merged.pcap

MD5	1cd1ea56484846142e58015720fa6d34
Submission Date	2021-11-22 18:29:01
Tags	(not set)

Alert 35

Showing 1-20 of 35 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

2005-01-14T09:58:08.905094-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:14.907941-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-01-14T09:58:20.913970-0800

200.57.7.205

10.52.10.15

GPL SNMP public access udp

2005-05-06T02:42:14.364705-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2005-05-06T02:43:13.717249-0700

192.168.1.14

207.46.108.59

GPL CHAT MSN user search

2006-08-25T12:36:08.782873-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:32:21.808007-0700

192.168.1.2

212.72.49.131

ET CHAT Skype VOIP Checking Version (Startup)

2006-08-25T12:34:05.096863-0700

192.168.1.2

69.114.183.8

ET P2P Kazaa over UDP

2011-09-23T13:11:59.760293-0700

172.16.0.2

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2011-09-23T13:11:59.760432-0700

192.168.43.244

66.147.240.170

ET POLICY HTTP POST contains pass= in cleartext

2017-07-02T15:20:34.110081-0700

192.168.0.106

255.255.255.255

ET POLICY Dropbox Client Broadcasting

2017-07-02T15:20:24.944089-0700

192.168.0.106

109.173.11.109

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:37.241599-0700

10.21.1.45

46.10.22.5

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:57.053088-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:42.881285-0700

10.21.1.88

216.58.202.14

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:43.231299-0700

10.21.1.88

172.217.29.132

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:55:47.291301-0700

10.21.1.88

110.52.23.134

ET P2P BitTorrent DHT ping request

2018-08-13T06:34:36.788379-0700

10.21.1.45

172.217.30.110

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:56:03.244116-0700

10.21.1.88

172.217.29.142

ET POLICY Python-urllib/ Suspicious User Agent

2018-08-13T06:34:37.049607-0700

10.21.1.45

172.217.30.100

ET POLICY Python-urllib/ Suspicious User Agent

DNS 1374

Showing 1-20 of 1,374 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2005-07-16T07:29:32.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:33.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.596875-0700

81.131.67.131

213.120.62.99

query

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:34.753125-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:36.441602-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2005-07-16T07:29:37.271680-0700

213.120.62.99

81.131.67.131

answer

ftp.ipv6.uni-leipzig.de

AAAA

(not set)

2006-08-25T12:32:21.664799-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

(not set)

2006-08-25T12:32:21.664914-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:21.698599-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

(not set)

2006-08-25T12:32:23.172938-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:23.994435-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:24.673656-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:25.009057-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.174411-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663468-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:26.663826-0700

192.168.1.2

192.168.1.1

query

ui.skype.com

AAAA

(not set)

2006-08-25T12:32:27.152203-0700

192.168.1.1

192.168.1.2

answer

ui.skype.com

AAAA

(not set)

2006-08-25T12:31:06.890652-0700

192.168.1.2

192.168.1.1

query

2.1.168.192.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.890808-0700

192.168.1.2

192.168.1.1

query

114.214.204.212.in-addr.arpa

PTR

(not set)

2006-08-25T12:31:06.924944-0700

192.168.1.1

192.168.1.2

answer

2.1.168.192.in-addr.arpa

PTR

(not set)

TLS 64

Showing 1-20 of 64 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2017-07-02T15:20:34.279553-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:33.559648-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:36.867925-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:34.387320-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:35.427278-0700

192.168.0.106

172.217.29.238

TLS 1.2

translate.google.com

2017-07-02T15:20:35.630035-0700

192.168.0.106

54.187.128.85

TLS 1.2

oauth.accounts.firefox.com

2017-07-02T15:20:37.615894-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:37.624410-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:38.535015-0700

192.168.0.106

52.17.122.61

TLS 1.2

location.services.mozilla.com

2017-07-02T15:20:37.411042-0700

192.168.0.106

172.217.29.100

TLS 1.2

www.google.com

2017-07-02T15:20:37.605273-0700

192.168.0.106

54.192.226.174

TLS 1.2

snippets.cdn.mozilla.net

2017-07-02T15:20:40.202010-0700

192.168.0.106

35.160.100.86

TLS 1.2

addons.mozilla.org

2017-07-02T15:20:41.271164-0700

192.168.0.106

52.39.237.157

TLS 1.2

self-repair.mozilla.org

2017-07-02T15:20:38.534966-0700

192.168.0.106

54.69.106.30

TLS 1.2

accounts.firefox.com

2017-07-02T15:20:41.836615-0700

192.168.0.106

54.192.227.96

TLS 1.2

normandy-cloudfront.cdn.mozilla.net

2017-07-02T15:21:03.457984-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:04.527394-0700

192.168.0.106

172.217.29.99

TLS 1.2

www.gstatic.com

2017-07-02T15:21:19.971634-0700

192.168.0.106

172.217.29.110

TLS 1.2

sb-ssl.google.com

2017-07-02T15:21:03.143734-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

2017-07-02T15:21:03.376975-0700

192.168.0.106

216.58.222.42

TLS 1.2

translate.googleapis.com

TFTP 1

Showing 1-1 of 1 item.

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
1	2013-05-01T05:24:11.972852-0700	192.168.0.253	192.168.0.10	read	rfc1350.txt	octet

HTTP 670

Showing 141-160 of 670 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

141

2011-09-23T13:12:09.594375-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/turba/themes/bluewhite/screen.css

200

142

2011-09-23T13:12:09.612966-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/js/popup.js

200

143

2011-09-23T13:12:10.208105-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/themes/graphics/horde.png

200

144

2011-09-23T13:12:10.208164-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/imp/themes/graphics/imp.png

200

145

2011-09-23T13:12:10.208215-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/dimp/themes/graphics/dimp.png

200

146

2011-09-23T13:12:10.211495-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/mimp/themes/graphics/mimp.png

200

147

2011-09-23T13:12:09.181431-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/nag/themes/bluewhite/screen.css

200

148

2011-09-23T13:12:10.822553-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/mnemo/themes/graphics/mnemo.png

200

149

2011-09-23T13:12:09.181552-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/nag/themes/bluewhite/screen.css

200

150

2011-09-23T13:12:10.824275-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/nag/themes/graphics/nag.png

200

151

2011-09-23T13:12:10.825329-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/turba/themes/graphics/turba.png

200

152

2011-09-23T13:12:09.592855-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/mnemo/themes/screen.css

200

153

2011-09-23T13:12:10.825890-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/themes/graphics/prefs.png

200

154

2011-09-23T13:12:09.592988-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/mnemo/themes/screen.css

200

155

2011-09-23T13:12:11.436381-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/themes/graphics/edit.png

200

156

2011-09-23T13:12:11.436278-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/themes/graphics/show_panel.png

200

157

2011-09-23T13:12:11.436439-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/themes/graphics/show_panel.png

200

158

2011-09-23T13:12:09.593847-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/mnemo/themes/bluewhite/screen.css

200

159

2011-09-23T13:12:11.438538-0700

172.16.0.2

www.epoca2011.org

2095

GET

/horde/themes/graphics/tree/blank.png

200

160

2011-09-23T13:12:11.437594-0700

192.168.43.244

www.epoca2011.org

2095

GET

/horde/imp/themes/graphics/newmail.png

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 5

Showing 1-5 of 5 items.

Timestamp

Source

Destination

Email From

Email To

Subject

2013-08-22T12:17:56.649185-0700

192.168.0.4

212.227.15.167

DI <digitalinvestigator@networksims.com>

w.buchanan@napier.ac.uk

Testing

2014-01-06T13:20:26.759146-0800

192.168.47.171

192.168.47.134

"Bill" <w.buchanan@napier.ac.uk>

<test@home.com>

Test

2015-12-29T11:13:51.630178-0800

172.16.16.221

172.16.16.231

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2015-12-29T11:14:08.908722-0800

172.16.16.225

172.16.16.221

Chris Sanders <sanders@skynet.local>

Chris Sanders <sanders@cyberdyne.local>

Help!

2017-07-02T15:20:34.040092-0700

172.16.16.225

172.16.16.221

(not set)

Flow 1143

Showing 61-80 of 1,143 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2005-07-16T07:29:32.065625-0700

2091496738831672

flow

200.57.7.195

5060

200.57.7.204

5061

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1247746119159147

flow

200.57.7.196

40378

200.57.7.199

4800

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

263857158282487

flow

200.57.7.204

4235

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2093566913470292

flow

200.57.7.204

4414

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1249857095278258

flow

200.57.7.204

4561

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1813191449187165

flow

200.57.7.204

4571

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2235580007112261

flow

200.57.7.204

4355

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

829130689091766

flow

200.57.7.204

4566

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1814632409911174

flow

200.57.7.205

1026

10.52.10.15

161

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

269906620847428

flow

200.57.7.204

4572

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

975067236556623

flow

200.57.7.205

3603

216.155.193.131

5050

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

976798106723970

flow

200.57.7.204

4554

64.69.76.21

13840

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1258960278721049

flow

200.57.7.196

40379

200.57.7.199

4801

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

418679991809612

flow

200.57.7.204

4564

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

843759347621782

flow

200.57.7.204

4421

200.57.7.194

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

281183056434475

flow

200.57.7.202

2427

200.57.7.195

2427

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

572359710070257

flow

222.136.251.117

34578

80.171.48.1

1026

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

2020737982686961

flow

192.168.1.14

1217

207.46.108.41

1863

TCP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

346895438469662

flow

70.85.177.186

36958

80.171.48.1

1026

UDP

pcapanalyzer

2005-07-16T07:29:32.065625-0700

1615809129732567

flow

222.136.251.117

34578

80.171.48.1

1027

UDP

pcapanalyzer

File 670

Showing 81-100 of 670 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2011-09-23T13:11:46.554377-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1314052354/cjt/cpanel-all-min.js

ASCII text, with very long lines, with no line terminators

158542

2011-09-23T13:11:46.556520-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_1181099245/webmail/hostmonster/branding/ufiltering.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 32x32, frames 3

685

2011-09-23T13:11:46.556684-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1181099245/webmail/hostmonster/branding/ufiltering.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 32x32, frames 3

685

2011-09-23T13:11:46.657327-0700

66.147.240.170

172.16.0.2

/webmail/x3/images/squirrelmail_logo.gif

GIF image data, version 89a, 150 x 48

3511

2011-09-23T13:11:53.620553-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/horde-power1.png

PNG image data, 84 x 31, 8-bit/color RGB, non-interlaced

2259

2011-09-23T13:11:47.168837-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_7645080595.11748/branding/hostmonster/heading_sprites_bg_snap_to_smallest_width.png

PNG image data, 11 x 138, 8-bit/color RGB, interlaced

2669

2011-09-23T13:11:47.209231-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_58686618011.1752/branding/hostmonster/ui_sprites_bg_snap_to_smallest_width.png

PNG image data, 1 x 2246, 8-bit/color RGB, interlaced

808

2011-09-23T13:11:55.459795-0700

66.147.240.170

172.16.0.2

/horde/themes/graphics/favicon.ico

MS Windows icon resource - 1 icon, 16x16

1150

2011-09-23T13:11:55.459930-0700

66.147.240.170

192.168.43.244

/horde/themes/graphics/favicon.ico

MS Windows icon resource - 1 icon, 16x16

1150

2011-09-23T13:11:58.062475-0700

192.168.43.244

66.147.240.170

/horde/login.php

ASCII text, with no line terminators

2011-09-23T13:11:58.062611-0700

172.16.0.2

66.147.240.170

/horde/login.php

ASCII text, with no line terminators

2011-09-23T13:11:47.621113-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1181099244/webmail/hostmonster/branding/responder.jpg

JPEG image data, JFIF standard 1.01, resolution (DPI), density 299x299, segment length 16, baseline, precision 8, 32x32, frames 3

685

2011-09-23T13:11:48.201405-0700

66.147.240.170

172.16.0.2

/cPanel_magic_revision_38363069535.6975/branding/hostmonster/heading_sprites_compleximg.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 95", progressive, precision 8, 763x149, frames 3

27354

2011-09-23T13:11:48.201508-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_38363069535.6975/branding/hostmonster/heading_sprites_compleximg.jpg

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 95", progressive, precision 8, 763x149, frames 3

27354

2011-09-23T13:11:53.243423-0700

66.147.240.170

172.16.0.2

/horde/themes/bluewhite/screen.css

ASCII text

3210

2011-09-23T13:11:54.235054-0700

66.147.240.170

172.16.0.2

/horde/js/prototype.js

ASCII text, with very long lines, with no line terminators

81469

2011-09-23T13:12:05.597573-0700

66.147.240.170

172.16.0.2

/horde/services/portal/sidebar.php

HTML document, ASCII text, with very long lines

11433

2011-09-23T13:11:33.750856-0700

192.168.43.244

66.147.240.170

/login/

ASCII text, with no line terminators

109

2011-09-23T13:11:33.956726-0700

66.147.240.170

192.168.43.244

/login/

HTML document, ASCII text

153

100

2011-09-23T13:11:38.871063-0700

66.147.240.170

192.168.43.244

/cPanel_magic_revision_1214446472/branding/hostmonster/local.css

ASCII text

2158

Comments	(not set)

Update Download PCAP Delete