Date: Wed, 6 Jan 2010 15:40:22 -0600 From: "M. Keith Thompson" <m.keith.thompson@gmail.com> To: freebsd-pf@freebsd.org Subject: Re: ftp problem Message-ID: <fc2243911001061340l5fd75af5hc90e6cbd659d0d19@mail.gmail.com> In-Reply-To: <7731938b1001060923n5de4b511of07b8c63cff4e011@mail.gmail.com> References: <fc2243911001060809m5417b810vf2ed40c8a969fb5f@mail.gmail.com> <7731938b1001060923n5de4b511of07b8c63cff4e011@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 01/06/10 09:57, M. Keith Thompson wrote: > The states and tcpdump are with scrub turned off. I tried that and it > did not change things. > > Unsuccessful: > > self tcp xxx.yyy.15.125:21<- vvv.zzz.226.92:50187 TIME_WAIT:TIME_WAIT > self tcp xxx.yyy.15.125:20<- vvv.zzz.226.92:59433 FIN_WAIT_2:FIN_WAIT_2 > self tcp xxx.yyy.15.125:20<- vvv.zzz.226.92:59434 FIN_WAIT_2:FIN_WAIT_2 > > Successful: > self tcp xxx.yyy.15.125:21<- vvv.zzz.226.92:50188 FIN_WAIT_2:FIN_WAIT_2 > self tcp xxx.yyy.15.125:20<- vvv.zzz.226.92:59435 FIN_WAIT_2:FIN_WAIT_2 > > On Wed, Jan 6, 2010 at 11:23 AM, Peter Maxwell<peter at allicient.co.uk> wrote: >> 2010/1/6 M. Keith Thompson<m.keith.thompson at gmail.com>: >>> I have a very screwy problem. I have a pure-ftp server running pf on >>> FreeBSD 7.0. For the most part the server works fine; users upload >>> and download multi-megabyte files daily. However, I have one client >>> (HP-UX) that can not get files larger that 98K. If I turn off pf, it >>> works fine. The pflog does not show any packets from the IP that does >>> not work. I am totally lost; any ideas? >> >> >> Off the top of my head: packet normalisation/scrub directives, the >> other one would be to post your ruleset and a tcpdump of the session >> so folk have something to work with. >> >> Also, what happens to the FTP data and control connections - do they >> just stall or are the RSTs, etc? What does your state table show? The ftp server is sending FIN on the data connection after the first PSH of data. It would be interesting to see the before and after contents of the ftp command channel if you could repeat only the first failed transfer with the dump using '-s 0 -X' tcpdump flags. 11:40:30.476375 IP (tos 0x8, ttl 64, id 13412, offset 0, flags [DF], proto: TCP (6), length: 757) xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.59433: P 1:706(705) ack 1 win 33026 <nop,nop,timestamp 1091991329 31321002> 11:40:30.476386 IP (tos 0x8, ttl 64, id 13413, offset 0, flags [DF], proto: TCP (6), length: 52) xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.59433: F, cksum 0x3a26 (correct), 706:706(0) ack 1 win 33026 <nop,nop,timestamp 1091991329 31321002> Here is a dump with the requested flags. Some of the data was removed for security & brevity. listening on em0, link-type EN10MB (Ethernet), capture size 65535 bytes 14:40:47.964049 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: S 361770991:361770991(0) win 16384 <mss 1360,nop,wscale 0,nop,nop,timestamp 31342636 0> 0x0000: 4500 003c 2ecc 0000 3406 2985 a4eb e25c E..<....4.)....\ 0x0010: 97a6 0f7d c419 0015 1590 2fef 0000 0000 ...}....../..... 0x0020: a002 4000 9148 0000 0204 0550 0103 0300 ..@..H.....P.... 0x0030: 0101 080a 01de 402c 0000 0000 ......@,.... 14:40:47.964098 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: S 3213011514:3213011514(0) ack 361770992 win 65535 <mss 1460,nop,wscale 1,nop,nop,timestamp 1102805997 31342636> 0x0000: 4500 003c 5adf 4000 4006 b171 97a6 0f7d E..<Z.@.@..q...} 0x0010: a4eb e25c 0015 c419 bf82 aa3a 1590 2ff0 ...\.......:../. 0x0020: a012 ffff a96c 0000 0204 05b4 0103 0301 .....l.......... 0x0030: 0101 080a 41bb 7bed 01de 402c ....A.{...@, 14:40:48.130826 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: . ack 1 win 17680 <nop,nop,timestamp 31342636 1102805997> 0x0000: 4500 0034 2f1c 0000 3406 293d a4eb e25c E..4/...4.)=...\ 0x0010: 97a6 0f7d c419 0015 1590 2ff0 bf82 aa3b ...}....../....; 0x0020: 8010 4510 9021 0000 0101 080a 01de 402c ..E..!........@, 0x0030: 41bb 7bed A.{. 14:40:48.132208 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 1:260(259) ack 1 win 33026 <nop,nop,timestamp 1102806165 31342636> 0x0000: 4510 0137 5aee 4000 4006 b057 97a6 0f7d E..7Z.@.@..W...} 0x0010: a4eb e25c 0015 c419 bf82 aa3b 1590 2ff0 ...\.......;../. 0x0020: 8018 8102 649f 0000 0101 080a 41bb 7c95 ....d.......A.|. 0x0030: 01de 402c 3232 302d 2d2d 2d2d 2d2d 2d2d ..@,220--------- 0x0040: 2d20 5765 6c63 6f6d 6520 746f 2050 7572 -.Welcome.to.Pur 0x0050: 652d 4654 5064 205b 7072 6976 7365 705d e-FTPd.[privsep] 0x0060: 202d 2d2d 2d2d 2d2d 2d2d 2d0d 0a32 3230 .----------..220 0x0070: 2d59 6f75 2061 7265 2075 7365 7220 6e75 -You.are.user.nu 0x0080: 6d62 6572 2033 206f 6620 3530 2061 6c6c mber.3.of.50.all 0x0090: 6f77 6564 2e0d 0a32 3230 2d4c 6f63 616c owed...220-Local 0x00a0: 2074 696d 6520 6973 206e 6f77 2031 343a .time.is.now.14: 0x00b0: 3430 2e20 5365 7276 6572 2070 6f72 743a 40..Server.port: 0x00c0: 2032 312e 0d0a 3232 302d 5468 6973 2069 .21...220-This.i 0x00d0: 7320 6120 7072 6976 6174 6520 7379 7374 s.a.private.syst 0x00e0: 656d 202d 204e 6f20 616e 6f6e 796d 6f75 em.-.No.anonymou 0x00f0: 7320 6c6f 6769 6e0d 0a32 3230 2059 6f75 s.login..220.You 0x0100: 2077 696c 6c20 6265 2064 6973 636f 6e6e .will.be.disconn 0x0110: 6563 7465 6420 6166 7465 7220 3130 206d ected.after.10.m 0x0120: 696e 7574 6573 206f 6620 696e 6163 7469 inutes.of.inacti 0x0130: 7669 7479 2e0d 0a vity... 14:40:48.300852 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 1:14(13) ack 260 win 17680 <nop,nop,timestamp 31342636 1102806165> 0x0000: 4500 0041 2f6c 0000 3406 28e0 a4eb e25c E..A/l..4.(....\ 0x0010: 97a6 0f7d c419 0015 1590 2ff0 bf82 ab3e ...}....../....> 0x0020: 8018 4510 9683 0000 0101 080a 01de 402c ..E...........@, 0x0030: 41bb 7c95 5553 4552 2065 6461 6564 690d A.|.USER.edaedi. 0x0040: 0a . 14:40:48.300984 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 260:299(39) ack 14 win 33026 <nop,nop,timestamp 1102806334 31342636> 0x0000: 4510 005b 5af5 4000 4006 b12c 97a6 0f7d E..[Z.@.@..,...} 0x0010: a4eb e25c 0015 c419 bf82 ab3e 1590 2ffd ...\.......>../. 0x0020: 8018 8102 d846 0000 0101 080a 41bb 7d3e .....F......A.}> . . . 14:40:48.469127 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 14:29(15) ack 299 win 17680 <nop,nop,timestamp 31342637 1102806334> 0x0000: 4500 0043 2fba 0000 3406 2890 a4eb e25c E..C/...4.(....\ 0x0010: 97a6 0f7d c419 0015 1590 2ffd bf82 ab65 ...}....../....e 0x0020: 8018 4510 9485 0000 0101 080a 01de 402d ..E...........@- . . 14:40:48.474801 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 299:381(82) ack 29 win 33026 <nop,nop,timestamp 1102806508 31342637> 0x0000: 4510 0086 5afb 4000 4006 b0fb 97a6 0f7d E...Z.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ab65 1590 300c ...\.......e..0. 0x0020: 8018 8102 dce4 0000 0101 080a 41bb 7dec ............A.}. . . . 0x0060: 2020 2020 0d0a 3233 3020 4f4b 2e20 4375 ......230.OK..Cu 0x0070: 7272 656e 7420 6469 7265 6374 6f72 7920 rrent.directory. 0x0080: 6973 202f 0d0a is./.. 14:40:48.644524 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 29:34(5) ack 381 win 17680 <nop,nop,timestamp 31342637 1102806508> 0x0000: 4500 0039 3056 0000 3406 27fe a4eb e25c E..90V..4.'....\ 0x0010: 97a6 0f7d c419 0015 1590 300c bf82 abb7 ...}......0..... 0x0020: 8018 4510 ee17 0000 0101 080a 01de 402d ..E...........@- 0x0030: 41bb 7dec 5057 440d 0a A.}.PWD.. 14:40:48.644575 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 381:415(34) ack 34 win 33026 <nop,nop,timestamp 1102806677 31342637> 0x0000: 4510 0056 5b0b 4000 4006 b11b 97a6 0f7d E..V[.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 abb7 1590 3011 ...\..........0. 0x0020: 8018 8102 c66e 0000 0101 080a 41bb 7e95 .....n......A.~. 0x0030: 01de 402d 3235 3720 222f 2220 6973 2079 ..@-257."/".is.y 0x0040: 6f75 7220 6375 7272 656e 7420 6c6f 6361 our.current.loca 0x0050: 7469 6f6e 0d0a tion.. 14:40:48.813676 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 34:40(6) ack 415 win 17680 <nop,nop,timestamp 31342637 1102806677> 0x0000: 4500 003a 3091 0000 3406 27c2 a4eb e25c E..:0...4.'....\ 0x0010: 97a6 0f7d c419 0015 1590 3011 bf82 abd9 ...}......0..... 0x0020: 8018 4510 f707 0000 0101 080a 01de 402d ..E...........@- 0x0030: 41bb 7e95 4645 4154 0d0a A.~.FEAT.. 14:40:48.813719 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 415:609(194) ack 40 win 33026 <nop,nop,timestamp 1102806846 31342637> 0x0000: 4510 00f6 5b12 4000 4006 b074 97a6 0f7d E...[.@.@..t...} 0x0010: a4eb e25c 0015 c419 bf82 abd9 1590 3017 ...\..........0. 0x0020: 8018 8102 8c53 0000 0101 080a 41bb 7f3e .....S......A..> 0x0030: 01de 402d 3231 312d 4578 7465 6e73 696f ..@-211-Extensio 0x0040: 6e73 2073 7570 706f 7274 6564 3a0d 0a20 ns.supported:... 0x0050: 4550 5254 0d0a 2049 444c 450d 0a20 4d44 EPRT...IDLE...MD 0x0060: 544d 0d0a 2053 495a 450d 0a20 5245 5354 TM...SIZE...REST 0x0070: 2053 5452 4541 4d0d 0a20 4d4c 5354 2074 .STREAM...MLST.t 0x0080: 7970 652a 3b73 697a 652a 3b73 697a 642a ype*;size*;sizd* 0x0090: 3b6d 6f64 6966 792a 3b55 4e49 582e 6d6f ;modify*;UNIX.mo 0x00a0: 6465 2a3b 554e 4958 2e75 6964 2a3b 554e de*;UNIX.uid*;UN 0x00b0: 4958 2e67 6964 2a3b 756e 6971 7565 2a3b IX.gid*;unique*; 0x00c0: 0d0a 204d 4c53 440d 0a20 4553 5441 0d0a ...MLSD...ESTA.. 0x00d0: 2050 4153 560d 0a20 4550 5356 0d0a 2053 .PASV...EPSV...S 0x00e0: 5053 560d 0a20 4553 5450 0d0a 3231 3120 PSV...ESTP..211. 0x00f0: 456e 642e 0d0a End... 14:40:48.986324 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 40:51(11) ack 609 win 17680 <nop,nop,timestamp 31342638 1102806846> 0x0000: 4500 003f 30ce 0000 3406 2780 a4eb e25c E..?0...4.'....\ 0x0010: 97a6 0f7d c419 0015 1590 3017 bf82 ac9b ...}......0..... 0x0020: 8018 4510 3cea 0000 0101 080a 01de 402e ..E.<.........@. 0x0030: 41bb 7f3e 4845 4c50 2053 4954 450d 0a A..>HELP.SITE.. 14:40:48.986365 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 609:726(117) ack 51 win 33026 <nop,nop,timestamp 1102807019 31342638> 0x0000: 4510 00a9 5b17 4000 4006 b0bc 97a6 0f7d E...[.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ac9b 1590 3022 ...\..........0" 0x0020: 8018 8102 e800 0000 0101 080a 41bb 7feb ............A... 0x0030: 01de 402e 3231 342d 5468 6520 666f 6c6c ..@.214-The.foll 0x0040: 6f77 696e 6720 5349 5445 2063 6f6d 6d61 owing.SITE.comma 0x0050: 6e64 7320 6172 6520 7265 636f 676e 697a nds.are.recogniz 0x0060: 6564 0d0a 2041 4c49 4153 0d0a 2043 484d ed...ALIAS...CHM 0x0070: 4f44 0d0a 2049 444c 450d 0a20 5554 494d OD...IDLE...UTIM 0x0080: 450d 0a32 3134 2050 7572 652d 4654 5064 E..214.Pure-FTPd 0x0090: 202d 2068 7474 703a 2f2f 7075 7265 6674 .-.http://pureft 0x00a0: 7064 2e6f 7267 2f0d 0a pd.org/.. 14:40:49.160097 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 51:80(29) ack 726 win 17680 <nop,nop,timestamp 31342638 1102807019> 0x0000: 4500 0051 3118 0000 3406 2724 a4eb e25c E..Q1...4.'$...\ 0x0010: 97a6 0f7d c419 0015 1590 3022 bf82 ad10 ...}......0".... 0x0020: 8018 4510 9e1a 0000 0101 080a 01de 402e ..E...........@. 0x0030: 41bb 7feb 504f 5254 2031 3634 2c32 3335 A...PORT.164,235 0x0040: 2c32 3236 2c39 322c 3233 352c 3130 330d ,226,92,235,103. 0x0050: 0a . 14:40:49.160234 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 726:755(29) ack 80 win 33026 <nop,nop,timestamp 1102807193 31342638> 0x0000: 4510 0051 5b26 4000 4006 b105 97a6 0f7d E..Q[&@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad10 1590 303f ...\..........0? 0x0020: 8018 8102 927b 0000 0101 080a 41bb 8099 .....{......A... 0x0030: 01de 402e 3230 3020 504f 5254 2063 6f6d ..@.200.PORT.com 0x0040: 6d61 6e64 2073 7563 6365 7373 6675 6c0d mand.successful. 0x0050: 0a . 14:40:49.329499 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 80:105(25) ack 755 win 17680 <nop,nop,timestamp 31342638 1102807193> 0x0000: 4500 004d 3160 0000 3406 26e0 a4eb e25c E..M1`..4.&....\ 0x0010: 97a6 0f7d c419 0015 1590 303f bf82 ad2d ...}......0?...- 0x0020: 8018 4510 fbea 0000 0101 080a 01de 402e ..E...........@. . . 14:40:49.329635 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60263: S 2183710806:2183710806(0) win 65535 <mss 1460,nop,wscale 1,nop,nop,timestamp 1102807362 0,sackOK,eol> 0x0000: 4500 0040 5b2d 4000 4006 b11f 97a6 0f7d E..@[-@.@......} 0x0010: a4eb e25c 0014 eb67 8228 c856 0000 0000 ...\...g.(.V.... 0x0020: b002 ffff 0f9d 0000 0204 05b4 0103 0301 ................ 0x0030: 0101 080a 41bb 8142 0000 0000 0402 0000 ....A..B........ 14:40:49.429011 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: . ack 105 win 33026 <nop,nop,timestamp 1102807462 31342638> 0x0000: 4510 0034 5b2e 4000 4006 b11a 97a6 0f7d E..4[.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad2d 1590 3058 ...\.......-..0X 0x0020: 8010 8102 4b1a 0000 0101 080a 41bb 81a6 ....K.......A... 0x0030: 01de 402e ..@. 14:40:49.497150 IP vvv.zzz.226.92.60263 > xxx.yyy.15.125.ftp-data: S 3714191276:3714191276(0) ack 2183710807 win 17680 <mss 1360,nop,wscale 1,nop,nop,timestamp 31342639 1102807362> 0x0000: 4500 003c 31ae 0000 3406 26a3 a4eb e25c E..<1...4.&....\ 0x0010: 97a6 0f7d eb67 0014 dd62 0fac 8228 c857 ...}.g...b...(.W 0x0020: a012 4510 afc9 0000 0204 0550 0103 0301 ..E........P.... 0x0030: 0101 080a 01de 402f 41bb 8142 ......@/A..B 14:40:49.497191 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60263: . ack 1 win 33026 <nop,nop,timestamp 1102807530 31342639> 0x0000: 4500 0034 5b34 4000 4006 b124 97a6 0f7d E..4[4@.@..$...} 0x0010: a4eb e25c 0014 eb67 8228 c857 dd62 0fad ...\...g.(.W.b.. 0x0020: 8010 8102 9e90 0000 0101 080a 41bb 81ea ............A... 0x0030: 01de 402f ..@/ 14:40:49.497227 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 755:785(30) ack 105 win 33026 <nop,nop,timestamp 1102807530 31342638> 0x0000: 4510 0052 5b35 4000 4006 b0f5 97a6 0f7d E..R[5@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad2d 1590 3058 ...\.......-..0X 0x0020: 8018 8102 e92a 0000 0101 080a 41bb 81ea .....*......A... 0x0030: 01de 402e 3135 3020 436f 6e6e 6563 7469 ..@.150.Connecti 0x0040: 6e67 2074 6f20 706f 7274 2036 3032 3633 ng.to.port.60263 0x0050: 0d0a .. 14:40:49.498433 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60263: P 1:659(658) ack 1 win 33026 <nop,nop,timestamp 1102807531 31342639> 0x0000: 4508 02c6 5b36 4000 4006 ae88 97a6 0f7d E...[6@.@......} 0x0010: a4eb e25c 0014 eb67 8228 c857 dd62 0fad ...\...g.(.W.b.. 0x0020: 8018 8102 6e98 0000 0101 080a 41bb 81eb ....n.......A... . . . . . . . . . . . . . . . . . . . . 14:40:49.498445 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60263: F 659:659(0) ack 1 win 33026 <nop,nop,timestamp 1102807531 31342639> 0x0000: 4508 0034 5b37 4000 4006 b119 97a6 0f7d E..4[7@.@......} 0x0010: a4eb e25c 0014 eb67 8228 cae9 dd62 0fad ...\...g.(...b.. 0x0020: 8011 8102 9bfc 0000 0101 080a 41bb 81eb ............A... 0x0030: 01de 402f ..@/ 14:40:49.498480 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 785:807(22) ack 105 win 33026 <nop,nop,timestamp 1102807531 31342638> 0x0000: 4510 004a 5b38 4000 4006 b0fa 97a6 0f7d E..J[8@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad4b 1590 3058 ...\.......K..0X 0x0020: 8018 8102 67f6 0000 0101 080a 41bb 81eb ....g.......A... 0x0030: 01de 402e 3232 3620 3134 206d 6174 6368 ..@.226.14.match 0x0040: 6573 2074 6f74 616c 0d0a es.total.. 14:40:49.667424 IP vvv.zzz.226.92.60263 > xxx.yyy.15.125.ftp-data: . ack 660 win 8510 <nop,nop,timestamp 31342639 1102807531> 0x0000: 4500 0034 3251 0000 3406 2608 a4eb e25c E..42Q..4.&....\ 0x0010: 97a6 0f7d eb67 0014 dd62 0fad 8228 caea ...}.g...b...(.. 0x0020: 8010 213e fbc0 0000 0101 080a 01de 402f ..!>..........@/ 0x0030: 41bb 81eb A... 14:40:49.667430 IP vvv.zzz.226.92.60263 > xxx.yyy.15.125.ftp-data: F 1:1(0) ack 660 win 8840 <nop,nop,timestamp 31342639 1102807531> 0x0000: 4500 0034 3253 0000 3406 2606 a4eb e25c E..42S..4.&....\ 0x0010: 97a6 0f7d eb67 0014 dd62 0fad 8228 caea ...}.g...b...(.. 0x0020: 8011 2288 fa75 0000 0101 080a 01de 402f .."..u........@/ 0x0030: 41bb 81eb A... 14:40:49.667466 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60263: . ack 2 win 33025 <nop,nop,timestamp 1102807700 31342639> 0x0000: 4508 0034 5b47 4000 4006 b109 97a6 0f7d E..4[G@.@......} 0x0010: a4eb e25c 0014 eb67 8228 caea dd62 0fae ...\...g.(...b.. 0x0020: 8010 8101 9b53 0000 0101 080a 41bb 8294 .....S......A... 0x0030: 01de 402f ..@/ 14:40:49.668674 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 105:113(8) ack 807 win 17680 <nop,nop,timestamp 31342639 1102807530> 0x0000: 4500 003c 3257 0000 3406 25fa a4eb e25c E..<2W..4.%....\ 0x0010: 97a6 0f7d c419 0015 1590 3058 bf82 ad61 ...}......0X...a 0x0020: 8018 4510 b491 0000 0101 080a 01de 402f ..E...........@/ 0x0030: 41bb 81ea 5459 5045 2049 0d0a A...TYPE.I.. 14:40:49.668739 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 807:837(30) ack 113 win 33026 <nop,nop,timestamp 1102807701 31342639> 0x0000: 4510 0052 5b48 4000 4006 b0e2 97a6 0f7d E..R[H@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad61 1590 3060 ...\.......a..0` 0x0020: 8018 8102 6aba 0000 0101 080a 41bb 8295 ....j.......A... 0x0030: 01de 402f 3230 3020 5459 5045 2069 7320 ..@/200.TYPE.is. 0x0040: 6e6f 7720 382d 6269 7420 6269 6e61 7279 now.8-bit.binary 0x0050: 0d0a .. 14:40:49.839452 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 113:165(52) ack 837 win 17680 <nop,nop,timestamp 31342639 1102807701> 0x0000: 4500 0068 328d 0000 3406 2598 a4eb e25c E..h2...4.%....\ 0x0010: 97a6 0f7d c419 0015 1590 3060 bf82 ad7f ...}......0`.... 0x0020: 8018 4510 e7d6 0000 0101 080a 01de 402f ..E...........@/ . . . . 14:40:49.839526 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 837:849(12) ack 165 win 33026 <nop,nop,timestamp 1102807872 31342639> 0x0000: 4510 0040 5b4f 4000 4006 b0ed 97a6 0f7d E..@[O@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad7f 1590 3094 ...\..........0. 0x0020: 8018 8102 3de0 0000 0101 080a 41bb 8340 ....=.......A..@ 0x0030: 01de 402f 3231 3320 3533 3136 3238 0d0a ..@/213.531628.. 14:40:50.008225 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 165:217(52) ack 849 win 17680 <nop,nop,timestamp 31342640 1102807872> 0x0000: 4500 0068 32ca 0000 3406 255b a4eb e25c E..h2...4.%[...\ 0x0010: 97a6 0f7d c419 0015 1590 3094 bf82 ad8b ...}......0..... 0x0020: 8018 4510 f2e7 0000 0101 080a 01de 4030 ..E...........@0 . . . . 14:40:50.008397 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 849:869(20) ack 217 win 33026 <nop,nop,timestamp 1102808041 31342640> 0x0000: 4510 0048 5b54 4000 4006 b0e0 97a6 0f7d E..H[T@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad8b 1590 30c8 ...\..........0. 0x0020: 8018 8102 7b22 0000 0101 080a 41bb 83e9 ....{"......A... 0x0030: 01de 4030 3231 3320 3230 3039 3132 3330 ..@0213.20091230 0x0040: 3139 3037 3231 0d0a 190721.. 14:40:50.185371 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 217:246(29) ack 869 win 17680 <nop,nop,timestamp 31342640 1102808041> 0x0000: 4500 0051 331b 0000 3406 2521 a4eb e25c E..Q3...4.%!...\ 0x0010: 97a6 0f7d c419 0015 1590 30c8 bf82 ad9f ...}......0..... 0x0020: 8018 4510 97e5 0000 0101 080a 01de 4030 ..E...........@0 0x0030: 41bb 83e9 504f 5254 2031 3634 2c32 3335 A...PORT.164,235 0x0040: 2c32 3236 2c39 322c 3233 352c 3130 340d ,226,92,235,104. 0x0050: 0a . 14:40:50.185564 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 869:898(29) ack 246 win 33026 <nop,nop,timestamp 1102808218 31342640> 0x0000: 4510 0051 5b63 4000 4006 b0c8 97a6 0f7d E..Q[c@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ad9f 1590 30e5 ...\..........0. 0x0020: 8018 8102 8d43 0000 0101 080a 41bb 849a .....C......A... 0x0030: 01de 4030 3230 3020 504f 5254 2063 6f6d ..@0200.PORT.com 0x0040: 6d61 6e64 2073 7563 6365 7373 6675 6c0d mand.successful. 0x0050: 0a . 14:40:50.358769 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: P 246:298(52) ack 898 win 17680 <nop,nop,timestamp 31342640 1102808218> 0x0000: 4500 0068 335f 0000 3406 24c6 a4eb e25c E..h3_..4.$....\ 0x0010: 97a6 0f7d c419 0015 1590 30e5 bf82 adbc ...}......0..... 0x0020: 8018 4510 ec05 0000 0101 080a 01de 4030 ..E...........@0 . . . . 14:40:50.358879 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: S 1454955342:1454955342(0) win 65535 <mss 1460,nop,wscale 1,nop,nop,timestamp 1102808391 0,sackOK,eol> 0x0000: 4500 0040 5b6b 4000 4006 b0e1 97a6 0f7d E..@[k@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 db4e 0000 0000 ...\...hV..N.... 0x0020: b002 ffff 240f 0000 0204 05b4 0103 0301 ....$........... 0x0030: 0101 080a 41bb 8547 0000 0000 0402 0000 ....A..G........ 14:40:50.458340 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: . ack 298 win 33026 <nop,nop,timestamp 1102808491 31342640> 0x0000: 4510 0034 5b6c 4000 4006 b0dc 97a6 0f7d E..4[l@.@......} 0x0010: a4eb e25c 0015 c419 bf82 adbc 1590 3119 ...\..........1. 0x0020: 8010 8102 45c3 0000 0101 080a 41bb 85ab ....E.......A... 0x0030: 01de 4030 ..@0 14:40:50.534790 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: S 1649882274:1649882274(0) ack 1454955343 win 17680 <mss 1360,nop,wscale 1,nop,nop,timestamp 31342641 1102808391> 0x0000: 4500 003c 33ab 0000 3406 24a6 a4eb e25c E..<3...4.$....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a2 56b8 db4f ...}.h..bW4.V..O 0x0020: a012 4510 1a4f 0000 0204 0550 0103 0301 ..E..O.....P.... 0x0030: 0101 080a 01de 4031 41bb 8547 ......@1A..G 14:40:50.534838 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . ack 1 win 33026 <nop,nop,timestamp 1102808567 31342641> 0x0000: 4500 0034 5b71 4000 4006 b0e7 97a6 0f7d E..4[q@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 db4f 6257 34a3 ...\...hV..ObW4. 0x0020: 8010 8102 090e 0000 0101 080a 41bb 85f7 ............A... 0x0030: 01de 4031 ..@1 14:40:50.534898 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 898:958(60) ack 298 win 33026 <nop,nop,timestamp 1102808567 31342640> 0x0000: 4510 0070 5b72 4000 4006 b09a 97a6 0f7d E..p[r@.@......} 0x0010: a4eb e25c 0015 c419 bf82 adbc 1590 3119 ...\..........1. 0x0020: 8018 8102 5130 0000 0101 080a 41bb 85f7 ....Q0......A... 0x0030: 01de 4030 3135 302d 436f 6e6e 6563 7469 ..@0150-Connecti 0x0040: 6e67 2074 6f20 706f 7274 2036 3032 3634 ng.to.port.60264 0x0050: 0d0a 3135 3020 3531 392e 3220 6b62 7974 ..150.519.2.kbyt 0x0060: 6573 2074 6f20 646f 776e 6c6f 6164 0d0a es.to.download.. 14:40:50.535475 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 1:1349(1348) ack 1 win 33026 <nop,nop,timestamp 1102808568 31342641> 0x0000: 4508 0578 5b73 4000 4006 ab99 97a6 0f7d E..x[s@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 db4f 6257 34a3 ...\...hV..ObW4. 0x0020: 8010 8102 f04d 0000 0101 080a 41bb 85f8 .....M......A... 0x0030: 01de 4031 3c3f 786d 6c20 7665 7273 696f ..@1<?xml.versio 0x0040: 6e3d 2231 2e30 2220 656e 636f 6469 6e67 n="1.0".encoding 0x0050: 3d22 5554 462d 3822 203f 3e0a 0a3c 446f ="UTF-8".?>..<Do 0x0060: 6375 6d65 6e74 3e0a 093c 4177 6172 643e cument>..<Award> 0x0070: 0a09 093c 446f 6375 6d65 6e74 4261 7365 ...<DocumentBase . . . . 0x0530: 3c2f 5265 6c65 6173 6544 6174 653e 0a09 </ReleaseDate>.. 0x0540: 0909 093c 5570 6772 6164 6553 7461 7475 ...<UpgradeStatu 0x0550: 733e 303c 2f55 7067 7261 6465 5374 6174 s>0</UpgradeStat 0x0560: 7573 3e0a 0909 093c 2f44 6f63 756d 656e us>....</Documen 0x0570: 7444 6574 6169 6c3e tDetail> 14:40:50.836863 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 1349 win 8320 <nop,nop,timestamp 31342641 1102808568> 0x0000: 4500 0034 3495 0000 3406 23c4 a4eb e25c E..44...4.#....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b8 e093 ...}.h..bW4.V... 0x0020: 8010 2080 644b 0000 0101 080a 01de 4031 ....dK........@1 0x0030: 41bb 85f8 A... 14:40:50.836869 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: . ack 958 win 17680 <nop,nop,timestamp 31342641 1102808567> 0x0000: 4500 0034 3496 0000 3406 23c3 a4eb e25c E..44...4.#....\ 0x0010: 97a6 0f7d c419 0015 1590 3119 bf82 adf8 ...}......1..... 0x0020: 8010 4510 812c 0000 0101 080a 01de 4031 ..E..,........@1 0x0030: 41bb 85f7 A... 14:40:50.836898 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 1349:2697(1348) ack 1 win 33026 <nop,nop,timestamp 1102808869 31342641> 0x0000: 4508 0578 5b84 4000 4006 ab88 97a6 0f7d E..x[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 e093 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 ff2b 0000 0101 080a 41bb 8725 .....+......A..% 0x0030: 01de 4031 0a09 093c 2f44 6f63 756d 656e ..@1...</Documen . . . . . . 14:40:50.836908 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 2697:4045(1348) ack 1 win 33026 <nop,nop,timestamp 1102808869 31342641> 0x0000: 4508 0578 5b85 4000 4006 ab87 97a6 0f7d E..x[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 e5d7 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 3782 0000 0101 080a 41bb 8725 ....7.......A..% 0x0030: 01de 4031 436f 756e 7479 3e0a 0909 0909 ..@1County>..... . . . . 0x0560: 6e74 793e 0a09 0909 093c 436f 756e 7472 nty>.....<Countr 0x0570: 7920 4465 7363 3d22 y.Desc=" 14:40:51.005390 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 4045 win 8320 <nop,nop,timestamp 31342642 1102808869> 0x0000: 4500 0034 34e1 0000 3406 2378 a4eb e25c E..44...4.#x...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b8 eb1b ...}.h..bW4.V... 0x0020: 8010 2080 5895 0000 0101 080a 01de 4032 ....X.........@2 0x0030: 41bb 8725 A..% 14:40:51.005419 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 4045:5393(1348) ack 1 win 33026 <nop,nop,timestamp 1102809037 31342642> 0x0000: 4508 0578 5b8a 4000 4006 ab82 97a6 0f7d E..x[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 eb1b 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 ea37 0000 0101 080a 41bb 87cd .....7......A... . . . . . . 0x0570: 6e3e 3539 2d33 3239 n>59-329 14:40:51.005429 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 5393:6741(1348) ack 1 win 33026 <nop,nop,timestamp 1102809037 31342642> 0x0000: 4508 0578 5b8b 4000 4006 ab81 97a6 0f7d E..x[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 f05f 6257 34a3 ...\...hV.._bW4. 0x0020: 8010 8102 b1a8 0000 0101 080a 41bb 87cd ............A... . . . . . . 0x0570: 723e 0a09 093c 2f41 r>...</A 14:40:51.005437 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 6741:8089(1348) ack 1 win 33026 <nop,nop,timestamp 1102809037 31342642> 0x0000: 4508 0578 5b8c 4000 4006 ab80 97a6 0f7d E..x[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b8 f5a3 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 4b85 0000 0101 080a 41bb 87cd ....K.......A... . . . . . 0x0560: 4164 6472 6573 7349 643e 0a09 0909 0909 AddressId>...... 0x0570: 3c4f 7267 616e 697a <Organiz 14:40:51.179288 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 6741 win 8320 <nop,nop,timestamp 31342642 1102809037> 0x0000: 4500 0034 3540 0000 3406 2319 a4eb e25c E..45@..4.#....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b8 f5a3 ...}.h..bW4.V... 0x0020: 8010 2080 4d65 0000 0101 080a 01de 4032 ....Me........@2 0x0030: 41bb 87cd A... 14:40:51.179314 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 8089:9437(1348) ack 1 win 33026 <nop,nop,timestamp 1102809211 31342642> 0x0000: 4508 0578 5ba0 4000 4006 ab6c 97a6 0f7d E..x[.@.@..l...} 0x0010: a4eb e25c 0014 eb68 56b8 fae7 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 883e 0000 0101 080a 41bb 887b .....>......A..{ . . . . . 0x0560: 6465 3e0a 0909 0909 0909 3c55 6963 3e46 de>.......<Uic>F 0x0570: 4134 3431 373c 2f55 A4417</U 14:40:51.179325 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 9437:10785(1348) ack 1 win 33026 <nop,nop,timestamp 1102809211 31342642> 0x0000: 4508 0578 5ba1 4000 4006 ab6b 97a6 0f7d E..x[.@.@..k...} 0x0010: a4eb e25c 0014 eb68 56b9 002b 6257 34a3 ...\...hV..+bW4. 0x0020: 8010 8102 41dc 0000 0101 080a 41bb 887b ....A.......A..{ 0x0030: 01de 4032 6963 3e0a 0909 0909 093c 2f41 ..@2ic>......</A . . . . 0x0570: 0a09 0909 0909 3c5a ......<Z 14:40:51.179336 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 10785:12133(1348) ack 1 win 33026 <nop,nop,timestamp 1102809211 31342642> 0x0000: 4508 0578 5ba2 4000 4006 ab6a 97a6 0f7d E..x[.@.@..j...} 0x0010: a4eb e25c 0014 eb68 56b9 056f 6257 34a3 ...\...hV..obW4. 0x0020: 8010 8102 f03d 0000 0101 080a 41bb 887b .....=......A..{ . . . . . 0x0570: 6f63 756d 656e 7454 ocumentT 14:40:51.235630 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 8089 win 8320 <nop,nop,timestamp 31342642 1102809037> 0x0000: 4500 0034 3562 0000 3406 22f7 a4eb e25c E..45b..4."....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b8 fae7 ...}.h..bW4.V... 0x0020: 8010 2080 4821 0000 0101 080a 01de 4032 ....H!........@2 0x0030: 41bb 87cd A... 14:40:51.235655 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 12133:13481(1348) ack 1 win 33026 <nop,nop,timestamp 1102809268 31342642> 0x0000: 4508 0578 5ba3 4000 4006 ab69 97a6 0f7d E..x[.@.@..i...} 0x0010: a4eb e25c 0014 eb68 56b9 0ab3 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 6e62 0000 0101 080a 41bb 88b4 ....nb......A... 0x0030: 01de 4032 7970 653e 0a09 0909 093c 4869 ..@2ype>.....<Hi . . . 0x0570: 4e75 6d62 6572 3e46 Number>F 14:40:51.235665 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 13481:14829(1348) ack 1 win 33026 <nop,nop,timestamp 1102809268 31342642> 0x0000: 4508 0578 5ba4 4000 4006 ab68 97a6 0f7d E..x[.@.@..h...} 0x0010: a4eb e25c 0014 eb68 56b9 0ff7 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 ed57 0000 0101 080a 41bb 88b4 .....W......A... 0x0030: 01de 4032 3246 3332 3337 3134 3441 313c ..@22F3237144A1< . . . . 0x0570: 7065 2044 6573 633d pe.Desc= 14:40:51.347938 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 12133 win 7646 <nop,nop,timestamp 31342642 1102809211> 0x0000: 4500 0034 35a5 0000 3406 22b4 a4eb e25c E..45...4."....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 0ab3 ...}.h..bW4.V... 0x0020: 8010 1dde 3a49 0000 0101 080a 01de 4032 ....:I........@2 0x0030: 41bb 887b A..{ 14:40:51.347964 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 14829:16177(1348) ack 1 win 33026 <nop,nop,timestamp 1102809380 31342642> 0x0000: 4508 0578 5ba7 4000 4006 ab65 97a6 0f7d E..x[.@.@..e...} 0x0010: a4eb e25c 0014 eb68 56b9 153b 6257 34a3 ...\...hV..;bW4. 0x0020: 8010 8102 9673 0000 0101 080a 41bb 8924 .....s......A..$ . . . . . 0x0560: 093c 4368 6172 6163 7465 7269 7374 6963 .<Characteristic 0x0570: 733e 0a09 0909 093c s>.....< 14:40:51.347975 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 16177:17525(1348) ack 1 win 33026 <nop,nop,timestamp 1102809380 31342642> 0x0000: 4508 0578 5ba8 4000 4006 ab64 97a6 0f7d E..x[.@.@..d...} 0x0010: a4eb e25c 0014 eb68 56b9 1a7f 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 a155 0000 0101 080a 41bb 8924 .....U......A..$ . . . . . 0x0570: 756d 6265 723e 3030 umber>00 14:40:51.347986 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 17525:18873(1348) ack 1 win 33026 <nop,nop,timestamp 1102809380 31342642> 0x0000: 4508 0578 5ba9 4000 4006 ab63 97a6 0f7d E..x[.@.@..c...} 0x0010: a4eb e25c 0014 eb68 56b9 1fc3 6257 34a3 ...\...hV...bW4. 0x0020: 8010 8102 e0d2 0000 0101 080a 41bb 8924 ............A..$ . . . . 0x0560: 3c2f 446f 6375 6d65 6e74 5479 7065 3e0a </DocumentType>. 0x0570: 0909 0909 0909 3c4c ......<L 14:40:51.403906 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 14829 win 7646 <nop,nop,timestamp 31342643 1102809268> 0x0000: 4500 0034 35b6 0000 3406 22a3 a4eb e25c E..45...4."....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 153b ...}.h..bW4.V..; 0x0020: 8010 1dde 2f87 0000 0101 080a 01de 4033 ..../.........@3 0x0030: 41bb 88b4 A... 14:40:51.403931 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 18873:20221(1348) ack 1 win 33026 <nop,nop,timestamp 1102809436 31342643> 0x0000: 4508 0578 5bb2 4000 4006 ab5a 97a6 0f7d E..x[.@.@..Z...} 0x0010: a4eb e25c 0014 eb68 56b9 2507 6257 34a3 ...\...hV.%.bW4. 0x0020: 8010 8102 c5f3 0000 0101 080a 41bb 895c ............A..\ . . . . 0x0570: 6e22 3e34 394e 3c2f n">49N</ 14:40:51.403942 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 20221:21569(1348) ack 1 win 33026 <nop,nop,timestamp 1102809436 31342643> 0x0000: 4508 0578 5bb3 4000 4006 ab59 97a6 0f7d E..x[.@.@..Y...} 0x0010: a4eb e25c 0014 eb68 56b9 2a4b 6257 34a3 ...\...hV.*KbW4. 0x0020: 8010 8102 108e 0000 0101 080a 41bb 895c ............A..\ . . . . 0x0570: 6f75 7263 654c 6567 ourceLeg 14:40:51.516465 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 17525 win 7646 <nop,nop,timestamp 31342643 1102809380> 0x0000: 4500 0034 35f4 0000 3406 2265 a4eb e25c E..45...4."e...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 1fc3 ...}.h..bW4.V... 0x0020: 8010 1dde 248f 0000 0101 080a 01de 4033 ....$.........@3 0x0030: 41bb 8924 A..$ 14:40:51.516488 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 21569:22917(1348) ack 1 win 33026 <nop,nop,timestamp 1102809548 31342643> 0x0000: 4508 0578 5bb5 4000 4006 ab57 97a6 0f7d E..x[.@.@..W...} 0x0010: a4eb e25c 0014 eb68 56b9 2f8f 6257 34a3 ...\...hV./.bW4. 0x0020: 8010 8102 6b9e 0000 0101 080a 41bb 89cc ....k.......A... . . . . 0x0570: 3c2f 536f 7572 6365 </Source 14:40:51.516499 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 22917:24265(1348) ack 1 win 33026 <nop,nop,timestamp 1102809548 31342643> 0x0000: 4508 0578 5bb6 4000 4006 ab56 97a6 0f7d E..x[.@.@..V...} 0x0010: a4eb e25c 0014 eb68 56b9 34d3 6257 34a3 ...\...hV.4.bW4. 0x0020: 8010 8102 72de 0000 0101 080a 41bb 89cc ....r.......A... . . . . 0x0570: 0a09 0909 093c 4c65 .....<Le 14:40:51.516840 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 18873 win 8320 <nop,nop,timestamp 31342643 1102809380> 0x0000: 4500 0034 35f7 0000 3406 2262 a4eb e25c E..45...4."b...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 2507 ...}.h..bW4.V.%. 0x0020: 8010 2080 1ca9 0000 0101 080a 01de 4033 ..............@3 0x0030: 41bb 8924 A..$ 14:40:51.516871 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 24265:25613(1348) ack 1 win 33026 <nop,nop,timestamp 1102809549 31342643> 0x0000: 4508 0578 5bb8 4000 4006 ab54 97a6 0f7d E..x[.@.@..T...} 0x0010: a4eb e25c 0014 eb68 56b9 3a17 6257 34a3 ...\...hV.:.bW4. 0x0020: 8010 8102 d6d6 0000 0101 080a 41bb 89cd ............A... . . . . 0x0570: 5346 2031 3434 393c SF.1449< 14:40:51.516883 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 25613:26961(1348) ack 1 win 33026 <nop,nop,timestamp 1102809549 31342643> 0x0000: 4508 0578 5bb9 4000 4006 ab53 97a6 0f7d E..x[.@.@..S...} 0x0010: a4eb e25c 0014 eb68 56b9 3f5b 6257 34a3 ...\...hV.?[bW4. 0x0020: 8010 8102 15e9 0000 0101 080a 41bb 89cd ............A... . . . . 0x0570: 313c 2f46 756c 6c54 1</FullT 14:40:51.573432 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 21569 win 8320 <nop,nop,timestamp 31342643 1102809436> 0x0000: 4500 0034 3678 0000 3406 21e1 a4eb e25c E..46x..4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 2f8f ...}.h..bW4.V./. 0x0020: 8010 2080 11e9 0000 0101 080a 01de 4033 ..............@3 0x0030: 41bb 895c A..\ 14:40:51.573456 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 26961:28309(1348) ack 1 win 33026 <nop,nop,timestamp 1102809605 31342643> 0x0000: 4508 0578 5bbf 4000 4006 ab4d 97a6 0f7d E..x[.@.@..M...} 0x0010: a4eb e25c 0014 eb68 56b9 449f 6257 34a3 ...\...hV.D.bW4. 0x0020: 8010 8102 7a19 0000 0101 080a 41bb 8a05 ....z.......A... . . . . 0x0570: 0909 093c 4675 6c6c ...<Full 14:40:51.573467 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 28309:29657(1348) ack 1 win 33026 <nop,nop,timestamp 1102809605 31342643> 0x0000: 4508 0578 5bc0 4000 4006 ab4c 97a6 0f7d E..x[.@.@..L...} 0x0010: a4eb e25c 0014 eb68 56b9 49e3 6257 34a3 ...\...hV.I.bW4. 0x0020: 8010 8102 2f41 0000 0101 080a 41bb 8a05 ..../A......A... . . . . 0x0570: 303c 2f45 6469 7465 0</Edite 14:40:51.688739 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 25613 win 7646 <nop,nop,timestamp 31342643 1102809548> 0x0000: 4500 0034 36ae 0000 3406 21ab a4eb e25c E..46...4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 3f5b ...}.h..bW4.V.?[ 0x0020: 8010 1dde 044f 0000 0101 080a 01de 4033 .....O........@3 0x0030: 41bb 89cc A... 14:40:51.688745 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 26961 win 8320 <nop,nop,timestamp 31342643 1102809549> 0x0000: 4500 0034 36b1 0000 3406 21a8 a4eb e25c E..46...4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 449f ...}.h..bW4.V.D. 0x0020: 8010 2080 fc67 0000 0101 080a 01de 4033 .....g........@3 0x0030: 41bb 89cd A... 14:40:51.688769 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 29657:31005(1348) ack 1 win 33026 <nop,nop,timestamp 1102809721 31342643> 0x0000: 4508 0578 5bd0 4000 4006 ab3c 97a6 0f7d E..x[.@.@..<...} 0x0010: a4eb e25c 0014 eb68 56b9 4f27 6257 34a3 ...\...hV.O'bW4. 0x0020: 8010 8102 a16e 0000 0101 080a 41bb 8a79 .....n......A..y . . . . 0x0570: 4675 6c6c 5465 7874 FullText 14:40:51.688780 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 31005:32353(1348) ack 1 win 33026 <nop,nop,timestamp 1102809721 31342643> 0x0000: 4508 0578 5bd1 4000 4006 ab3b 97a6 0f7d E..x[.@.@..;...} 0x0010: a4eb e25c 0014 eb68 56b9 546b 6257 34a3 ...\...hV.TkbW4. 0x0020: 8010 8102 4dc2 0000 0101 080a 41bb 8a79 ....M.......A..y . . . . 0x0570: 6167 3e31 3c2f 4675 ag>1</Fu 14:40:51.688803 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 32353:33701(1348) ack 1 win 33026 <nop,nop,timestamp 1102809721 31342643> 0x0000: 4508 0578 5bd3 4000 4006 ab39 97a6 0f7d E..x[.@.@..9...} 0x0010: a4eb e25c 0014 eb68 56b9 59af 6257 34a3 ...\...hV.Y.bW4. 0x0020: 8010 8102 04bc 0000 0101 080a 41bb 8a79 ............A..y . . . . 0x0570: 636c 7564 6564 3e30 cluded>0 14:40:51.688813 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 33701:35049(1348) ack 1 win 33026 <nop,nop,timestamp 1102809721 31342643> 0x0000: 4508 0578 5bd4 4000 4006 ab38 97a6 0f7d E..x[.@.@..8...} 0x0010: a4eb e25c 0014 eb68 56b9 5ef3 6257 34a3 ...\...hV.^.bW4. 0x0020: 8010 8102 924b 0000 0101 080a 41bb 8a79 .....K......A..y . . . . 0x0570: 0909 0909 093c 4f72 .....<Or 14:40:51.743707 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 29657 win 8320 <nop,nop,timestamp 31342643 1102809605> 0x0000: 4500 0034 36c2 0000 3406 2197 a4eb e25c E..46...4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 4f27 ...}.h..bW4.V.O' 0x0020: 8010 2080 f1a7 0000 0101 080a 01de 4033 ..............@3 0x0030: 41bb 8a05 A... 14:40:51.743733 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 35049:36397(1348) ack 1 win 33026 <nop,nop,timestamp 1102809776 31342643> 0x0000: 4508 0578 5bd6 4000 4006 ab36 97a6 0f7d E..x[.@.@..6...} 0x0010: a4eb e25c 0014 eb68 56b9 6437 6257 34a3 ...\...hV.d7bW4. 0x0020: 8010 8102 a4d9 0000 0101 080a 41bb 8ab0 ............A... . . . . 0x0570: 6972 6564 436f 6465 iredCode 14:40:51.743743 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 36397:37745(1348) ack 1 win 33026 <nop,nop,timestamp 1102809776 31342643> 0x0000: 4508 0578 5bd7 4000 4006 ab35 97a6 0f7d E..x[.@.@..5...} 0x0010: a4eb e25c 0014 eb68 56b9 697b 6257 34a3 ...\...hV.i{bW4. 0x0020: 8010 8102 5eaf 0000 0101 080a 41bb 8ab0 ....^.......A... . . . . . 0x0570: 6265 723e 3532 2e32 ber>52.2 14:40:51.859264 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 33701 win 7646 <nop,nop,timestamp 31342643 1102809721> 0x0000: 4500 0034 36fd 0000 3406 215c a4eb e25c E..46...4.!\...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 5ef3 ...}.h..bW4.V.^. 0x0020: 8010 1dde e409 0000 0101 080a 01de 4033 ..............@3 0x0030: 41bb 8a79 A..y 14:40:51.859270 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 35049 win 7646 <nop,nop,timestamp 31342643 1102809721> 0x0000: 4500 0034 3700 0000 3406 2159 a4eb e25c E..47...4.!Y...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 6437 ...}.h..bW4.V.d7 0x0020: 8010 1dde dec5 0000 0101 080a 01de 4033 ..............@3 0x0030: 41bb 8a79 A..y 14:40:51.859298 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 37745:39093(1348) ack 1 win 33026 <nop,nop,timestamp 1102809891 31342643> 0x0000: 4508 0578 5be0 4000 4006 ab2c 97a6 0f7d E..x[.@.@..,...} 0x0010: a4eb e25c 0014 eb68 56b9 6ebf 6257 34a3 ...\...hV.n.bW4. 0x0020: 8010 8102 bdcf 0000 0101 080a 41bb 8b23 ............A..# . . . . 0x0570: 3e0a 0909 0909 0909 >....... 14:40:51.859310 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 39093:40441(1348) ack 1 win 33026 <nop,nop,timestamp 1102809891 31342643> 0x0000: 4508 0578 5be1 4000 4006 ab2b 97a6 0f7d E..x[.@.@..+...} 0x0010: a4eb e25c 0014 eb68 56b9 7403 6257 34a3 ...\...hV.t.bW4. 0x0020: 8010 8102 6678 0000 0101 080a 41bb 8b23 ....fx......A..# . . . . . 0x0570: 653e 0a09 0909 0909 e>...... 14:40:51.859332 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . 40441:41789(1348) ack 1 win 33026 <nop,nop,timestamp 1102809891 31342643> 0x0000: 4508 0578 5be3 4000 4006 ab29 97a6 0f7d E..x[.@.@..)...} 0x0010: a4eb e25c 0014 eb68 56b9 7947 6257 34a3 ...\...hV.yGbW4. 0x0020: 8010 8102 4e19 0000 0101 080a 41bb 8b23 ....N.......A..# . . . . 0x0570: 696c 6c49 6e46 6c61 illInFla 14:40:51.859342 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: FP 41789:42489(700) ack 1 win 33026 <nop,nop,timestamp 1102809891 31342643> 0x0000: 4508 02f0 5be4 4000 4006 adb0 97a6 0f7d E...[.@.@......} 0x0010: a4eb e25c 0014 eb68 56b9 7e8b 6257 34a3 ...\...hV.~.bW4. 0x0020: 8019 8102 90af 0000 0101 080a 41bb 8b23 ............A..# . . . . 0x02e0: 4e75 6d62 6572 3e35 363c 2f4f 7264 6572 Number>56</Order 14:40:51.914106 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 37745 win 7646 <nop,nop,timestamp 31342644 1102809776> 0x0000: 4500 0034 3711 0000 3406 2148 a4eb e25c E..47...4.!H...\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 6ebf ...}.h..bW4.V.n. 0x0020: 8010 1dde d405 0000 0101 080a 01de 4034 ..............@4 0x0030: 41bb 8ab0 A... 14:40:52.029164 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 40441 win 7646 <nop,nop,timestamp 31342644 1102809891> 0x0000: 4500 0034 3744 0000 3406 2115 a4eb e25c E..47D..4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 7947 ...}.h..bW4.V.yG 0x0020: 8010 1dde c90a 0000 0101 080a 01de 4034 ..............@4 0x0030: 41bb 8b23 A..# 14:40:52.029170 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: . ack 42490 win 7296 <nop,nop,timestamp 31342644 1102809891> 0x0000: 4500 0034 3748 0000 3406 2111 a4eb e25c E..47H..4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 8148 ...}.h..bW4.V..H 0x0020: 8010 1c80 c267 0000 0101 080a 01de 4034 .....g........@4 0x0030: 41bb 8b23 A..# 14:40:52.029173 IP vvv.zzz.226.92.60264 > xxx.yyy.15.125.ftp-data: F 1:1(0) ack 42490 win 8840 <nop,nop,timestamp 31342644 1102809891> 0x0000: 4500 0034 3749 0000 3406 2110 a4eb e25c E..47I..4.!....\ 0x0010: 97a6 0f7d eb68 0014 6257 34a3 56b9 8148 ...}.h..bW4.V..H 0x0020: 8011 2288 bc5e 0000 0101 080a 01de 4034 .."..^........@4 0x0030: 41bb 8b23 A..# 14:40:52.029206 IP xxx.yyy.15.125.ftp-data > vvv.zzz.226.92.60264: . ack 2 win 33025 <nop,nop,timestamp 1102810061 31342644> 0x0000: 4508 0034 5be9 4000 4006 b067 97a6 0f7d E..4[.@.@..g...} 0x0010: a4eb e25c 0014 eb68 56b9 8148 6257 34a4 ...\...hV..HbW4. 0x0020: 8010 8101 5d3b 0000 0101 080a 41bb 8bcd ....];......A... 0x0030: 01de 4034 ..@4 14:41:37.043508 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: F 298:298(0) ack 958 win 17680 <nop,nop,timestamp 31342734 1102808567> 0x0000: 4500 0034 7376 0000 3406 e4e2 a4eb e25c E..4sv..4......\ 0x0010: 97a6 0f7d c419 0015 1590 3119 bf82 adf8 ...}......1..... 0x0020: 8011 4510 80ce 0000 0101 080a 01de 408e ..E...........@. 0x0030: 41bb 85f7 A... 14:41:37.043534 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: . ack 299 win 33026 <nop,nop,timestamp 1102855063 31342734> 0x0000: 4510 0034 64ad 4000 4006 a79b 97a6 0f7d E..4d.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 adf8 1590 311a ...\..........1. 0x0020: 8010 8102 8f3b 0000 0101 080a 41bc 3b97 .....;......A.;. 0x0030: 01de 408e ..@. 14:41:37.043594 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: P 958:971(13) ack 299 win 33026 <nop,nop,timestamp 1102855063 31342734> 0x0000: 4510 0041 64ae 4000 4006 a78d 97a6 0f7d E..Ad.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 adf8 1590 311a ...\..........1. 0x0020: 8018 8102 cc70 0000 0101 080a 41bc 3b97 .....p......A.;. 0x0030: 01de 408e 3135 3020 4c6f 676f 7574 2e0d ..@.150.Logout.. 0x0040: 0a . 14:41:37.043726 IP xxx.yyy.15.125.ftp > vvv.zzz.226.92.50201: F 971:971(0) ack 299 win 33026 <nop,nop,timestamp 1102855063 31342734> 0x0000: 4510 0034 64af 4000 4006 a799 97a6 0f7d E..4d.@.@......} 0x0010: a4eb e25c 0015 c419 bf82 ae05 1590 311a ...\..........1. 0x0020: 8011 8102 8f2d 0000 0101 080a 41bc 3b97 .....-......A.;. 0x0030: 01de 408e ..@. 14:41:37.211160 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: R 361771290:361771290(0) win 0 0x0000: 4500 0028 73a4 0000 3406 e4c0 a4eb e25c E..(s...4......\ 0x0010: 97a6 0f7d c419 0015 1590 311a 0000 0000 ...}......1..... 0x0020: 5004 0000 769c 0000 0000 0000 0000 P...v......... 14:41:37.211166 IP vvv.zzz.226.92.50201 > xxx.yyy.15.125.ftp: R 361771290:361771290(0) win 0 0x0000: 4500 0028 73a5 0000 3406 e4bf a4eb e25c E..(s...4......\ 0x0010: 97a6 0f7d c419 0015 1590 311a 0000 0000 ...}......1..... 0x0020: 5004 0000 769c 0000 0000 0000 0000 P...v.........
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?fc2243911001061340l5fd75af5hc90e6cbd659d0d19>