/screen.css

200

124

2011-09-23T13:12:09.594238-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/turba/themes/screen.css

200

125

2011-09-23T13:12:09.010240-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/kronolith/themes/screen.css

200

126

2011-09-23T13:12:08.669986-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/imp/themes/screen.css

200

127

2011-09-23T13:12:09.612845-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/js/popup.js

200

128

2011-09-23T13:12:09.019992-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/kronolith/themes/bluewhite/screen.css

200

129

2011-09-23T13:12:08.976589-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/imp/themes/bluewhite/screen.css

200

130

2011-09-23T13:12:10.207982-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/imp/themes/graphics/imp.png

200

131

2011-09-23T13:12:09.070739-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/ingo/themes/screen.css

200

132

2011-09-23T13:12:08.976734-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/imp/themes/bluewhite/screen.css

200

133

2011-09-23T13:12:09.131542-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/nag/themes/screen.css

200

134

2011-09-23T13:12:09.010112-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/kronolith/themes/screen.css

200

135

2011-09-23T13:12:10.211389-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/mimp/themes/graphics/mimp.png

200

136

2011-09-23T13:12:09.594200-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/mnemo/themes/bluewhite/screen.css

200

137

2011-09-23T13:12:10.824160-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/nag/themes/graphics/nag.png

200

138

2011-09-23T13:12:09.070603-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/ingo/themes/screen.css

200

139

2011-09-23T13:12:09.594322-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/turba/themes/screen.css

200

140

2011-09-23T13:12:10.825773-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/themes/graphics/prefs.png

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 5

Showing 1-5 of 5 items.

Timestamp

Source

Destination

Email From

Email To

Subject

2013-08-22T12:17:56.649185-0700

192.168.0.4

212.227.15.167

DI <digitalinvestigator@networksims.com>

w.buchanan@napier.ac.uk

Testing

2014-01-06T13:20:26.759146-0800

192.168.47.171

192.168.47.134

"Bill" <w.buchanan@napier.ac.uk>

<test@home.com>

Test

2015-12-29T11:13:51.630178-0800

172.16.16.221

172.16.16.231

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2015-12-29T11:14:08.908722-0800

172.16.16.225

172.16.16.221

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2017-07-02T15:20:34.040092-0700

172.16.16.225

172.16.16.221

(not set)

Flow 1143

Showing 1-20 of 1,143 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2002-07-25T23:19:03.543641-0700

47072469784406

flow

10.1.3.143

5000

10.1.6.18

2006

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

161030837428135

flow

10.1.6.18

2007

10.1.3.143

5001

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

47072469838750

flow

10.1.6.18

2006

10.1.3.143

5000

UDP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

1672288094489009

flow

10.1.3.143

32803

10.1.6.18

1720

TCP

pcapanalyzer

2005-01-14T09:58:05.638272-0800

2108609527171034

flow

10.1.3.143

32804

10.1.6.18

1232

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

140879359696387

flow

200.57.7.204

4338

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2113396778721426

flow

200.57.7.202

30000

200.57.7.196

40362

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

990073852147903

flow

200.57.7.204

4573

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1694087709946134

flow

200.57.7.197

2428

200.57.7.199

2424

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1413372943574856

flow

200.57.7.205

4314

200.73.183.213

110

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

991209869738086

flow

200.57.7.204

4558

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1977435293762074

flow

200.57.7.204

1047

207.46.107.165

1863

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

713703442857994

flow

200.57.7.204

4565

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

16550794046159

flow

200.57.7.195

2427

200.57.7.202

9693

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

16576563584556

flow

200.57.7.204

4559

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2133007598353108

flow

200.57.7.195

200.57.7.205

3432

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1571421296763843

flow

200.57.7.204

4563

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1011138518113258

flow

200.57.7.204

4218

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1856065959173428

flow

200.57.7.204

4556

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1293255592435337

flow

200.57.7.204

4372

200.57.7.194

TCP

pcapanalyzer

File 670

Showing 61-80 of 670 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2011-09-23T13:11:46.657458-0700

66.147.240.170

192.168.43.244

/webmail/x3/images/squirrelmail_logo.gif

GIF image data, version 89a, 150 x 48

3511

2011-09-23T13:11:40.304158-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1314051899/webmail/hostmonster/css/combined_optimized.css

ASCII text, with very long lines, with no line terminators

30147

2006-08-25T12:32:21.808007-0700

212.72.49.131

192.168.1.2

/ui/2/1.2.0.18/en/getlatestversion

ASCII text, with no line terminators

2011-09-23T13:11:41.328832-0700

66.147.240.170

172.16.0.2

/webmail/x3/images/horde.gif

GIF image data, version 89a, 133 x 45

1579

2011-09-23T13:11:44.711177-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1296095636/yui/utilities_container/utilities_container.js

ASCII text, with very long lines

199226

2011-09-23T13:11:44.711369-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1296095636/yui/utilities_container/utilities_container.js

ASCII text, with very long lines

199226

2011-09-23T13:11:47.169140-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_7645080595.11748/branding/hostmonster/heading_sprites_bg_snap_to_smallest_width.png

PNG image data, 11 x 138, 8-bit/color RGB, interlaced

2669

2011-09-23T13:11:47.621005-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1181099244/webmail/hostmonster/branding/responder.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 299x299, segment length 16, baseline, precision 8, 32x32, frames 3

685

2011-09-23T13:11:47.649413-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_48139483185.8516/branding/hostmonster/heading_sprites_img.png

PNG image data, 35 x 222, 8-bit/color RGB, interlaced

3500

2011-09-23T13:11:52.433168-0700

66.147.240.170

172.16.0.2

/horde/login.php

HTML document, UTF-8 Unicode text, with very long lines

8124

2011-09-23T13:11:53.009867-0700

66.147.240.170

172.16.0.2

/horde/js/accesskeys.js

ASCII text, with very long lines, with no line terminators

1066

2011-09-23T13:11:53.009973-0700

66.147.240.170

192.168.43.244

/horde/js/accesskeys.js

ASCII text, with very long lines, with no line terminators

1066

2011-09-23T13:11:53.030228-0700

66.147.240.170

172.16.0.2

/horde/js/horde.js

ASCII text, with very long lines, with no line terminators

4086

2011-09-23T13:11:53.030336-0700

66.147.240.170

192.168.43.244

/horde/js/horde.js

ASCII text, with very long lines, with no line terminators

4086

2011-09-23T13:11:45.538982-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1181099247/webmail/hostmonster/branding/password.jpg

JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 32x32, frames 3

1263

2011-09-23T13:11:45.624509-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1181099245/webmail/hostmonster/branding/manageaccounts.gif

GIF image data, version 89a, 32 x 32

1639

2011-09-23T13:11:53.060640-0700

66.147.240.170

172.16.0.2

/horde/themes/screen.css

assembler source, ASCII text

15857

2011-09-23T13:11:45.624614-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1181099245/webmail/hostmonster/branding/manageaccounts.gif

GIF image data, version 89a, 32 x 32

1639

2011-09-23T13:11:46.103735-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1181099244/webmail/hostmonster/branding/emailroute.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 32x32, frames 3

741

2011-09-23T13:11:46.103843-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1181099244/webmail/hostmonster/branding/emailroute.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 32x32, frames 3

741

Comments	(not set)

Update Download PCAP Delete