BARCODE-SEC-2.root.2.pcap

MD5	226906f282b97897f3066d665b6252bb
Submission Date	2021-11-23 04:09:34
Tags	(not set)

Alert 3

Showing 1-3 of 3 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2021-11-23T03:53:25.126867-0800
Flow Id	1867854806069938
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.9
Destination Port	58320
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..5{......Q...oD.I.. ..DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....r...n... ^?.`.\......G...S%`....(... # .....F0D. CVw.F.p....,.Aw...q......P....n(. }U.DI......y.O6e...x..... l_b..h.........

2021-11-23T03:53:25.126867-0800

1.1.1.1

10.182.89.9

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

Timestamp	2021-11-23T04:01:42.604334-0800
Flow Id	2008867204921155
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.3
Destination Port	52850
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..&.B-.......3.....D.i.DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....s...o... .1...~,.....N.......r. ..K%........G0E. g...U.-X..JJ...}bd..P..w.........!...iV..bF....I..Vn.^d.....3...............

2021-11-23T04:01:42.604334-0800

1.1.1.1

10.182.89.3

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

Timestamp	2021-11-23T04:07:13.988623-0800
Flow Id	663868153084036
Source IP	1.1.1.1
Source Port	853
Destination IP	10.182.89.9
Destination Port	58334
Protocol	TCP
Alert Signature	ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2027671
Payload Printable	....?...;..a..q .n;.....#..........DOWNGRD...+...................#..... %.. !. ....0...0...........u.m2.k...__qJ.p0 ...H.=...0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10.. 211025000000Z. 221025235959Z0r1.0...U....US1.0...U... California1.0...U... San Francisco1.0...U. ..Cloudflare, Inc.1.0...U....cloudflare-dns.com0Y0....H.=.....H.=....B...)D..?...V.,....1+.&."..{K...{{)..5l. H.l.s. ..F!..M.....8..........0...0...U.#..0... ..)...9mz..3......z0...U.......E.#..t."..Fk...`..@0....U.....0....cloudflare-dns.com...cloudflare-dns.com..one.one.one.one................$.........&.G.G.............&.G.G.............&.G.G..........d..&.G.G.........d.0...U...........0...U.%..0...+.........+.......0....U.....0..0F.D.B.@http://crl3.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0F.D.B.@http://crl4.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crl0>..U. .70503..g.....0)0'..+.........http://www.digicert.com/CPS0....+........y0w0$..+.....0...http://ocsp.digicert.com0O..+.....0..Chttp://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt0...U.......0.0..~. +.....y......n...j.h.w.)y...99!.Vs.c.w..W}.` ..M]&\%].....\|.a.......H0F.!....M....X.........$..L...v.......!.. a....X..u#.R..... ...Q+...+.Q..u.Q.....y.Vm.7x...z..'....B. ........\|.a.......F0D. ..!.8..?.cq...7!A..T......s.a.. ..RF..IU._g.b. ...=jM....,...]...v.A...."FJ...:.B.^N1.....K.h..b......\|.a.......G0E. d.../4.(Yo..........o..d..N....x.!......z[...w.....d.....4.s..L..6.0 ...H.=....g.0d.0.R......\o....-.?.B0...C.?.!...Q[[...h. ..v...J..0I....rV.7~`....Vg.. ..KJb.P.ap....._.......$[......0...0.............\..w.z..G.5%.0 ...H.. .....0a1.0...U....US1.0...U. ..DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root CA0.. 210414000000Z. 310413235959Z0V1.0...U....US1.0...U. ..DigiCert Inc100...U...'DigiCert TLS Hybrid ECC SHA384 2020 CA10v0....H.=....+...".b......[...).........lU.....I/.'Q..p..z...................t56<.r...."i....{@..h.&\9..M.M......C../s....0..~0...U.......0.......0...U...... ..)...9mz..3......z0...U.#..0.....P5V.L.f........=.U0...U...........0...U.%..0...+.........+.......0v..+........j0h0$..+.....0...http://ocsp.digicert.com0@..+.....0..4http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B..U...;0907.5.3.1http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=..U. .6040...`.H...l..0...g....0...g.....0...g.....0...g.....0 ...H.. ..........GY......q..]...G..~v+.....&.B.1.J...............-.....S..?... ........5&.....2..#K.E....\|......r......\|j.m...6...,..?...u...).......&.e.7.&........x..Ny.v..Q....j..,V..6'.s..}.2..D.....{.(.+..v.w..z.{R&U.r....O..!....9.V....5.p..F...d..>..F..#..}.O..E:.t0.....s...o... ...P,*[..iZ... U tw....N;..... S...G0E.!..C..+....9..F.......1.;GaI{D..A.. f nS. ..a.7:.d..p...A...h. .-............

2021-11-23T04:07:13.988623-0800

1.1.1.1

10.182.89.9

ET POLICY Cloudflare DNS Over HTTPS Certificate Inbound

DNS 12

Showing 1-12 of 12 items.

Timestamp

Src Ip

Dest Ip

Dns Type

Resource Record Name

Resource Record Type

Resource Data

2021-11-23T04:06:01.172501-0800

10.182.89.7

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:06:01.183143-0800

1.1.1.1

10.182.89.7

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T03:59:03.067377-0800

10.182.89.8

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T03:59:03.086379-0800

1.1.1.1

10.182.89.8

answer

www.honeywellaidc.com

(not set)

2021-11-23T04:06:01.172407-0800

10.182.89.7

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T04:06:01.281904-0800

1.1.1.1

10.182.89.7

answer

www.honeywellaidc.com

(not set)

2021-11-23T03:59:03.067496-0800

10.182.89.8

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T03:59:03.077631-0800

1.1.1.1

10.182.89.8

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.057889-0800

10.182.89.9

1.1.1.1

query

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.058022-0800

10.182.89.9

1.1.1.1

query

www.honeywellaidc.com

(not set)

2021-11-23T04:07:16.068680-0800

1.1.1.1

10.182.89.9

answer

connectivitycheck.gstatic.com

(not set)

2021-11-23T04:07:16.219755-0800

1.1.1.1

10.182.89.9

answer

www.honeywellaidc.com

(not set)

TLS 69

Showing 1-20 of 69 items.

Timestamp

Source IP

Destination IP

TLS Version

Server Name Indication

2021-11-23T03:54:38.676316-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:58:48.394810-0800

10.182.89.2

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T03:58:57.181105-0800

10.182.89.2

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:54:10.231937-0800

10.182.89.5

8.8.8.8

TLS 1.2

(not set)

2021-11-23T03:53:25.103719-0800

10.182.89.9

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:54:32.882781-0800

10.182.89.7

8.8.4.4

TLS 1.2

(not set)

2021-11-23T03:59:03.830878-0800

10.182.89.8

184.24.27.58

TLS 1.2

www.honeywellaidc.com

2021-11-23T03:59:30.353529-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T04:01:22.628926-0800

10.182.89.9

142.250.186.68

TLS 1.3

www.google.com

2021-11-23T04:01:42.583136-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:58:00.239139-0800

10.182.89.3

157.133.206.72

TLS 1.2

flpnwc-gd5z9994n0.dispatcher.eu2.hana.ondemand.com

2021-11-23T03:58:20.692010-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:58:46.481729-0800

10.182.89.2

157.133.206.72

TLS 1.2

flpnwc-gd5z9994n0.dispatcher.eu2.hana.ondemand.com

2021-11-23T03:58:00.214070-0800

10.182.89.3

157.133.206.72

TLS 1.2

flpnwc-gd5z9994n0.dispatcher.eu2.hana.ondemand.com

2021-11-23T03:58:00.214262-0800

10.182.89.3

157.133.206.72

TLS 1.2

flpnwc-gd5z9994n0.dispatcher.eu2.hana.ondemand.com

2021-11-23T04:03:49.110781-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:58:01.052442-0800

10.182.89.3

104.89.28.46

TLS 1.3

sapui5.hana.ondemand.com

2021-11-23T03:58:23.773016-0800

10.182.89.3

1.1.1.1

TLS 1.2

(not set)

2021-11-23T03:58:28.741395-0800

10.182.89.4

8.8.4.4

TLS 1.2

(not set)

2021-11-23T03:58:31.381234-0800

10.182.89.2

1.1.1.1

TLS 1.2

(not set)

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 3

Showing 1-3 of 3 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2021-11-23T03:59:03.119863-0800

10.182.89.8

connectivitycheck.gstatic.com

GET

/generate_204

204

2021-11-23T04:06:01.226130-0800

10.182.89.7

connectivitycheck.gstatic.com

GET

/generate_204

204

2021-11-23T04:07:32.227920-0800

10.182.89.9

connectivitycheck.gstatic.com

GET

/generate_204

(not set)

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 137

Showing 101-120 of 137 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

101

2021-11-23T04:07:32.227920-0800

1232680702540509

flow

173.194.76.188

5228

10.182.89.5

35782

TCP

pcapanalyzer

102

2021-11-23T04:07:32.227920-0800

2218225387682234

flow

157.133.206.72

443

10.182.89.9

36060

TCP

pcapanalyzer

103

2021-11-23T04:07:32.227920-0800

1233702908776568

flow

10.182.89.5

45022

8.8.8.8

853

TCP

pcapanalyzer

104

2021-11-23T04:07:32.227920-0800

1656731449114463

flow

10.182.89.9

36094

157.133.206.72

443

TCP

pcapanalyzer

105

2021-11-23T04:07:32.227920-0800

531660449096105

flow

10.182.89.9

42161

142.250.185.106

443

UDP

pcapanalyzer

106

2021-11-23T04:07:32.227920-0800

1799337226932189

flow

10.182.89.3

52860

1.1.1.1

853

TCP

pcapanalyzer

107

2021-11-23T04:07:32.227920-0800

534735634118408

flow

10.182.89.8

35010

8.8.4.4

853

TCP

pcapanalyzer

108

2021-11-23T04:07:32.227920-0800

116251234388699

flow

10.182.89.9

36104

157.133.206.72

443

TCP

pcapanalyzer

109

2021-11-23T04:07:32.227920-0800

117982062100785

flow

10.182.89.11

56769

142.250.186.42

443

UDP

pcapanalyzer

110

2021-11-23T04:07:32.227920-0800

962806413822923

flow

46.140.145.157

5494

10.182.89.4

35460

TCP

pcapanalyzer

111

2021-11-23T04:07:32.227920-0800

259209165983973

flow

10.182.89.7

53710

8.8.4.4

853

TCP

pcapanalyzer

112

2021-11-23T04:07:32.227920-0800

1808103276597250

flow

10.182.89.9

40234

104.89.28.46

443

TCP

pcapanalyzer

113

2021-11-23T04:07:32.227920-0800

1104836711639561

flow

157.133.206.72

443

10.182.89.7

33434

TCP

pcapanalyzer

114

2021-11-23T04:07:32.227920-0800

261133331579785

flow

10.182.89.2

41476

20.190.160.6

443

TCP

pcapanalyzer

115

2021-11-23T04:07:32.227920-0800

1950940955822523

flow

10.182.89.13

55928

1.1.1.1

853

TCP

pcapanalyzer

116

2021-11-23T04:07:32.227920-0800

1529621862834568

flow

10.182.89.3

50158

104.89.28.46

443

TCP

pcapanalyzer

117

2021-11-23T04:07:32.227920-0800

685995779343639

flow

10.182.89.12

52690

1.1.1.1

853

TCP

pcapanalyzer

118

2021-11-23T04:07:32.227920-0800

2234219840126331

flow

10.182.89.1

56940

142.250.186.106

443

TCP

pcapanalyzer

119

2021-11-23T04:07:32.227920-0800

1952929530320580

flow

10.182.89.8

59438

173.194.76.188

5228

TCP

pcapanalyzer

120

2021-11-23T04:07:32.227920-0800

2093761533282417

flow

10.182.89.9

40788

74.125.133.188

5228

TCP

pcapanalyzer

File 0

#		Timestamp	Source	Destination	File Name	File Magic	File Size
No results found.

Comments	(not set)

Update Download PCAP Delete