[Dshield] Mydoom probe in Handler's Diary for April 1, 2004

Bill McCarty bmccarty at pt-net.net
Fri Apr 2 01:39:29 GMT 2004


Hi all,

The Handler's Diary for April 1, 2004, mentions a scan of ports 1025 135 
139 2745 3127 445 6129 80 and 8080. I have seen a quite similar scan that 
omits tcp/8080. Is that close enough to be of interest <g>?

I first saw the scan on March 17 (times UTC):

01 Apr 04 16:16:52    man version=2.0     probeid=3848370891 
STA
17 Mar 04 11:06:59    tcp  199.120.93.217.3796   ->    XXX.XXX.XX.231.2745 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3799   ->    XXX.XXX.XX.231.445 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3801   ->    XXX.XXX.XX.231.6129 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3800   ->    XXX.XXX.XX.231.3127 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3798   ->    XXX.XXX.XX.231.1025 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3802   ->    XXX.XXX.XX.231.139 
1        1         0            0           RST
17 Mar 04 11:07:00    tcp  199.120.93.217.3802   ->    XXX.XXX.XX.231.139 
1        1         0            0           RST
17 Mar 04 11:07:05    tcp  199.120.93.217.3797   ->    XXX.XXX.XX.231.135 
1        1         0            0           RST
17 Mar 04 11:06:59    tcp  199.120.93.217.3803   ->    XXX.XXX.XX.231.80 
11       12        11680        1238        RST
01 Apr 04 16:16:52    man  pkts        39  bytes        15218  drops     0 
flows    0         closed       9           SHT

Packet captures for the stream on tcp/80 appear as the last part of this 
message.

Today, on one of my class C honeynets, I saw the following similar probes. 
The number to the left is a count of the source IPs:

   13 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/1433, tcp/2745, 
tcp/3127, tcp/3410, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/2082, tcp/2745, 
tcp/3127, tcp/6129 ]
    8 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/2745, tcp/3127, 
tcp/5000, tcp/6129 ]
   49 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/2745, tcp/3127, 
tcp/6129 ]
    2 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1025, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/1433, tcp/2745, tcp/3127, 
tcp/3410, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/139, tcp/445, tcp/2745, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/139, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/445, tcp/1025, tcp/2745, tcp/3127, tcp/5000, 
tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/445, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/135, tcp/1025, tcp/2745, tcp/3127, tcp/5000, tcp/6129 ]
    1 [ tcp/80, tcp/139, tcp/445, tcp/1025, tcp/3127, tcp/5000, tcp/6129, 
udp/137 ]
    1 [ tcp/80, tcp/139, tcp/445, tcp/1025, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/139, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/139, tcp/1025, tcp/2745, tcp/6129 ]
    1 [ tcp/80, tcp/445, tcp/1025, tcp/2745, tcp/3127, tcp/5000, tcp/6129 ]
    1 [ tcp/80, tcp/445, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/445, tcp/2745, tcp/6129 ]
    1 [ tcp/80, tcp/1025, tcp/2745, tcp/3127, tcp/5000, tcp/6129 ]
    3 [ tcp/80, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/80, tcp/1025, tcp/2745, tcp/3410, tcp/6129 ]
    2 [ tcp/80, tcp/6129 ]
    3 [ tcp/135, tcp/139, tcp/445, tcp/1025, tcp/2745, tcp/3127, tcp/6129 ]
    1 [ tcp/135, tcp/139, tcp/445, tcp/1025, tcp/2745, tcp/5000, tcp/6129 ]
    1 [ tcp/135, tcp/139, tcp/2745, tcp/3127, tcp/6129 ]

Unfortunately, Honeyd seems generally not to respond with a SYN-ACK to the 
SYNs sent by these probes. Maybe my Honeyd host is maxxed out; I haven't 
yet found time to investigate. In the interim, I've so far found no packet 
captures for these probes.

Here's the packet capture for the tcp/80 stream mentioned earlier in this 
message:

03/17-11:06:59.709027 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:48071 IpLen:20 DgmLen:48 DF
******S* Seq: 0xD0557E21  Ack: 0x0  Win: 0x4000  TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:06:59.709260 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:48 DF
***A**S* Seq: 0x10DFD43F  Ack: 0xD0557E22  Win: 0x16D0  TcpLen: 28
TCP Options (4) => MSS: 1460 NOP NOP SackOK

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:06:59.781987 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:48220 IpLen:20 DgmLen:40 DF
***A**** Seq: 0xD0557E22  Ack: 0x10DFD440  Win: 0x5B4  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.242330 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51097 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD0557E22  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
53 45 41 52 43 48 20 2F 90 02 B1 02 B1 02 B1 02  SEARCH /........
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.244414 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54754 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD05583D6  Win: 0x2238  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.390730 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51149 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD05583D6  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02 B1 02  ................
B1 02 B1 02 B1 02 B1 02 B1 02 B1 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.392245 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54755 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD055898A  Win: 0x2DA0  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.555860 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51199 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD055898A  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.557718 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54756 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD0558F3E  Win: 0x3908  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.603946 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51200 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD0558F3E  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.605653 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54757 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD05594F2  Win: 0x4470  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.693660 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51216 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD05594F2  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.693916 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54758 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD0559AA6  Win: 0x4FD8  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.765727 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51224 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD0559AA6  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.767542 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54759 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD440  Ack: 0xD055A05A  Win: 0x5B40  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.771874 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54760 IpLen:20 DgmLen:659 DF
***AP*** Seq: 0x10DFD440  Ack: 0xD055A05A  Win: 0x5B40  TcpLen: 20
48 54 54 50 2F 31 2E 31 20 34 31 34 20 52 65 71  HTTP/1.1 414 Req
75 65 73 74 2D 55 52 49 20 54 6F 6F 20 4C 61 72  uest-URI Too Lar
67 65 0D 0A 44 61 74 65 3A 20 57 65 64 2C 20 31  ge..Date: Wed, 1
37 20 4D 61 72 20 32 30 30 34 20 31 39 3A 30 37  7 Mar 2004 19:07
3A 30 36 20 47 4D 54 0D 0A 53 65 72 76 65 72 3A  :06 GMT..Server:
20 41 70 61 63 68 65 2F 31 2E 33 2E 32 32 20 28   Apache/1.3.22 (
55 6E 69 78 29 20 20 28 52 65 64 2D 48 61 74 2F  Unix)  (Red-Hat/
4C 69 6E 75 78 29 20 6D 6F 64 5F 6A 6B 2F 31 2E  Linux) mod_jk/1.
32 2E 30 20 6D 6F 64 5F 70 65 72 6C 2F 31 2E 32  2.0 mod_perl/1.2
34 5F 30 31 20 50 48 50 2F 34 2E 31 2E 31 20 46  4_01 PHP/4.1.1 F
72 6F 6E 74 50 61 67 65 2F 35 2E 30 2E 32 20 6D  rontPage/5.0.2 m
6F 64 5F 73 73 6C 2F 32 2E 38 2E 35 20 4F 70 65  od_ssl/2.8.5 Ope
6E 53 53 4C 2F 30 2E 39 2E 36 62 0D 0A 43 6F 6E  nSSL/0.9.6b..Con
6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A  nection: close..
43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 74 65  Content-Type: te
78 74 2F 68 74 6D 6C 3B 20 63 68 61 72 73 65 74  xt/html; charset
3D 69 73 6F 2D 38 38 35 39 2D 31 0D 0A 0D 0A 3C  =iso-8859-1....<
21 44 4F 43 54 59 50 45 20 48 54 4D 4C 20 50 55  !DOCTYPE HTML PU
42 4C 49 43 20 22 2D 2F 2F 49 45 54 46 2F 2F 44  BLIC "-//IETF//D
54 44 20 48 54 4D 4C 20 32 2E 30 2F 2F 45 4E 22  TD HTML 2.0//EN"
3E 0A 3C 48 54 4D 4C 3E 3C 48 45 41 44 3E 0A 3C  >.<HTML><HEAD>.<
54 49 54 4C 45 3E 34 31 34 20 52 65 71 75 65 73  TITLE>414 Reques
74 2D 55 52 49 20 54 6F 6F 20 4C 61 72 67 65 3C  t-URI Too Large<
2F 54 49 54 4C 45 3E 0A 3C 2F 48 45 41 44 3E 3C  /TITLE>.</HEAD><
42 4F 44 59 3E 0A 3C 48 31 3E 52 65 71 75 65 73  BODY>.<H1>Reques
74 2D 55 52 49 20 54 6F 6F 20 4C 61 72 67 65 3C  t-URI Too Large<
2F 48 31 3E 0A 54 68 65 20 72 65 71 75 65 73 74  /H1>.The request
65 64 20 55 52 4C 27 73 20 6C 65 6E 67 74 68 20  ed URL's length
65 78 63 65 65 64 73 20 74 68 65 20 63 61 70 61  exceeds the capa
63 69 74 79 0A 6C 69 6D 69 74 20 66 6F 72 20 74  city.limit for t
68 69 73 20 73 65 72 76 65 72 2E 3C 50 3E 0A 72  his server.<P>.r
65 71 75 65 73 74 20 66 61 69 6C 65 64 3A 20 55  equest failed: U
52 49 20 74 6F 6F 20 6C 6F 6E 67 3C 50 3E 0A 3C  RI too long<P>.<
48 52 3E 0A 3C 41 44 44 52 45 53 53 3E 41 70 61  HR>.<ADDRESS>Apa
63 68 65 2F 31 2E 33 2E 32 32 20 53 65 72 76 65  che/1.3.22 Serve
72 20 61 74 20 77 65 62 68 6F 73 74 2E XX XX XX  r at webhost.XXX
XX XX XX XX XX 2E 63 6F 6D 20 50 6F 72 74 20 38  XXXXX.com Port 8
30 3C 2F 41 44 44 52 45 53 53 3E 0A 3C 2F 42 4F  0</ADDRESS>.</BO
44 59 3E 3C 2F 48 54 4D 4C 3E 0A                 DY></HTML>.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.791836 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54761 IpLen:20 DgmLen:40 DF
***A***F Seq: 0x10DFD6AB  Ack: 0xD055A05A  Win: 0x5B40  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.894573 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51256 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD055A05A  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.931052 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54762 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD6AC  Ack: 0xD055A60E  Win: 0x66A8  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.938778 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:115 TOS:0x0 ID:51257 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD055A60E  Ack: 0x10DFD440  Win: 0x4470  TcpLen: 20
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
90 90 90 90                                      ....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:06.940184 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54763 IpLen:20 DgmLen:40 DF
***A**** Seq: 0x10DFD6AC  Ack: 0xD055ABC2  Win: 0x7210  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:09.171672 XXX.XXX.XX.231:80 -> 199.120.93.217:3803
TCP TTL:64 TOS:0x0 ID:54764 IpLen:20 DgmLen:659 DF
***AP**F Seq: 0x10DFD440  Ack: 0xD055ABC2  Win: 0x7210  TcpLen: 20
48 54 54 50 2F 31 2E 31 20 34 31 34 20 52 65 71  HTTP/1.1 414 Req
75 65 73 74 2D 55 52 49 20 54 6F 6F 20 4C 61 72  uest-URI Too Lar
67 65 0D 0A 44 61 74 65 3A 20 57 65 64 2C 20 31  ge..Date: Wed, 1
37 20 4D 61 72 20 32 30 30 34 20 31 39 3A 30 37  7 Mar 2004 19:07
3A 30 36 20 47 4D 54 0D 0A 53 65 72 76 65 72 3A  :06 GMT..Server:
20 41 70 61 63 68 65 2F 31 2E 33 2E 32 32 20 28   Apache/1.3.22 (
55 6E 69 78 29 20 20 28 52 65 64 2D 48 61 74 2F  Unix)  (Red-Hat/
4C 69 6E 75 78 29 20 6D 6F 64 5F 6A 6B 2F 31 2E  Linux) mod_jk/1.
32 2E 30 20 6D 6F 64 5F 70 65 72 6C 2F 31 2E 32  2.0 mod_perl/1.2
34 5F 30 31 20 50 48 50 2F 34 2E 31 2E 31 20 46  4_01 PHP/4.1.1 F
72 6F 6E 74 50 61 67 65 2F 35 2E 30 2E 32 20 6D  rontPage/5.0.2 m
6F 64 5F 73 73 6C 2F 32 2E 38 2E 35 20 4F 70 65  od_ssl/2.8.5 Ope
6E 53 53 4C 2F 30 2E 39 2E 36 62 0D 0A 43 6F 6E  nSSL/0.9.6b..Con
6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A  nection: close..
43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 74 65  Content-Type: te
78 74 2F 68 74 6D 6C 3B 20 63 68 61 72 73 65 74  xt/html; charset
3D 69 73 6F 2D 38 38 35 39 2D 31 0D 0A 0D 0A 3C  =iso-8859-1....<
21 44 4F 43 54 59 50 45 20 48 54 4D 4C 20 50 55  !DOCTYPE HTML PU
42 4C 49 43 20 22 2D 2F 2F 49 45 54 46 2F 2F 44  BLIC "-//IETF//D
54 44 20 48 54 4D 4C 20 32 2E 30 2F 2F 45 4E 22  TD HTML 2.0//EN"
3E 0A 3C 48 54 4D 4C 3E 3C 48 45 41 44 3E 0A 3C  >.<HTML><HEAD>.<
54 49 54 4C 45 3E 34 31 34 20 52 65 71 75 65 73  TITLE>414 Reques
74 2D 55 52 49 20 54 6F 6F 20 4C 61 72 67 65 3C  t-URI Too Large<
2F 54 49 54 4C 45 3E 0A 3C 2F 48 45 41 44 3E 3C  /TITLE>.</HEAD><
42 4F 44 59 3E 0A 3C 48 31 3E 52 65 71 75 65 73  BODY>.<H1>Reques
74 2D 55 52 49 20 54 6F 6F 20 4C 61 72 67 65 3C  t-URI Too Large<
2F 48 31 3E 0A 54 68 65 20 72 65 71 75 65 73 74  /H1>.The request
65 64 20 55 52 4C 27 73 20 6C 65 6E 67 74 68 20  ed URL's length
65 78 63 65 65 64 73 20 74 68 65 20 63 61 70 61  exceeds the capa
63 69 74 79 0A 6C 69 6D 69 74 20 66 6F 72 20 74  city.limit for t
68 69 73 20 73 65 72 76 65 72 2E 3C 50 3E 0A 72  his server.<P>.r
65 71 75 65 73 74 20 66 61 69 6C 65 64 3A 20 55  equest failed: U
52 49 20 74 6F 6F 20 6C 6F 6E 67 3C 50 3E 0A 3C  RI too long<P>.<
48 52 3E 0A 3C 41 44 44 52 45 53 53 3E 41 70 61  HR>.<ADDRESS>Apa
63 68 65 2F 31 2E 33 2E 32 32 20 53 65 72 76 65  che/1.3.22 Serve
72 20 61 74 20 77 65 62 68 6F 73 74 2E XX XX XX  r at webhost.XXX
XX XX XX XX XX 2E 63 6F 6D 20 50 6F 72 74 20 38  XXXXX.com Port 8
30 3C 2F 41 44 44 52 45 53 53 3E 0A 3C 2F 42 4F  0</ADDRESS>.</BO
44 59 3E 3C 2F 48 54 4D 4C 3E 0A                 DY></HTML>.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

03/17-11:07:09.172079 199.120.93.217:3803 -> XXX.XXX.XX.231:80
TCP TTL:128 TOS:0x0 ID:7053 IpLen:20 DgmLen:40 DF
*****R** Seq: 0xD055ABC2  Ack: 0x10DFD440  Win: 0x0  TcpLen: 20

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Run time for packet processing was 0.3092 seconds


This capture resembles that mentioned in the Diary for February 25, and 
which I reported on the following day.


Cheers,

---------------------------------------------------
Bill McCarty, Ph.D.
Professor of Information Technology
Azusa Pacific University





More information about the list mailing list