Code:
No. Time Source Destination Protocol Length Info
440 09:17:58,140649058 xxx-1.yyy.zzz yyy.zzz DNS 84 Standard query 0x570d A xxx-2.yyy.zzz
441 09:17:58,140659467 xxx-1.yyy.zzz yyy.zzz DNS 84 Standard query 0x0523 AAAA xxx-2.yyy.zzz
442 09:17:58,141330930 yyy.zzz xxx-1.yyy.zzz DNS 186 Standard query response 0x570d A xxx-2.yyy.zzz A 192.168.178.29 NS yyy.zzz A 192.168.178.1 AAAA fd00::5e49:79ff:fedc:e1aa AAAA 2001:16b8:3855:bd00:5e49:79ff:fedc:e1aa
443 09:17:58,141880786 yyy.zzz xxx-1.yyy.zzz DNS 198 Standard query response 0x0523 AAAA xxx-2.yyy.zzz AAAA 2001:16b8:3855:bd00:265e:beff:fe02:8d2b NS yyy.zzz A 192.168.178.1 AAAA fd00::5e49:79ff:fedc:e1aa AAAA 2001:16b8:3855:bd00:5e49:79ff:fedc:e1aa
444 09:17:58,143162898 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 94 59824 → http-alt(8080) [SYN] Seq=0 Win=64440 Len=0 MSS=1432 SACK_PERM=1 TSval=1330549354 TSecr=0 WS=128
445 09:17:58,143603800 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 94 http-alt(8080) → 59824 [SYN, ACK] Seq=0 Ack=1 Win=28400 Len=0 MSS=1432 SACK_PERM=1 TSval=146697 TSecr=1330549354 WS=128
446 09:17:58,143649656 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1 Ack=1 Win=64512 Len=0 TSval=1330549355 TSecr=146697
447 09:17:58,143726259 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 406 59824 → http-alt(8080) [PSH, ACK] Seq=1 Ack=1 Win=64512 Len=320 TSval=1330549355 TSecr=146697 [TCP segment of a reassembled PDU]
448 09:17:58,144162302 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 http-alt(8080) → 59824 [ACK] Seq=1 Ack=321 Win=29568 Len=0 TSval=146697 TSecr=1330549355
449 09:17:58,144179554 xxx-1.yyy.zzz xxx-2.yyy.zzz HTTP/XML 938 POST /wsd/a431575d-3225-43ed-8198-7fa043b9901d%0A HTTP/1.1
450 09:17:58,144341897 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 http-alt(8080) → 59824 [ACK] Seq=1 Ack=1173 Win=31232 Len=0 TSval=146697 TSecr=1330549355
451 09:17:58,145681186 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 2926 http-alt(8080) → 59824 [ACK] Seq=1 Ack=1173 Win=31232 Len=2840 TSval=146697 TSecr=1330549355 [TCP segment of a reassembled PDU]
452 09:17:58,145692056 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=2841 Win=63488 Len=0 TSval=1330549357 TSecr=146697
453 09:17:58,145705301 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 2926 http-alt(8080) → 59824 [ACK] Seq=2841 Ack=1173 Win=31232 Len=2840 TSval=146697 TSecr=1330549355 [TCP segment of a reassembled PDU]
454 09:17:58,145720409 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 1506 http-alt(8080) → 59824 [ACK] Seq=5681 Ack=1173 Win=31232 Len=1420 TSval=146697 TSecr=1330549355 [TCP segment of a reassembled PDU]
455 09:17:58,145724366 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=5681 Win=60672 Len=0 TSval=1330549357 TSecr=146697
456 09:17:58,145730879 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=7101 Win=59264 Len=0 TSval=1330549357 TSecr=146697
457 09:17:58,145735537 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 1481 http-alt(8080) → 59824 [PSH, ACK] Seq=7101 Ack=1173 Win=31232 Len=1395 TSval=146697 TSecr=1330549355 [TCP segment of a reassembled PDU]
458 09:17:58,145735658 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 821 http-alt(8080) → 59824 [PSH, ACK] Seq=8496 Ack=1173 Win=31232 Len=735 TSval=146697 TSecr=1330549355 [TCP segment of a reassembled PDU]
459 09:17:58,145749563 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=8496 Win=57984 Len=0 TSval=1330549357 TSecr=146697
460 09:17:58,145754913 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=9231 Win=57344 Len=0 TSval=1330549357 TSecr=146697
No. Time Source Destination Protocol Length Info
483 09:18:00,247990553 xxx-2.yyy.zzz xxx-1.yyy.zzz HTTP 91 HTTP/1.1 404 Not Found (text/html)
484 09:18:00,248058370 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1173 Ack=9236 Win=64128 Len=0 TSval=1330551459 TSecr=146907
485 09:18:00,248612934 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [FIN, ACK] Seq=1173 Ack=9236 Win=64128 Len=0 TSval=1330551460 TSecr=146907
486 09:18:00,249020315 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 http-alt(8080) → 59824 [FIN, ACK] Seq=9236 Ack=1174 Win=31232 Len=0 TSval=146907 TSecr=1330551460
487 09:18:00,249060790 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 59824 → http-alt(8080) [ACK] Seq=1174 Ack=9237 Win=64128 Len=0 TSval=1330551460 TSecr=146907
No. Time Source Destination Protocol Length Info
541 09:18:06,172221392 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 94 35854 → netbios-ssn(139) [SYN] Seq=0 Win=64440 Len=0 MSS=1432 SACK_PERM=1 TSval=1330557383 TSecr=0 WS=128
542 09:18:06,172549173 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 94 netbios-ssn(139) → 35854 [SYN, ACK] Seq=0 Ack=1 Win=28400 Len=0 MSS=1432 SACK_PERM=1 TSval=147499 TSecr=1330557383 WS=128
543 09:18:06,172585501 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 35854 → netbios-ssn(139) [ACK] Seq=1 Ack=1 Win=64512 Len=0 TSval=1330557384 TSecr=147499
544 09:18:06,172646154 xxx-1.yyy.zzz xxx-2.yyy.zzz NBSS 158 Session request, to <20> from ECK001<00>
545 09:18:06,172837962 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=1 Ack=73 Win=28416 Len=0 TSval=147500 TSecr=1330557384
551 09:18:06,237978975 xxx-2.yyy.zzz xxx-1.yyy.zzz NBSS 90 Positive session response
553 09:18:06,238033476 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 35854 → netbios-ssn(139) [ACK] Seq=73 Ack=5 Win=64512 Len=0 TSval=1330557449 TSecr=147506
556 09:18:06,238318288 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB 174 Negotiate Protocol Request
557 09:18:06,238478587 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=5 Ack=161 Win=28416 Len=0 TSval=147506 TSecr=1330557450
558 09:18:06,426892879 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 292 Negotiate Protocol Response
559 09:18:06,426950056 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 35854 → netbios-ssn(139) [ACK] Seq=161 Ack=211 Win=64384 Len=0 TSval=1330557638 TSecr=147525
560 09:18:06,427112388 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 322 Negotiate Protocol Request
561 09:18:06,427196956 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=211 Ack=397 Win=29568 Len=0 TSval=147525 TSecr=1330557638
562 09:18:06,531466271 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 358 Negotiate Protocol Response
563 09:18:06,531525111 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 35854 → netbios-ssn(139) [ACK] Seq=397 Ack=483 Win=64128 Len=0 TSval=1330557743 TSecr=147535
564 09:18:06,544665626 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 252 Session Setup Request, NTLMSSP_NEGOTIATE
565 09:18:06,544728103 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=483 Ack=563 Win=30592 Len=0 TSval=147537 TSecr=1330557756
566 09:18:06,545639133 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 395 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
567 09:18:06,546146850 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 252 Session Setup Request, NTLMSSP_NEGOTIATE
568 09:18:06,546652353 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 395 Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
569 09:18:06,546812321 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 290 Session Setup Request, NTLMSSP_AUTH, User: \
570 09:18:06,564871665 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 171 Session Setup Response
571 09:18:06,565182505 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 216 Tree Connect Request Tree: \\xxx-2.local\IPC$
572 09:18:06,602774029 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=1186 Ack=1063 Win=33792 Len=0 TSval=147543 TSecr=1330557776
573 09:18:06,637466935 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 170 Tree Connect Response
574 09:18:06,638806704 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 222 Create Request File: srvsvc
575 09:18:06,638874871 xxx-2.yyy.zzz xxx-1.yyy.zzz TCP 86 netbios-ssn(139) → 35854 [ACK] Seq=1270 Ack=1199 Win=34944 Len=0 TSval=147546 TSecr=1330557850
576 09:18:06,665966266 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 242 Create Response File: srvsvc
577 09:18:06,666552710 xxx-1.yyy.zzz xxx-2.yyy.zzz DCERPC 282 Bind: call_id: 1, Fragment: Single, 1 context items: SRVSVC V3.0 (32bit NDR)
578 09:18:06,666986549 xxx-2.yyy.zzz xxx-1.yyy.zzz DCERPC 270 Bind_ack: call_id: 1, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance
579 09:18:06,668529037 xxx-1.yyy.zzz xxx-2.yyy.zzz SRVSVC 326 NetShareEnumAll request
580 09:18:06,669410942 xxx-2.yyy.zzz xxx-1.yyy.zzz SRVSVC 1066 NetShareEnumAll response
581 09:18:06,669597340 xxx-1.yyy.zzz xxx-2.yyy.zzz SMB2 178 Close Request File: srvsvc
582 09:18:06,669756387 xxx-2.yyy.zzz xxx-1.yyy.zzz SMB2 214 Close Response
583 09:18:06,711336343 xxx-1.yyy.zzz xxx-2.yyy.zzz TCP 86 35854 → netbios-ssn(139) [ACK] Seq=1727 Ack=2718 Win=64128 Len=0 TSval=1330557923 TSecr=147549
Bookmarks