TAS_VM16.pcap

MD5	51eac57e322c15a75f7bce474c0faff9
Submission Date	2019-08-30 14:19:31
Tags	(not set)

Alert 7

Showing 1-7 of 7 items.

Timestamp

Src Ip

Dest Ip

Alert Signature

Timestamp	2019-08-30T03:44:51.136545-0700
Flow Id	1757504881282443
Source IP	10.49.74.196
Source Port	39396
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 11557 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:edb54d46-857e-48d7-af9f-1349cbcd6421</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192695</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192695.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567161891112@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43aced3d56afbe6e266ffaa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567161891112@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:44:45.183Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_AUTH msg=audit(1567161885.183:17451): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.186Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_ACCT msg=audit(1567161885.186:17452): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.188Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CRED_ACQ msg=audit(1567161885.188:17453): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/1 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:44:45.189Z" facility="audit" host="cbam-1de7165db

2019-08-30T03:44:51.136545-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T03:46:13.778964-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

Timestamp	2019-08-30T03:48:38.174235-0700
Flow Id	1610750158585363
Source IP	10.49.74.196
Source Port	32951
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 4538 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:cf5f7494-9c2f-4514-93d1-c3f70def0f6e</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192724</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192724.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162118139@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43af3ba956afbe6e266d9aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162118139@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:48:32.112Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=TTY msg=audit(1567162112.112:17556): tty pid=28132 uid=0 auid=4294967295 ses=4294967295 major=136 minor=0 comm=\"bash\" data=657869740D"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.112Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_TTY msg=audit(1567162112.112:17557): pid=28132 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=\"exit\""</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.113Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CONFIG_CHANGE msg=audit(1567162112.113:17558): pid=28011 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=tty_set old-enabled=1 new-enabled=0 old-log_passwd=0 new-log_passwd=0 res=1"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:32.114Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_END msg=audit(1567162112.114:17559): pid=28011 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_mkhomedir,pam_limits,pam_ldap,pam_unix,pam_tty_audit,pam_xauth acct=\"root\" ex

2019-08-30T03:48:38.174235-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

Timestamp	2019-08-30T03:51:07.281377-0700
Flow Id	157346120331866
Source IP	10.49.74.196
Source Port	50488
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 7121 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:0681fd9c-9ceb-4e72-bc08-2cb263ba3f07</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192740</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192740.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162267251@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43a6b2fb56afbe6e266d8aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162267251@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:51:03.974Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=TTY msg=audit(1567162263.974:17595): tty pid=17166 uid=0 auid=4294967295 ses=4294967295 major=136 minor=1 comm=\"bash\" data=1B5B411B5B411B5B411B5B411B5B411B5B410808080808080808657869740D"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.974Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_TTY msg=audit(1567162263.974:17596): pid=17166 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data=\"exit\""</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.977Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CONFIG_CHANGE msg=audit(1567162263.977:17597): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 op=tty_set old-enabled=1 new-enabled=0 old-log_passwd=0 new-log_passwd=0 res=1"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:51:03.977Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_END msg=audit(1567162263.977:17598): pid=17107 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close grantors=pam_mkhomedir,pam_limits,pam_ld

2019-08-30T03:51:07.281377-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T03:51:13.146898-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

Timestamp	2019-08-30T03:48:50.172375-0700
Flow Id	89859290179243
Source IP	10.49.74.196
Source Port	44371
Destination IP	10.49.83.115
Destination Port	30505
Protocol	TCP
Alert Signature	ET POLICY Http Client Body contains passwd= in cleartext
Alert Category	Potential Corporate Privacy Violation
Alert Severity	1
Alert Gid	1
Alert Signature Id	2012886
Payload Printable	POST /services/NE3SBasicNotificationsService HTTP/1.1 Content-Type: multipart/related; boundary="MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4"; type="text/xml"; start="<0.b3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4@apache.org>" SOAPAction: "http://www.nokiasiemens.com/ne3s/1.0/transferNotification" User-Agent: Axis2 Host: 10.49.83.115:30505 Content-Length: 9450 Connection: keep-alive --MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4 Content-Type: text/xml; charset=UTF-8 Content-Transfer-Encoding: binary Content-ID: <0.b3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4@apache.org> <?xml version='1.0' encoding='UTF-8'?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"><wsa:To>http://10.49.83.115:30505/services/NE3SBasicNotificationsService</wsa:To><wsa:MessageID>urn:uuid:3d6cebfc-315d-4443-9844-8a4735c9c93b</wsa:MessageID><wsa:Action>http://www.nokiasiemens.com/ne3s/1.0/transferNotification</wsa:Action></soapenv:Header><soapenv:Body><transferNotification xmlns="http://www.nokiasiemens.com/ne3s/1.0"><agentRegistrationId>PLMN-PLMN/NTAS-TGTAS2</agentRegistrationId><agentRegistrationKey>MTcyNTM0ODAyMQ==</agentRegistrationKey><queueId>ne3s_atl_logUploadNotificationQueue</queueId><notificationType>ne3s_atl_logUploadNotification</notificationType><sequenceNumber>192726</sequenceNumber><attachmentProperties><compression>none</compression><contentType>oats</contentType><checksum><algorithm>none</algorithm><hash>checksumHash</hash></checksum><primaryDocument>ne3s_atl_logUploadNotification.ne3s_atl_logUploadNotificationQueue.192726.xml</primaryDocument></attachmentProperties><notificationContent>cid:transferNotificationContent1567162130135@nokiasiemens.com</notificationContent></transferNotification></soapenv:Body></soapenv:Envelope> --MIMEBoundary_c3a6466c4e4bf43a31ad956afbe6e266f9aa41400a22f9c4 Content-Type: application/octet-stream Content-Transfer-Encoding: binary Content-ID: <transferNotificationContent1567162130135@nokiasiemens.com> <?xml version="1.0" encoding="UTF-8" standalone="yes"?><log><record eventTime="2019-08-30T10:48:44.239Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_AUTH msg=audit(1567162124.239:17561): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.242Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=USER_ACCT msg=audit(1567162124.242:17562): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.244Z" facility="audit" host="cbam-1de7165dbec0457f9f952e682ef-infra-node-0" level="info" neid="406666" process="auditd" service="auditd" system="ntasts02" userName="root"><additionalText>"type=CRED_ACQ msg=audit(1567162124.244:17563): pid=20290 uid=1160 auid=4294967295 ses=4294967295 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_unix acct=\"root\" exe=\"/usr/bin/su\" hostname=cbam-1de7165dbec0457f9f952e682ef-infra-node-0 addr=? terminal=pts/0 res=success'"</additionalText><interfaceType>"host-os"</interfaceType></record><record eventTime="2019-08-30T10:48:44.245Z" facility="audit" host="cbam-1de7165dbe

2019-08-30T03:48:50.172375-0700

10.49.74.196

10.49.83.115

ET POLICY Http Client Body contains passwd= in cleartext

2019-08-30T04:11:13.790634-0700

10.49.83.81

10.49.74.196

ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted

DNS 0

#		Timestamp	Src Ip	Dest Ip	Dns Type	Resource Record Name	Resource Record Type	Resource Data
No results found.

TLS 0

#		Timestamp	Source IP	Destination IP	TLS Version	Server Name Indication
No results found.

TFTP 0

#	Timestamp	Src Ip	Dest Ip	Tftp Packet	Tftp File	Tftp Mode
No results found.

HTTP 98

Showing 61-80 of 98 items.

Timestamp

Source

Hostname

Port

Method

URL

Status

2019-08-30T03:55:15.660083-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:54:16.317766-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:08:00.517983-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:55:39.956312-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:55:33.949666-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:09:19.334747-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:15.713013-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:31.443090-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:10:15.342665-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:57:46.083119-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:34.448490-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:15.702042-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:45.108657-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:11:13.790665-0700

10.49.83.81

10.49.74.196

8080

POST

/NE3S/1.0/NE3SOperationService

200

2019-08-30T04:11:20.427424-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:52.112820-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:58:28.355447-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:12:02.919533-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T04:00:10.757061-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

2019-08-30T03:59:10.716295-0700

10.49.74.196

10.49.83.115

30505

POST

/services/NE3SBasicNotificationsService

200

SMB 0

#		Timestamp	Src Ip	Dest Ip	SMB Dialect	Command	Session	Tree
No results found.

SMTP 0

#		Timestamp	Source	Destination	Email From	Email To	Subject
No results found.

Flow 98

Showing 61-80 of 98 items.

Timestamp

Flow Id

Event Type

Source

Source Port

Destination

Destination Port

Protocol

Host

2019-08-30T04:12:02.919705-0700

1045004270297140

flow

10.49.83.81

41369

10.49.74.196

8080

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1187798959579303

flow

10.49.74.196

37015

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1188322982981851

flow

10.49.74.196

42145

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1610750158585363

flow

10.49.74.196

32951

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1194443359051589

flow

10.49.74.196

37560

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1339054889958107

flow

10.49.74.196

60370

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1058108136885843

flow

10.49.74.196

42601

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1629413973914293

flow

10.49.74.196

38339

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1488732356818472

flow

10.49.74.196

42597

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1349199532627535

flow

10.49.74.196

53536

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

89859290179243

flow

10.49.74.196

44371

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

90555108007532

flow

10.49.74.196

59265

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

514646656250219

flow

10.49.74.196

59398

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1922904125770416

flow

10.49.74.196

41638

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

658766372574356

flow

10.49.83.81

33906

10.49.74.196

8080

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

2208927426041040

flow

10.49.74.196

52259

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

1364790323583181

flow

10.49.74.196

51493

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

380912039940056

flow

10.49.74.196

36022

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

524602339954443

flow

10.49.74.196

40751

10.49.83.115

30505

TCP

pcapanalyzer

2019-08-30T04:12:02.919705-0700

244991432663822

flow

10.49.74.196

33769

10.49.83.115

30505

TCP

pcapanalyzer

File 98

Showing 1-20 of 98 items.

Timestamp

Source

Destination

File Name

File Magic

File Size

2019-08-30T03:39:06.463999-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:38:47.730581-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:38:32.050342-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:39:35.067982-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:39:12.708645-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:40:59.809772-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:41:47.139881-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:39:41.055414-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:40:29.512486-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:41:54.007282-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:40:44.070047-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:42:50.115665-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:43:53.116721-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:41:06.478625-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:42:56.023361-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:43:07.508213-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:43:47.116819-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:42:42.016589-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:44:08.522650-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

2019-08-30T03:44:31.909543-0700

10.49.83.115

10.49.74.196

/services/NE3SBasicNotificationsService

ASCII text, with very long lines, with no line terminators

436

Comments	(not set)

Update Download PCAP Delete