TAS_VM16.pcap

MD5	51eac57e322c15a75f7bce474c0faff9
Submission Date	2019-08-30 14:19:31
Tags	(not set)

Alert 7

Showing 1-7 of 7 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2019-08-30T03:44:51.136545-0700
Flow Id	1757504881282443
Source IP	10.49.74.196
Source Port	39396
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 11557 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:edb54d46-857e-48d7-af9f-1349cbcd6421</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192695</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192695.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567161891112@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567161891112@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:44:45.183Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_AUTH msg=audit(1567161885.183:17451): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.186Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_ACCT msg=audit(1567161885.186:17452): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.188Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CRED_ACQ msg=audit(1567161885.188:17453): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.189Z" facility="audit" host="cbam-1de7165db

2019-08-30T03:44:51.136545-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T03:46:13.778964-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

Timestamp	2019-08-30T03:48:38.174235-0700
Flow Id	1610750158585363
Source IP	10.49.74.196
Source Port	32951
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 4538 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:cf5f7494-9c2f-4514-93d1-c3f70def0f6e</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192724</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192724.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162118139@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162118139@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:48:32.112Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=TTY msg=audit(1567162112.112:17556): tty pid=28132 uid=0 auid=4294967295 ses=4294967295 major=136 minor=0 comm=\"bash\" data=657869740D"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.112Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_TTY msg=audit(1567162112.112:17557): pid=28132 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=\"exit\""</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.113Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CONFIG_CHANGE msg=audit(1567162112.113:17558): pid=28011 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=tty_set old-enabled=1 new-enabled=0 old-log_passwd=0 new-log_passwd=0 res=1"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.114Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_END msg=audit(1567162112.114:17559): pid=28011 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_mkhomedir,pam_limits,pam_ldap,pam_unix,pam_tty_audit,pam_xauth acct=\"root\" ex

2019-08-30T03:48:38.174235-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

Timestamp	2019-08-30T03:51:07.281377-0700
Flow Id	157346120331866
Source IP	10.49.74.196
Source Port	50488
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 7121 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:0681fd9c-9ceb-4e72-bc08-2cb263ba3f07</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192740</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192740.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162267251@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162267251@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:51:03.974Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=TTY msg=audit(1567162263.974:17595): tty pid=17166 uid=0 auid=4294967295 ses=4294967295 major=136 minor=1 comm=\"bash\" data=1B5B411B5B411B5B411B5B411B5B411B5B410808080808080808657869740D"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.974Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_TTY msg=audit(1567162263.974:17596): pid=17166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=\"exit\""</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.977Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CONFIG_CHANGE msg=audit(1567162263.977:17597): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=tty_set old-enabled=1 new-enabled=0 old-log_passwd=0 new-log_passwd=0 res=1"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.977Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_END msg=audit(1567162263.977:17598): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_mkhomedir,pam_limits,pam_ld

2019-08-30T03:51:07.281377-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T03:51:13.146898-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

Timestamp	2019-08-30T03:48:50.172375-0700
Flow Id	89859290179243
Source IP	10.49.74.196
Source Port	44371
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 9450 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:3d6cebfc-315d-4443-9844-8a4735c9c93b</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192726</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192726.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162130135@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162130135@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:48:44.239Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_AUTH msg=audit(1567162124.239:17561): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.242Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_ACCT msg=audit(1567162124.242:17562): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.244Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CRED_ACQ msg=audit(1567162124.244:17563): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.245Z" facility="audit" host="cbam-1de7165dbe

2019-08-30T03:48:50.172375-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T04:11:13.790634-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

DNS 0

#		Timestamp	Src Ip	Dest Ip	Dns Type	Resource Record Name	Resource Record Type	Resource Data
No results found.

TLS 0

#		Timestamp	Source IP	Destination IP	TLS Version	Server Name Indication
No results found.

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 98

Showing 61-80 of 98 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2019-08-30T03:55:15.660083-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:54:16.317766-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:08:00.517983-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:55:39.956312-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:55:33.949666-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:09:19.334747-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:15.713013-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:31.443090-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:10:15.342665-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:46.083119-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:34.448490-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:15.702042-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:45.108657-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:11:13.790665-0700

10.49.83.81

10.49.74.196

8080

POST

/NE3S/1.0/NE3SOperationService

200

2019-08-30T04:11:20.427424-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:52.112820-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:28.355447-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:12:02.919533-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:00:10.757061-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:10.716295-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 98

Showing 1-20 of 98 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2019-08-30T04:08:16.328453-0700

1700884312685368

flow

10.49.74.196

54747

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1994917766266588

flow

10.49.74.196

44668

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

452401734121012

flow

10.49.74.196

36938

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1299218974185359

flow

10.49.74.196

39573

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

2009799842230451

flow

10.49.74.196

47091

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1166221004758660

flow

10.49.74.196

49850

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

2153844446168688

flow

10.49.74.196

48363

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1733796653251628

flow

10.49.74.196

36506

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

502201889525547

flow

10.49.74.196

45112

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

788375553098960

flow

10.49.74.196

36199

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1919261923395646

flow

10.49.74.196

43236

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

950480505649426

flow

10.49.74.196

42214

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

259652204616910

flow

10.49.74.196

52876

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

273619429983959

flow

10.49.74.196

35837

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1825537155665772

flow

10.49.74.196

43093

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1984691468548636

flow

10.49.74.196

50125

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

450572098699336

flow

10.49.74.196

48917

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1014849199906016

flow

10.49.74.196

36420

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

2006655937615945

flow

10.49.74.196

36857

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:08:16.328453-0700

1608082965230148

flow

10.49.74.196

36798

10.49.83.115

30505

TCP

pcapanalyzer

File 98

Showing 41-60 of 98 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2019-08-30T03:48:44.994831-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:57:09.364504-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:51:13.146923-0700

10.49.74.196

10.49.83.81

/NE3S/1.0/NE3SOperationService

ASCII text, with very long lines, with CRLF line terminators

1657

2019-08-30T03:48:50.172375-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:58:02.909006-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:51:14.218618-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:49:13.568417-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T04:02:40.413220-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:52:31.942217-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:49:31.181724-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T04:03:49.437804-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:53:08.642282-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:51:22.923238-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T04:05:54.637738-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:53:19.287954-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:51:28.903322-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T04:06:03.270844-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:53:27.948473-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:53:34.139135-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T04:06:09.440426-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

Comments	(not set)

Update Download PCAP Delete