BARCODE-SEC-2.root.2.pcap

MD5	226906f282b97897f3066d665b6252bb
Submission Date	2021-11-23 04:09:34
Tags	(not set)

Alert 3

Showing 1-3 of 3 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2021-11-23T03:53:25.126867-0800
Flow Id	1867854806069938
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.9
Destination Port	58320
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..5{......Q...oD.I.. ..DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....r...n... ^?.`.\......G...S%`....(... # .....F0D. CVw.F.p....,.Aw...q......P....n(. }U.DI......y.O6e...x..... l_b..h.........

2021-11-23T03:53:25.126867-0800

1.1.1.1

10.182.89.9

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

Timestamp	2021-11-23T04:01:42.604334-0800
Flow Id	2008867204921155
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.3
Destination Port	52850
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..&.B-.......3.....D.i.DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....s...o... .1...~,.....N.......r. ..K%........G0E. g...U.-X..JJ...}bd..P..w.........!...iV..bF....I..Vn.^d.....3...............

2021-11-23T04:01:42.604334-0800

1.1.1.1

10.182.89.3

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

Timestamp	2021-11-23T04:07:13.988623-0800
Flow Id	663868153084036
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.9
Destination Port	58334
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..q .n;.....#..........DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....s...o... ...P,*[..iZ... U tw....N;..... S...G0E.!..C..+....9..F.......1.;GaI{D..A.. f nS. ..a.7:.d..p...A...h. .-............

2021-11-23T04:07:13.988623-0800

1.1.1.1

10.182.89.9

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

DNS 12

Showing 1-12 of 12 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2021-11-23T04:06:01.172501-0800

10.182.89.7

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:06:01.183143-0800

1.1.1.1

10.182.89.7

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T03:59:03.067377-0800

10.182.89.8

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T03:59:03.086379-0800

1.1.1.1

10.182.89.8

answer

www.honeywellaidc.com

(not set)

2021-11-23T04:06:01.172407-0800

10.182.89.7

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T04:06:01.281904-0800

1.1.1.1

10.182.89.7

answer

www.honeywellaidc.com

(not set)

2021-11-23T03:59:03.067496-0800

10.182.89.8

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T03:59:03.077631-0800

1.1.1.1

10.182.89.8

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.057889-0800

10.182.89.9

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.058022-0800

10.182.89.9

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T04:07:16.068680-0800

1.1.1.1

10.182.89.9

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.219755-0800

1.1.1.1

10.182.89.9

answer

www.honeywellaidc.com

(not set)

TLS 69

Showing 21-40 of 69 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2021-11-23T03:58:46.828458-0800

10.182.89.2

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T03:58:47.005360-0800

10.182.89.2

157.133.205.174

TLS 1.2

authn.eu2.hana.ondemand.com

2021-11-23T04:07:14.041254-0800

10.182.89.9

142.250.74.196

TLS 1.3

www.google.com

2021-11-23T04:07:27.065948-0800

10.182.89.3

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T04:07:27.775675-0800

10.182.89.3

157.133.205.174

TLS 1.2

authn.eu2.hana.ondemand.com

2021-11-23T04:00:10.752675-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:01:06.095729-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:01:22.533844-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:01:43.041454-0800

10.182.89.3

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T04:01:43.043957-0800

10.182.89.3

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T04:02:25.919376-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:05:59.072840-0800

10.182.89.7

8.8.4.4

TLS 1.2

(not set)

2021-11-23T04:06:02.033319-0800

10.182.89.7

184.24.27.58

TLS 1.2

www.honeywellaidc.com

2021-11-23T04:06:34.148406-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:07:13.959069-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:07:14.040081-0800

10.182.89.9

142.250.74.196

TLS 1.3

www.google.com

2021-11-23T04:07:14.043629-0800

10.182.89.9

142.250.74.196

TLS 1.3

www.google.com

2021-11-23T04:07:27.013993-0800

10.182.89.3

157.133.206.72

TLS 1.2

flpnwc-gd5z9994n0.dispatcher.eu2.hana.ondemand.com

2021-11-23T03:58:47.228370-0800

10.182.89.2

20.190.160.6

TLS 1.2

2021-11-23T04:07:28.015742-0800

10.182.89.3

20.190.159.138

TLS 1.2

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 3

Showing 1-3 of 3 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2021-11-23T03:59:03.119863-0800

10.182.89.8

connectivitycheck.gstatic.com

GET

/generate_204

204

2021-11-23T04:06:01.226130-0800

10.182.89.7

connectivitycheck.gstatic.com

GET

/generate_204

204

2021-11-23T04:07:32.227920-0800

10.182.89.9

connectivitycheck.gstatic.com

GET

/generate_204

(not set)

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 137

Showing 61-80 of 137 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2021-11-23T04:07:32.227920-0800

765091892492885

flow

10.182.89.7

53712

8.8.4.4

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1188051689435735

flow

10.182.89.7

52258

108.177.15.188

5228

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

63470354938025

flow

10.182.89.9

58326

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

2034688542252077

flow

10.182.89.9

58324

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

346010482734150

flow

10.182.89.3

50162

104.89.28.46

443

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

206728987756736

flow

10.182.89.3

52846

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1615959323632294

flow

10.182.89.9

33755

1.1.1.1

UDP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

209709709468626

flow

10.182.89.11

56638

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

353749986482180

flow

46.140.145.157

5494

10.182.89.3

34060

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1621160528848698

flow

10.182.89.9

41818

142.250.74.196

443

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

777014738756166

flow

10.182.89.2

45766

157.133.206.72

443

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1903820916711969

flow

10.182.89.9

15541

1.1.1.1

UDP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1903962617555770

flow

10.182.89.11

56630

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1060796124778153

flow

10.182.89.12

33658

172.253.120.188

5228

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

2186996665508477

flow

10.182.89.3

52832

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

2047109593772609

flow

10.182.89.3

50168

104.89.28.46

443

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1906951894633419

flow

46.140.145.157

5494

10.182.89.10

48784

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1064214896943039

flow

10.182.89.11

56624

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

1069068239325631

flow

10.182.89.3

52862

1.1.1.1

853

TCP

pcapanalyzer

2021-11-23T04:07:32.227920-0800

2055270013051158

flow

10.182.89.12

52696

1.1.1.1

853

TCP

pcapanalyzer

File 0

#		Timestamp	Source	Destination	File Name	File Magic	File Size
No results found.

Comments	(not set)

Update Download PCAP Delete