diff --git a/testing/btest/Baseline/core.checksums_ignore_nets/conn-failed.log b/testing/btest/Baseline/core.checksums_ignore_nets/conn-failed.log index 973052487a..71bb582ff2 100644 --- a/testing/btest/Baseline/core.checksums_ignore_nets/conn-failed.log +++ b/testing/btest/Baseline/core.checksums_ignore_nets/conn-failed.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - - - - OTH - - 0 C 0 0 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 35.221.46.9 80 192.168.1.28 53246 tcp - 0.063810 432 0 SH - - 0 HcADF 4 604 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - - - - OTH T F 0 C 0 0 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 35.221.46.9 80 192.168.1.28 53246 tcp - 0.063810 432 0 SH F T 0 HcADF 4 604 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked-multi-subnets.log b/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked-multi-subnets.log index 9097cb30dd..9dac798aac 100644 --- a/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked-multi-subnets.log +++ b/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked-multi-subnets.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - 0.091969 74 432 SF - - 0 ShADadFf 6 338 4 604 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - 0.091969 74 432 SF T F 0 ShADadFf 6 338 4 604 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked.log b/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked.log index 9097cb30dd..9dac798aac 100644 --- a/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked.log +++ b/testing/btest/Baseline/core.checksums_ignore_nets/conn-worked.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - 0.091969 74 432 SF - - 0 ShADadFf 6 338 4 604 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.28 53246 35.221.46.9 80 tcp - 0.091969 74 432 SF T F 0 ShADadFf 6 338 4 604 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.cisco-fabric-path/conn.log b/testing/btest/Baseline/core.cisco-fabric-path/conn.log index e7bfd88117..c0d9e7d754 100644 --- a/testing/btest/Baseline/core.cisco-fabric-path/conn.log +++ b/testing/btest/Baseline/core.cisco-fabric-path/conn.log @@ -7,36 +7,36 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 1.1.1.6 57005 2.2.2.2 48879 tcp - 0.001018 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 1.1.1.4 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 1.1.1.14 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 1.1.1.12 57005 2.2.2.2 48879 tcp - 0.000926 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 1.1.1.0 57005 2.2.2.2 48879 tcp - 0.001042 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 1.1.1.2 57005 2.2.2.2 48879 tcp - 0.000920 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 1.1.1.8 57005 2.2.2.2 48879 tcp - 0.000930 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 1.1.1.10 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 - - 0 S 2 80 0 0 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 1234::e 57005 5678:: 48879 tcp - 0.001139 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 1234::c 57005 5678:: 48879 tcp - 0.001027 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 1234::6 57005 5678:: 48879 tcp - 0.001055 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 1234::4 57005 5678:: 48879 tcp - 0.001018 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 1234::8 57005 5678:: 48879 tcp - 0.001029 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 1234::a 57005 5678:: 48879 tcp - 0.001005 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 1234:: 57005 5678:: 48879 tcp - 0.001005 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl 1234::2 57005 5678:: 48879 tcp - 0.001120 0 0 S0 - - 0 S 2 120 0 0 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 1.1.1.0 57005 2.2.2.2 48879 udp - 0.000926 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 1.1.1.2 57005 2.2.2.2 48879 udp - 0.000830 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 1.1.1.4 57005 2.2.2.2 48879 udp - 0.000847 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.6 57005 2.2.2.2 48879 udp - 0.001243 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 1.1.1.8 57005 2.2.2.2 48879 udp - 0.000830 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 1.1.1.10 57005 2.2.2.2 48879 udp - 0.000843 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 1.1.1.12 57005 2.2.2.2 48879 udp - 0.000847 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 1.1.1.14 57005 2.2.2.2 48879 udp - 0.000880 0 0 S0 - - 0 D 2 56 0 0 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 1234:: 57005 5678:: 48879 udp - 0.000898 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 1234::2 57005 5678:: 48879 udp - 0.000902 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 1234::4 57005 5678:: 48879 udp - 0.000905 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 1234::6 57005 5678:: 48879 udp - 0.000898 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 1234::8 57005 5678:: 48879 udp - 0.001010 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 1234::a 57005 5678:: 48879 udp - 0.000894 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 1234::c 57005 5678:: 48879 udp - 0.000902 0 0 S0 - - 0 D 2 96 0 0 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 1234::e 57005 5678:: 48879 udp - 0.001014 0 0 S0 - - 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 1.1.1.6 57005 2.2.2.2 48879 tcp - 0.001018 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 1.1.1.4 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 1.1.1.14 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 1.1.1.12 57005 2.2.2.2 48879 tcp - 0.000926 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 1.1.1.0 57005 2.2.2.2 48879 tcp - 0.001042 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 1.1.1.2 57005 2.2.2.2 48879 tcp - 0.000920 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 1.1.1.8 57005 2.2.2.2 48879 tcp - 0.000930 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 1.1.1.10 57005 2.2.2.2 48879 tcp - 0.000928 0 0 S0 F F 0 S 2 80 0 0 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 1234::e 57005 5678:: 48879 tcp - 0.001139 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 1234::c 57005 5678:: 48879 tcp - 0.001027 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 1234::6 57005 5678:: 48879 tcp - 0.001055 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 1234::4 57005 5678:: 48879 tcp - 0.001018 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 1234::8 57005 5678:: 48879 tcp - 0.001029 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 1234::a 57005 5678:: 48879 tcp - 0.001005 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 1234:: 57005 5678:: 48879 tcp - 0.001005 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl 1234::2 57005 5678:: 48879 tcp - 0.001120 0 0 S0 F F 0 S 2 120 0 0 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 1.1.1.0 57005 2.2.2.2 48879 udp - 0.000926 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 1.1.1.2 57005 2.2.2.2 48879 udp - 0.000830 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 1.1.1.4 57005 2.2.2.2 48879 udp - 0.000847 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.6 57005 2.2.2.2 48879 udp - 0.001243 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 1.1.1.8 57005 2.2.2.2 48879 udp - 0.000830 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 1.1.1.10 57005 2.2.2.2 48879 udp - 0.000843 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 1.1.1.12 57005 2.2.2.2 48879 udp - 0.000847 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 1.1.1.14 57005 2.2.2.2 48879 udp - 0.000880 0 0 S0 F F 0 D 2 56 0 0 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 1234:: 57005 5678:: 48879 udp - 0.000898 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 1234::2 57005 5678:: 48879 udp - 0.000902 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 1234::4 57005 5678:: 48879 udp - 0.000905 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 1234::6 57005 5678:: 48879 udp - 0.000898 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 1234::8 57005 5678:: 48879 udp - 0.001010 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 1234::a 57005 5678:: 48879 udp - 0.000894 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 1234::c 57005 5678:: 48879 udp - 0.000902 0 0 S0 F F 0 D 2 96 0 0 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 1234::e 57005 5678:: 48879 udp - 0.001014 0 0 S0 F F 0 D 2 96 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.erspanI/conn.log b/testing/btest/Baseline/core.erspanI/conn.log index db479dd329..813a81fc66 100644 --- a/testing/btest/Baseline/core.erspanI/conn.log +++ b/testing/btest/Baseline/core.erspanI/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.16.133.2 8 172.217.11.78 0 icmp - 0.014360 280 280 OTH - - 0 - 5 420 5 420 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.16.133.2 8 172.217.11.78 0 icmp - 0.014360 280 280 OTH T F 0 - 5 420 5 420 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.erspanII/conn.log b/testing/btest/Baseline/core.erspanII/conn.log index d95db9c89e..facbec3728 100644 --- a/testing/btest/Baseline/core.erspanII/conn.log +++ b/testing/btest/Baseline/core.erspanII/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 23.0.0.2 8 23.0.0.3 0 icmp - 0.001727 144 144 OTH - - 0 - 2 200 2 200 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 23.0.0.2 8 23.0.0.3 0 icmp - 0.001727 144 144 OTH F F 0 - 2 200 2 200 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.erspanIII/conn.log b/testing/btest/Baseline/core.erspanIII/conn.log index b3ff0f4a62..cfe52907b5 100644 --- a/testing/btest/Baseline/core.erspanIII/conn.log +++ b/testing/btest/Baseline/core.erspanIII/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.15.47 8 1.1.1.1 0 icmp - 0.004305 56 56 OTH - - 0 - 1 84 1 84 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.15.47 8 1.1.1.1 0 icmp - 0.004305 56 56 OTH T F 0 - 1 84 1 84 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.expire-all-timers/conn-all.log b/testing/btest/Baseline/core.expire-all-timers/conn-all.log index 194375388d..e3fca8f6be 100644 --- a/testing/btest/Baseline/core.expire-all-timers/conn-all.log +++ b/testing/btest/Baseline/core.expire-all-timers/conn-all.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.1 51889 192.168.0.1 80 tcp - 0.000010 18 0 OTH - - 0 Da 1 58 1 40 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.1 51889 192.168.0.1 80 tcp - - - - OTH - - 0 D 1 58 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.1 51889 192.168.0.1 80 tcp - 0.000010 18 0 OTH T T 0 Da 1 58 1 40 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.1 51889 192.168.0.1 80 tcp - - - - OTH T T 0 D 1 58 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.expire-all-timers/conn-limited.log b/testing/btest/Baseline/core.expire-all-timers/conn-limited.log index c349ee4a03..bd2fe50b5e 100644 --- a/testing/btest/Baseline/core.expire-all-timers/conn-limited.log +++ b/testing/btest/Baseline/core.expire-all-timers/conn-limited.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.1 51889 192.168.0.1 80 tcp - 300.000010 18 0 OTH - - 0 DaT 2 116 1 40 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.1 51889 192.168.0.1 80 tcp - 300.000010 18 0 OTH T T 0 DaT 2 116 1 40 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.history-flip/conn.log b/testing/btest/Baseline/core.history-flip/conn.log index f3b0f82b3e..a00619d8c3 100644 --- a/testing/btest/Baseline/core.history-flip/conn.log +++ b/testing/btest/Baseline/core.history-flip/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_l2_addr resp_l2_addr #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.42.64.125 56730 125.190.109.199 80 tcp http 1.550793 98 9417 SF - - 0 ^hADdFaf 11 670 10 9945 - 00:d0:03:3b:f4:00 00:b0:c2:86:ec:00 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.42.64.125 56730 125.190.109.199 80 tcp http 1.550793 98 9417 SF F F 0 ^hADdFaf 11 670 10 9945 - 00:d0:03:3b:f4:00 00:b0:c2:86:ec:00 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.mpls-in-vlan/conn.log b/testing/btest/Baseline/core.mpls-in-vlan/conn.log index 9a120e6d03..20c08e0576 100644 --- a/testing/btest/Baseline/core.mpls-in-vlan/conn.log +++ b/testing/btest/Baseline/core.mpls-in-vlan/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 65.65.65.65 19244 65.65.65.65 80 tcp - - - - OTH - - 0 D 1 257 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 65.65.65.65 32828 65.65.65.65 80 tcp - - - - OTH - - 0 ^d 0 0 1 1500 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 65.65.65.65 61193 65.65.65.65 80 tcp - - - - OTH - - 0 D 1 710 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 65.65.65.65 19244 65.65.65.65 80 tcp - - - - OTH F F 0 D 1 257 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 65.65.65.65 32828 65.65.65.65 80 tcp - - - - OTH F F 0 ^d 0 0 1 1500 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 65.65.65.65 61193 65.65.65.65 80 tcp - - - - OTH F F 0 D 1 710 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.pbb/conn.log b/testing/btest/Baseline/core.pbb/conn.log index 9290759cfe..bbc6a67f2a 100644 --- a/testing/btest/Baseline/core.pbb/conn.log +++ b/testing/btest/Baseline/core.pbb/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.199.249.11 49601 10.199.249.12 49416 tcp - 0.002215 209 0 SF - - 0 ShADFaf 5 421 3 132 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.199.249.11 49601 10.199.249.12 49416 tcp - 0.002215 209 0 SF T T 0 ShADFaf 5 421 3 132 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.pcap.dynamic-filter/conn.log b/testing/btest/Baseline/core.pcap.dynamic-filter/conn.log index 6e760ad8e2..543be27fa1 100644 --- a/testing/btest/Baseline/core.pcap.dynamic-filter/conn.log +++ b/testing/btest/Baseline/core.pcap.dynamic-filter/conn.log @@ -7,20 +7,20 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 35634 208.80.152.2 80 tcp - - - - OTH - - 0 D 1 515 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 35634 208.80.152.2 80 tcp - - - - OTH F F 0 D 1 515 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.pcap.read-trace-with-filter/conn.log b/testing/btest/Baseline/core.pcap.read-trace-with-filter/conn.log index c617f85a95..666eb1dfe4 100644 --- a/testing/btest/Baseline/core.pcap.read-trace-with-filter/conn.log +++ b/testing/btest/Baseline/core.pcap.read-trace-with-filter/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.pppoe-over-qinq/conn.log b/testing/btest/Baseline/core.pppoe-over-qinq/conn.log index 1df4f70b5f..6d35c74e51 100644 --- a/testing/btest/Baseline/core.pppoe-over-qinq/conn.log +++ b/testing/btest/Baseline/core.pppoe-over-qinq/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.1 20394 2.2.2.2 443 tcp - 273.626833 11352 4984 SF - - 0 ShADdtaTTtFf 44 25283 42 13001 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.1.1.1 20394 2.2.2.2 443 tcp - 273.626833 11352 4984 SF F F 0 ShADdtaTTtFf 44 25283 42 13001 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.pppoe/conn.log b/testing/btest/Baseline/core.pppoe/conn.log index 6dddd7ccfa..c3cde9aaac 100644 --- a/testing/btest/Baseline/core.pppoe/conn.log +++ b/testing/btest/Baseline/core.pppoe/conn.log @@ -7,11 +7,11 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg fc00:0:2:100::1:1 128 fc00::1 129 icmp - 0.156000 260 260 OTH - - 0 - 5 500 5 500 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::c801:eff:fe88:8 134 fe80::ce05:eff:fe88:0 133 icmp - - - - OTH - - 0 - 1 64 0 0 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN fe80::c801:eff:fe88:8 547 fe80::ce05:eff:fe88:0 546 udp - 0.096000 192 0 S0 - - 0 D 2 288 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::c801:eff:fe88:8 136 ff02::1 135 icmp - - - - OTH - - 0 - 1 64 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 fe80::c801:eff:fe88:8 143 ff02::16 0 icmp - 0.835000 160 0 OTH - - 0 - 8 608 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc fe80::ce05:eff:fe88:0 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 48 0 0 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::ce05:eff:fe88:0 546 ff02::1:2 547 udp - 0.078000 114 0 S0 - - 0 D 2 210 0 0 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg fc00:0:2:100::1:1 128 fc00::1 129 icmp - 0.156000 260 260 OTH T T 0 - 5 500 5 500 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::c801:eff:fe88:8 134 fe80::ce05:eff:fe88:0 133 icmp - - - - OTH T T 0 - 1 64 0 0 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN fe80::c801:eff:fe88:8 547 fe80::ce05:eff:fe88:0 546 udp - 0.096000 192 0 S0 T T 0 D 2 288 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::c801:eff:fe88:8 136 ff02::1 135 icmp - - - - OTH T F 0 - 1 64 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 fe80::c801:eff:fe88:8 143 ff02::16 0 icmp - 0.835000 160 0 OTH T F 0 - 8 608 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc fe80::ce05:eff:fe88:0 133 ff02::2 134 icmp - - - - OTH T F 0 - 1 48 0 0 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::ce05:eff:fe88:0 546 ff02::1:2 547 udp - 0.078000 114 0 S0 T F 0 D 2 210 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.print-bpf-filters/conn.log b/testing/btest/Baseline/core.print-bpf-filters/conn.log index b8c642b7e8..a55b452b64 100644 --- a/testing/btest/Baseline/core.print-bpf-filters/conn.log +++ b/testing/btest/Baseline/core.print-bpf-filters/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.20.80.1 50343 10.0.0.15 80 tcp http 0.004152 9 3429 SF - - 0 ShADadfF 7 381 7 3801 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.20.80.1 50343 10.0.0.15 80 tcp http 0.004152 9 3429 SF T T 0 ShADadfF 7 381 7 3801 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.q-in-q/conn.log b/testing/btest/Baseline/core.q-in-q/conn.log index a02f8f4750..2b69af5fe5 100644 --- a/testing/btest/Baseline/core.q-in-q/conn.log +++ b/testing/btest/Baseline/core.q-in-q/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.19.51.37 47808 172.19.51.63 47808 udp - 0.000100 36 0 S0 - - 0 D 2 92 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 193.1.186.60 9875 224.2.127.254 9875 udp - 0.000139 552 0 S0 - - 0 D 2 608 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.19.51.37 47808 172.19.51.63 47808 udp - 0.000100 36 0 S0 T T 0 D 2 92 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 193.1.186.60 9875 224.2.127.254 9875 udp - 0.000139 552 0 S0 F F 0 D 2 608 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.radiotap/conn.log b/testing/btest/Baseline/core.radiotap/conn.log index 08d0501a43..66d7decd9e 100644 --- a/testing/btest/Baseline/core.radiotap/conn.log +++ b/testing/btest/Baseline/core.radiotap/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp dns 0.041654 35 128 SF - - 0 Dd 1 63 1 156 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp dns - - - S0 - - 0 D 1 328 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp dns 0.041654 35 128 SF T F 0 Dd 1 63 1 156 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp dns - - - S0 T F 0 D 1 328 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.skip_analyzer/conn.log b/testing/btest/Baseline/core.skip_analyzer/conn.log index 673ee7c11e..99d32e40b1 100644 --- a/testing/btest/Baseline/core.skip_analyzer/conn.log +++ b/testing/btest/Baseline/core.skip_analyzer/conn.log @@ -7,11 +7,11 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 66.59.111.190 40264 172.28.2.3 22 tcp - 3.157831 952 1671 SF - - 0 ShAdDaFf 12 1584 10 2199 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 66.59.111.190 123 18.26.4.105 123 udp - 0.074086 48 48 SF - - 0 Dd 1 76 1 76 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 66.59.111.190 123 66.59.111.182 123 udp - 0.056629 48 48 SF - - 0 Dd 1 76 1 76 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 66.59.111.190 123 129.170.17.4 123 udp - 0.072374 48 48 SF - - 0 Dd 1 76 1 76 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 66.59.111.190 8 172.28.2.3 0 icmp - 3.061298 224 224 OTH - - 0 - 4 336 4 336 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 37675 172.28.2.3 53 udp - 5.001141 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 172.28.2.3 3 66.59.111.190 3 icmp - 4.994662 122 0 OTH - - 0 - 2 178 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 66.59.111.190 40264 172.28.2.3 22 tcp - 3.157831 952 1671 SF F T 0 ShAdDaFf 12 1584 10 2199 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 66.59.111.190 123 18.26.4.105 123 udp - 0.074086 48 48 SF F F 0 Dd 1 76 1 76 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 66.59.111.190 123 66.59.111.182 123 udp - 0.056629 48 48 SF F F 0 Dd 1 76 1 76 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 66.59.111.190 123 129.170.17.4 123 udp - 0.072374 48 48 SF F F 0 Dd 1 76 1 76 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 66.59.111.190 8 172.28.2.3 0 icmp - 3.061298 224 224 OTH F T 0 - 4 336 4 336 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 37675 172.28.2.3 53 udp - 5.001141 66 0 S0 F T 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 172.28.2.3 3 66.59.111.190 3 icmp - 4.994662 122 0 OTH T F 0 - 2 178 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.flip-without-syn/conn.log b/testing/btest/Baseline/core.tcp.flip-without-syn/conn.log index d058edc5de..202b48f3e0 100644 --- a/testing/btest/Baseline/core.tcp.flip-without-syn/conn.log +++ b/testing/btest/Baseline/core.tcp.flip-without-syn/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 6669 192.150.187.43 80 tcp http 0.141744 136 5007 SF - - 0 ^hADadFf 6 456 7 5371 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 6669 192.150.187.43 80 tcp http 0.141744 136 5007 SF F F 0 ^hADadFf 6 456 7 5371 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.large-file-reassembly/conn.log b/testing/btest/Baseline/core.tcp.large-file-reassembly/conn.log index 1f8ad69d5b..1913234f75 100644 --- a/testing/btest/Baseline/core.tcp.large-file-reassembly/conn.log +++ b/testing/btest/Baseline/core.tcp.large-file-reassembly/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.56.1 59763 192.168.56.101 63988 tcp ftp-data 0.001676 0 270 SF - - 0 ShAdfFa 5 272 4 486 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.56.1 59764 192.168.56.101 37150 tcp ftp-data 150.496065 0 5416666670 SF - - 5416642848 ShAdgfFa 13 688 12 24454 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.1 59762 192.168.56.101 21 tcp ftp 169.634297 104 1041 SF - - 0 ShAdDaFf 31 1728 18 1985 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.56.1 59763 192.168.56.101 63988 tcp ftp-data 0.001676 0 270 SF T T 0 ShAdfFa 5 272 4 486 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.56.1 59764 192.168.56.101 37150 tcp ftp-data 150.496065 0 5416666670 SF T T 5416642848 ShAdgfFa 13 688 12 24454 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.1 59762 192.168.56.101 21 tcp ftp 169.634297 104 1041 SF T T 0 ShAdDaFf 31 1728 18 1985 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log b/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log index 7780de5df1..7cd6a2e1dc 100644 --- a/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log +++ b/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FnoIda1WW6kUCpRjRc ClEkJM2Vm5giqnMf4h 192.168.56.1 59763 192.168.56.101 63988 FTP_DATA 0 DATA_EVENT text/plain - 0.000000 - F 270 - 0 0 F - - - - - - - -XXXXXXXXXX.XXXXXX F1jSMF2ntWAIdj4juj C4J4Th3PJpwUYZZ6gc 192.168.56.1 59764 192.168.56.101 37150 FTP_DATA 0 DATA_EVENT text/plain - 150.490904 - F 23822 - 5416642848 0 F - - - - - - - +XXXXXXXXXX.XXXXXX FnoIda1WW6kUCpRjRc ClEkJM2Vm5giqnMf4h 192.168.56.1 59763 192.168.56.101 63988 FTP_DATA 0 DATA_EVENT text/plain - 0.000000 T F 270 - 0 0 F - - - - - - - +XXXXXXXXXX.XXXXXX F1jSMF2ntWAIdj4juj C4J4Th3PJpwUYZZ6gc 192.168.56.1 59764 192.168.56.101 37150 FTP_DATA 0 DATA_EVENT text/plain - 150.490904 T F 23822 - 5416642848 0 F - - - - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.miss-end-data/conn.log b/testing/btest/Baseline/core.tcp.miss-end-data/conn.log index 8a503a9eaa..8674407e79 100644 --- a/testing/btest/Baseline/core.tcp.miss-end-data/conn.log +++ b/testing/btest/Baseline/core.tcp.miss-end-data/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.122.230 60648 77.238.160.184 80 tcp http 10.048360 538 2902 SF - - 2902 ShADafgF 5 750 4 172 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.122.230 60648 77.238.160.184 80 tcp http 10.048360 538 2902 SF T F 2902 ShADafgF 5 750 4 172 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.missing-syn/conn.log b/testing/btest/Baseline/core.tcp.missing-syn/conn.log index d796024d57..d2cf690a76 100644 --- a/testing/btest/Baseline/core.tcp.missing-syn/conn.log +++ b/testing/btest/Baseline/core.tcp.missing-syn/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.42.64.125 56730 125.190.109.199 80 tcp http 1.550793 98 9417 SF - - 0 ^hADdFaf 11 670 10 9945 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.42.64.125 56730 125.190.109.199 80 tcp http 1.550793 98 9417 SF F F 0 ^hADdFaf 11 670 10 9945 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.reassembly-known-ports/conn.log b/testing/btest/Baseline/core.tcp.reassembly-known-ports/conn.log index 549372ab8e..58033995e6 100644 --- a/testing/btest/Baseline/core.tcp.reassembly-known-ports/conn.log +++ b/testing/btest/Baseline/core.tcp.reassembly-known-ports/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 tcp http 0.211484 136 5007 SF - - 0 ShADadFf 7 512 7 5379 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 tcp http 0.211484 136 5007 SF F F 0 ShADadFf 7 512 7 5379 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.rxmit-history/conn-1.log b/testing/btest/Baseline/core.tcp.rxmit-history/conn-1.log index 9031a913f6..63ef18bb5e 100644 --- a/testing/btest/Baseline/core.tcp.rxmit-history/conn-1.log +++ b/testing/btest/Baseline/core.tcp.rxmit-history/conn-1.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.88.85 50368 192.168.0.27 80 tcp - 60.991770 474 23783 RSTO - - 24257 ShADaGdgtR 17 1250 22 28961 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.88.85 50368 192.168.0.27 80 tcp - 60.991770 474 23783 RSTO T T 24257 ShADaGdgtR 17 1250 22 28961 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tcp.rxmit-history/conn-2.log b/testing/btest/Baseline/core.tcp.rxmit-history/conn-2.log index 8d7b7f3361..a0ffabf912 100644 --- a/testing/btest/Baseline/core.tcp.rxmit-history/conn-2.log +++ b/testing/btest/Baseline/core.tcp.rxmit-history/conn-2.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp dns - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.50 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.44 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 137 141.142.220.255 137 udp dns 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp dns 0.100096 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.226 55131 224.0.0.252 5355 udp dns 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp dns 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 141.142.220.226 55671 224.0.0.252 5355 udp dns 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 141.142.220.238 56641 141.142.220.255 137 udp dns - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH - - 0 ^h 0 0 1 48 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp dns - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.50 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.44 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 137 141.142.220.255 137 udp dns 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp dns 0.100096 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.226 55131 224.0.0.252 5355 udp dns 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp dns 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 141.142.220.226 55671 224.0.0.252 5355 udp dns 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 141.142.220.238 56641 141.142.220.255 137 udp dns - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH F F 0 ^h 0 0 1 48 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.analyzer-confirmation/conn.log b/testing/btest/Baseline/core.tunnels.analyzer-confirmation/conn.log index 875f72abca..ba4a3ef0d9 100644 --- a/testing/btest/Baseline/core.tunnels.analyzer-confirmation/conn.log +++ b/testing/btest/Baseline/core.tunnels.analyzer-confirmation/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.200.131 50000 10.1.1.172 4789 udp vxlan 0.627090 10203 0 S0 - - 0 D 12 10539 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.16.11.201 40354 54.86.237.188 80 tcp http 0.627052 87 9212 SF - - 0 ShADadFf 7 459 5 9480 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.200.131 50000 10.1.1.172 4789 udp vxlan 0.627090 10203 0 S0 T T 0 D 12 10539 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.16.11.201 40354 54.86.237.188 80 tcp http 0.627052 87 9212 SF T F 0 ShADadFf 7 459 5 9480 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.ayiya/conn.log b/testing/btest/Baseline/core.tunnels.ayiya/conn.log index 15a32535ce..8008004081 100644 --- a/testing/btest/Baseline/core.tunnels.ayiya/conn.log +++ b/testing/btest/Baseline/core.tunnels.ayiya/conn.log @@ -7,12 +7,12 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg :: 135 ff02::1:ff00:2 136 icmp - - - - OTH - - 0 - 1 64 0 0 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.3.101 53796 216.14.98.22 5072 udp ayiya - - - SHR - - 0 ^d 0 0 1 176 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.3.101 53859 216.14.98.22 5072 udp ayiya 20.879001 5129 6109 SF - - 0 Dd 21 5717 13 6473 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 - - 0 ShADad 10 3605 11 5329 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2001:4978:f:4c::1 128 2001:4978:f:4c::2 129 icmp - 23.834987 168 56 OTH - - 0 - 3 312 1 104 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH - - 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH - - 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH - - 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg :: 135 ff02::1:ff00:2 136 icmp - - - - OTH T F 0 - 1 64 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.3.101 53796 216.14.98.22 5072 udp ayiya - - - SHR T F 0 ^d 0 0 1 176 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.3.101 53859 216.14.98.22 5072 udp ayiya 20.879001 5129 6109 SF T F 0 Dd 21 5717 13 6473 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 2001:4978:f:4c::2 53382 2001:4860:b002::68 80 tcp http 2.101052 2981 4665 S1 F F 0 ShADad 10 3605 11 5329 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2001:4978:f:4c::1 128 2001:4978:f:4c::2 129 icmp - 23.834987 168 56 OTH F F 0 - 3 312 1 104 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff00:2 130 icmp - 0.919988 32 0 OTH T F 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::216:cbff:fe9a:4cb9 131 ff02::1:ff9a:4cb9 130 icmp - 4.922880 32 0 OTH T F 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::216:cbff:fe9a:4cb9 131 ff02::2:f901:d225 130 icmp - 0.719947 32 0 OTH T F 0 - 2 144 0 0 C4J4Th3PJpwUYZZ6gc #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.geneve/conn.log b/testing/btest/Baseline/core.tunnels.geneve/conn.log index a4fb26d63c..0b2e19b8df 100644 --- a/testing/btest/Baseline/core.tunnels.geneve/conn.log +++ b/testing/btest/Baseline/core.tunnels.geneve/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 20.0.0.2 0 20.0.0.1 6081 udp geneve 1.999999 318 0 S0 - - 0 D 3 402 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 20.0.0.1 50901 20.0.0.2 6081 udp geneve 1.999995 342 0 S0 - - 0 D 3 426 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 30.0.0.1 8 30.0.0.2 0 icmp - 2.000182 168 168 OTH - - 0 - 3 252 3 252 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 20.0.0.2 0 20.0.0.1 6081 udp geneve 1.999999 318 0 S0 F F 0 D 3 402 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 20.0.0.1 50901 20.0.0.2 6081 udp geneve 1.999995 342 0 S0 F F 0 D 3 426 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 30.0.0.1 8 30.0.0.2 0 icmp - 2.000182 168 168 OTH F F 0 - 3 252 3 252 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gre-in-gre/conn.log b/testing/btest/Baseline/core.tunnels.gre-in-gre/conn.log index 90f124d331..97600494bc 100644 --- a/testing/btest/Baseline/core.tunnels.gre-in-gre/conn.log +++ b/testing/btest/Baseline/core.tunnels.gre-in-gre/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 3.3.3.1 520 224.0.0.9 520 udp - 28.555457 168 0 S0 - - 0 D 2 224 0 0 ClEkJM2Vm5giqnMf4h -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 3.3.3.2 520 224.0.0.9 520 udp - 26.148268 48 0 S0 - - 0 D 2 104 0 0 ClEkJM2Vm5giqnMf4h -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.10.25.1 8 192.168.1.2 0 icmp - 42.380221 22464 22464 OTH - - 0 - 312 31200 312 31200 ClEkJM2Vm5giqnMf4h +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 3.3.3.1 520 224.0.0.9 520 udp - 28.555457 168 0 S0 F F 0 D 2 224 0 0 ClEkJM2Vm5giqnMf4h +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 3.3.3.2 520 224.0.0.9 520 udp - 26.148268 48 0 S0 F F 0 D 2 104 0 0 ClEkJM2Vm5giqnMf4h +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.10.25.1 8 192.168.1.2 0 icmp - 42.380221 22464 22464 OTH T T 0 - 312 31200 312 31200 ClEkJM2Vm5giqnMf4h #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gre-pptp/conn.log b/testing/btest/Baseline/core.tunnels.gre-pptp/conn.log index c670a075e7..46de793cc0 100644 --- a/testing/btest/Baseline/core.tunnels.gre-pptp/conn.log +++ b/testing/btest/Baseline/core.tunnels.gre-pptp/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.16.44.3 40768 8.8.8.8 53 udp dns 0.213894 71 146 SF - - 0 Dd 1 99 1 174 ClEkJM2Vm5giqnMf4h +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.16.44.3 40768 8.8.8.8 53 udp dns 0.213894 71 146 SF T F 0 Dd 1 99 1 174 ClEkJM2Vm5giqnMf4h #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gre/conn.log b/testing/btest/Baseline/core.tunnels.gre/conn.log index 8b8bbe77b3..9894bc52ca 100644 --- a/testing/btest/Baseline/core.tunnels.gre/conn.log +++ b/testing/btest/Baseline/core.tunnels.gre/conn.log @@ -7,11 +7,11 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 40264 172.28.2.3 22 tcp ssh 3.157831 952 1671 SF - - 0 ShAdDaFf 12 1584 10 2199 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 66.59.111.190 37675 172.28.2.3 53 udp dns 5.001141 66 0 S0 - - 0 D 2 122 0 0 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 66.59.111.190 123 18.26.4.105 123 udp ntp 0.074086 48 48 SF - - 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 66.59.111.190 123 66.59.111.182 123 udp ntp 0.056629 48 48 SF - - 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 66.59.111.190 123 129.170.17.4 123 udp ntp 0.072374 48 48 SF - - 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 66.59.111.190 8 172.28.2.3 0 icmp - 3.061298 224 224 OTH - - 0 - 4 336 4 336 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 172.28.2.3 3 66.59.111.190 3 icmp - 4.994662 122 0 OTH - - 0 - 2 178 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 40264 172.28.2.3 22 tcp ssh 3.157831 952 1671 SF F T 0 ShAdDaFf 12 1584 10 2199 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 66.59.111.190 37675 172.28.2.3 53 udp dns 5.001141 66 0 S0 F T 0 D 2 122 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 66.59.111.190 123 18.26.4.105 123 udp ntp 0.074086 48 48 SF F F 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 66.59.111.190 123 66.59.111.182 123 udp ntp 0.056629 48 48 SF F F 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 66.59.111.190 123 129.170.17.4 123 udp ntp 0.072374 48 48 SF F F 0 Dd 1 76 1 76 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 66.59.111.190 8 172.28.2.3 0 icmp - 3.061298 224 224 OTH F T 0 - 4 336 4 336 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 172.28.2.3 3 66.59.111.190 3 icmp - 4.994662 122 0 OTH T F 0 - 2 178 0 0 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gre/ssh.log b/testing/btest/Baseline/core.tunnels.gre/ssh.log index 056476fb75..5655db55c7 100644 --- a/testing/btest/Baseline/core.tunnels.gre/ssh.log +++ b/testing/btest/Baseline/core.tunnels.gre/ssh.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success auth_attempts direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key #types time string addr port addr port count bool count enum string string string string string string string string -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 40264 172.28.2.3 22 2 - 0 - SSH-2.0-OpenSSH_3.6.1p1 SSH-1.99-OpenSSH_3.1p1 blowfish-cbc hmac-md5 zlib diffie-hellman-group-exchange-sha1 ssh-rsa 20:7c:e5:96:b0:4e:ce:a4:db:e4:aa:29:e8:90:98:07 +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 66.59.111.190 40264 172.28.2.3 22 2 - 0 INBOUND SSH-2.0-OpenSSH_3.6.1p1 SSH-1.99-OpenSSH_3.1p1 blowfish-cbc hmac-md5 zlib diffie-hellman-group-exchange-sha1 ssh-rsa 20:7c:e5:96:b0:4e:ce:a4:db:e4:aa:29:e8:90:98:07 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.different_dl_and_ul/conn.log b/testing/btest/Baseline/core.tunnels.gtp.different_dl_and_ul/conn.log index 48ac92ab47..6e8beb5874 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.different_dl_and_ul/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.different_dl_and_ul/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.131.17.170 51803 173.199.115.168 80 tcp http 0.257902 1138 63424 S3 - - 0 ShADadf 29 2310 49 65396 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 207.233.125.40 2152 167.55.105.244 2152 udp gtpv1 0.251127 65788 0 S0 - - 0 D 49 67160 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 167.55.105.244 5906 207.233.125.40 2152 udp gtpv1 0.257902 2542 0 S0 - - 0 D 29 3354 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.131.17.170 51803 173.199.115.168 80 tcp http 0.257902 1138 63424 S3 T F 0 ShADadf 29 2310 49 65396 CHhAvVGS1DHFjwGM9,C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 207.233.125.40 2152 167.55.105.244 2152 udp gtpv1 0.251127 65788 0 S0 F F 0 D 49 67160 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 167.55.105.244 5906 207.233.125.40 2152 udp gtpv1 0.257902 2542 0 S0 F F 0 D 29 3354 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.false_gtp/conn.log b/testing/btest/Baseline/core.tunnels.gtp.false_gtp/conn.log index 258a0d760a..1030b69399 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.false_gtp/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.false_gtp/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.131.24.6 2152 195.178.38.3 53 udp dns - - - S0 - - 0 D 1 64 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.131.24.6 2152 195.178.38.3 53 udp dns - - - S0 T F 0 D 1 64 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.inner_ipv6/conn.log b/testing/btest/Baseline/core.tunnels.gtp.inner_ipv6/conn.log index f9d46dc749..7f2886f9b5 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.inner_ipv6/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.inner_ipv6/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::224c:4fff:fe43:414c 1234 ff02::1:3 5355 udp dns - - - S0 - - 0 D 1 80 0 0 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 118.92.124.41 2152 118.92.124.72 2152 udp gtpv1 0.199236 152 0 S0 - - 0 D 2 208 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc fe80::224c:4fff:fe43:414c 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 56 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::224c:4fff:fe43:414c 1234 ff02::1:3 5355 udp dns - - - S0 T F 0 D 1 80 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 118.92.124.41 2152 118.92.124.72 2152 udp gtpv1 0.199236 152 0 S0 F F 0 D 2 208 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc fe80::224c:4fff:fe43:414c 133 ff02::2 134 icmp - - - - OTH T F 0 - 1 56 0 0 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.inner_teredo/conn.log b/testing/btest/Baseline/core.tunnels.gtp.inner_teredo/conn.log index 28d8199bc7..3c7b5645ef 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.inner_teredo/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.inner_teredo/conn.log @@ -7,21 +7,21 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 10.131.42.160 62069 94.245.121.253 3544 udp teredo - - - SHR - - 0 ^d 0 0 1 84 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 10.131.112.102 51403 94.245.121.253 3544 udp teredo - - - SHR - - 0 ^d 0 0 1 84 Ck51lg1bScffFj34Ri -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 172.24.16.67 52298 65.55.158.118 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CmES5u32sYpV7JYN -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 172.24.203.81 54447 65.55.158.118 3544 udp teredo 0.003698 120 0 S0 - - 0 D 2 176 0 0 CNnMIj2QSd84NKf7U3 -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.24.204.200 56528 65.55.158.118 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 172.24.16.121 61901 94.245.121.251 3544 udp teredo - - - S0 - - 0 D 1 80 0 0 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 172.24.16.67 52298 94.245.121.253 3544 udp teredo - - - S0 - - 0 D 1 88 0 0 CmES5u32sYpV7JYN -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 172.27.159.9 63912 94.245.121.253 3544 udp teredo - - - S0 - - 0 D 1 89 0 0 CwjjYJ2WqgTbAqiHl6 -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 172.27.159.9 63912 94.245.121.254 3544 udp teredo - - - S0 - - 0 D 1 89 0 0 CwjjYJ2WqgTbAqiHl6 -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 174.94.190.213 2152 190.104.181.57 2152 udp gtpv1 - - - S0 - - 0 D 1 124 0 0 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 174.94.190.229 2152 190.104.181.57 2152 udp gtpv1 0.003698 192 0 S0 - - 0 D 2 248 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 174.94.190.229 2152 190.104.181.62 2152 udp gtpv1 0.016267 88 92 SF - - 0 Dd 1 116 1 120 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 190.104.181.57 2152 190.104.181.222 2152 udp gtpv1 - - - S0 - - 0 D 1 120 0 0 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 190.104.181.254 2152 190.104.181.62 2152 udp gtpv1 0.000002 192 0 S0 - - 0 D 2 248 0 0 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 190.104.181.210 2152 190.104.181.125 2152 udp gtpv1 0.000004 194 0 S0 - - 0 D 2 250 0 0 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 2001:0:5ef5:79fb:38b8:1695:2b37:be8e 128 2002:2571:c817::2571:c817 129 icmp - - - - OTH - - 0 - 1 52 0 0 CtPZjS20MLrsMUOJi2 -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh fe80::ffff:ffff:fffe 133 ff02::2 134 icmp - 0.000004 0 0 OTH - - 0 - 2 96 0 0 C0LAHyvtKSQHyJxIl,C9rXSW3KSpTYvPrlI1 +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 10.131.42.160 62069 94.245.121.253 3544 udp teredo - - - SHR T F 0 ^d 0 0 1 84 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 10.131.112.102 51403 94.245.121.253 3544 udp teredo - - - SHR T F 0 ^d 0 0 1 84 Ck51lg1bScffFj34Ri +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 172.24.16.67 52298 65.55.158.118 3544 udp teredo - - - S0 T F 0 D 1 88 0 0 CmES5u32sYpV7JYN +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 172.24.203.81 54447 65.55.158.118 3544 udp teredo 0.003698 120 0 S0 T F 0 D 2 176 0 0 CNnMIj2QSd84NKf7U3 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.24.204.200 56528 65.55.158.118 3544 udp teredo - - - S0 T F 0 D 1 88 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 172.24.16.121 61901 94.245.121.251 3544 udp teredo - - - S0 T F 0 D 1 80 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 172.24.16.67 52298 94.245.121.253 3544 udp teredo - - - S0 T F 0 D 1 88 0 0 CmES5u32sYpV7JYN +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 172.27.159.9 63912 94.245.121.253 3544 udp teredo - - - S0 T F 0 D 1 89 0 0 CwjjYJ2WqgTbAqiHl6 +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 172.27.159.9 63912 94.245.121.254 3544 udp teredo - - - S0 T F 0 D 1 89 0 0 CwjjYJ2WqgTbAqiHl6 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 174.94.190.213 2152 190.104.181.57 2152 udp gtpv1 - - - S0 F F 0 D 1 124 0 0 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 174.94.190.229 2152 190.104.181.57 2152 udp gtpv1 0.003698 192 0 S0 F F 0 D 2 248 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 174.94.190.229 2152 190.104.181.62 2152 udp gtpv1 0.016267 88 92 SF F F 0 Dd 1 116 1 120 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 190.104.181.57 2152 190.104.181.222 2152 udp gtpv1 - - - S0 F F 0 D 1 120 0 0 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 190.104.181.254 2152 190.104.181.62 2152 udp gtpv1 0.000002 192 0 S0 F F 0 D 2 248 0 0 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 190.104.181.210 2152 190.104.181.125 2152 udp gtpv1 0.000004 194 0 S0 F F 0 D 2 250 0 0 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 2001:0:5ef5:79fb:38b8:1695:2b37:be8e 128 2002:2571:c817::2571:c817 129 icmp - - - - OTH T F 0 - 1 52 0 0 CtPZjS20MLrsMUOJi2 +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh fe80::ffff:ffff:fffe 133 ff02::2 134 icmp - 0.000004 0 0 OTH T F 0 - 2 96 0 0 C0LAHyvtKSQHyJxIl,C9rXSW3KSpTYvPrlI1 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.not_user_plane_data/conn.log b/testing/btest/Baseline/core.tunnels.gtp.not_user_plane_data/conn.log index 432efc0afe..c0ab60039d 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.not_user_plane_data/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.not_user_plane_data/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 247.56.43.214 2152 237.56.101.238 2152 udp - 0.028676 12 14 SF - - 0 Dd 1 40 1 42 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 247.56.43.90 2152 247.56.43.248 2152 udp - - - - S0 - - 0 D 1 52 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 247.56.43.214 2152 237.56.101.238 2152 udp - 0.028676 12 14 SF T F 0 Dd 1 40 1 42 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 247.56.43.90 2152 247.56.43.248 2152 udp - - - - S0 T T 0 D 1 52 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.opt_header/conn.log b/testing/btest/Baseline/core.tunnels.gtp.opt_header/conn.log index a81377bb79..d87ff7d94f 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.opt_header/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.opt_header/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.222.10.10 44960 173.194.69.188 5228 tcp ssl 0.573499 704 1026 S1 - - 0 ShADad 17 1604 14 1762 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 79.188.154.91 2152 243.149.173.198 2152 udp gtpv1 0.573499 1740 1930 SF - - 0 Dd 17 2216 14 2322 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.222.10.10 44960 173.194.69.188 5228 tcp ssl 0.573499 704 1026 S1 T F 0 ShADad 17 1604 14 1762 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 79.188.154.91 2152 243.149.173.198 2152 udp gtpv1 0.573499 1740 1930 SF F T 0 Dd 17 2216 14 2322 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.gtp.outer_ip_frag/conn.log b/testing/btest/Baseline/core.tunnels.gtp.outer_ip_frag/conn.log index c16c9c5156..51f3e36f85 100644 --- a/testing/btest/Baseline/core.tunnels.gtp.outer_ip_frag/conn.log +++ b/testing/btest/Baseline/core.tunnels.gtp.outer_ip_frag/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.131.47.185 1923 79.101.110.141 80 tcp http 0.069783 2100 56702 SF - - 5760 ShADadfgF 27 3204 41 52594 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 239.114.155.111 2152 63.94.149.181 2152 udp gtpv1 0.069813 3420 52922 SF - - 0 Dd 27 4176 41 54070 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.131.47.185 1923 79.101.110.141 80 tcp http 0.069783 2100 56702 SF T F 5760 ShADadfgF 27 3204 41 52594 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 239.114.155.111 2152 63.94.149.181 2152 udp gtpv1 0.069813 3420 52922 SF F F 0 Dd 27 4176 41 54070 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.teredo/conn.log b/testing/btest/Baseline/core.tunnels.teredo/conn.log index cd5133fad5..8e5b0d6679 100644 --- a/testing/btest/Baseline/core.tunnels.teredo/conn.log +++ b/testing/btest/Baseline/core.tunnels.teredo/conn.log @@ -7,25 +7,25 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR - - 0 ^fA 1 40 1 40 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.16 1577 75.126.203.78 80 tcp - 0.000387 0 0 SHR - - 0 ^fA 1 40 1 40 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.16 1577 75.126.203.78 80 tcp - 0.079208 0 0 SH - - 0 Fa 1 40 1 40 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.16 1576 75.126.130.163 80 tcp - - - - OTH - - 0 R 1 40 0 0 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.16 1578 75.126.203.78 80 tcp http 0.407908 790 171 RSTO - - 0 ShADadR 6 1038 4 335 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.16 1920 192.168.2.1 53 udp dns 0.223055 66 438 SF - - 0 Dd 2 122 2 494 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.16 137 192.168.2.255 137 udp dns 1.499261 150 0 S0 - - 0 D 3 234 0 0 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.2.16 1920 192.168.2.1 53 udp dns 0.297723 123 598 SF - - 0 Dd 3 207 3 682 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 0.0.0.0 68 255.255.255.255 67 udp dhcp - - - S0 - - 0 D 1 328 0 0 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.16 3797 65.55.158.80 3544 udp teredo 8.928880 129 48 SF - - 0 Dd 2 185 1 76 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 ^d 0 0 1 137 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.2.16 1580 67.228.110.120 80 tcp http 0.466677 469 3916 SF - - 0 ShADadFf 7 757 6 4164 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.2.16 1577 75.126.203.78 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 192.168.2.16 1578 75.126.203.78 80 tcp - - - - RSTRH - - 0 ^r 0 0 1 40 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.2.16 3797 83.170.1.38 32900 udp teredo 13.293994 2359 11243 SF - - 0 Dd 12 2695 13 11607 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.2.16 138 192.168.2.255 138 udp - 28.448321 416 0 S0 - - 0 D 2 472 0 0 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH - - 0 - 1 52 1 52 Ck51lg1bScffFj34Ri,CtPZjS20MLrsMUOJi2 -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 12.810848 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 Ck51lg1bScffFj34Ri -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CmES5u32sYpV7JYN -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CtPZjS20MLrsMUOJi2 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.2.16 1576 75.126.130.163 80 tcp - 0.000357 0 0 SHR T F 0 ^fA 1 40 1 40 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.16 1577 75.126.203.78 80 tcp - 0.000387 0 0 SHR T F 0 ^fA 1 40 1 40 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.16 1577 75.126.203.78 80 tcp - 0.079208 0 0 SH T F 0 Fa 1 40 1 40 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.16 1576 75.126.130.163 80 tcp - - - - OTH T F 0 R 1 40 0 0 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.16 1578 75.126.203.78 80 tcp http 0.407908 790 171 RSTO T F 0 ShADadR 6 1038 4 335 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.16 1920 192.168.2.1 53 udp dns 0.223055 66 438 SF T T 0 Dd 2 122 2 494 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.16 137 192.168.2.255 137 udp dns 1.499261 150 0 S0 T T 0 D 3 234 0 0 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.2.16 1920 192.168.2.1 53 udp dns 0.297723 123 598 SF T T 0 Dd 3 207 3 682 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 0.0.0.0 68 255.255.255.255 67 udp dhcp - - - S0 T T 0 D 1 328 0 0 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.16 3797 65.55.158.80 3544 udp teredo 8.928880 129 48 SF T F 0 Dd 2 185 1 76 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR T F 0 ^d 0 0 1 137 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.2.16 1580 67.228.110.120 80 tcp http 0.466677 469 3916 SF T F 0 ShADadFf 7 757 6 4164 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.2.16 1576 75.126.130.163 80 tcp - - - - RSTRH T F 0 ^r 0 0 1 40 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.2.16 1577 75.126.203.78 80 tcp - - - - RSTRH T F 0 ^r 0 0 1 40 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 192.168.2.16 1578 75.126.203.78 80 tcp - - - - RSTRH T F 0 ^r 0 0 1 40 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.2.16 3797 83.170.1.38 32900 udp teredo 13.293994 2359 11243 SF T F 0 Dd 12 2695 13 11607 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.2.16 138 192.168.2.255 138 udp - 28.448321 416 0 S0 T T 0 D 2 472 0 0 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.463615 4 4 OTH T F 0 - 1 52 1 52 Ck51lg1bScffFj34Ri,CtPZjS20MLrsMUOJi2 +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 12.810848 1675 10467 S1 T F 0 ShADad 10 2279 12 11191 Ck51lg1bScffFj34Ri +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH T T 0 - 1 88 0 0 CmES5u32sYpV7JYN +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH T F 0 - 1 64 0 0 CtPZjS20MLrsMUOJi2 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log index 01c6fc86a2..97d373eb90 100644 --- a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log +++ b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log @@ -7,11 +7,11 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.2.16 3797 65.55.158.80 3544 udp teredo 0.010291 129 52 SF - - 0 Dd 2 185 1 80 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR - - 0 ^d 0 0 1 137 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.16 3797 83.170.1.38 32900 udp teredo 0.065485 2367 11243 SF - - 0 Dd 12 2703 13 11607 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - - 0 - 1 52 1 52 CHhAvVGS1DHFjwGM9,CUM0KZ3MLUfNB0cl11 -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 CUM0KZ3MLUfNB0cl11 -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.2.16 3797 65.55.158.80 3544 udp teredo 0.010291 129 52 SF T F 0 Dd 2 185 1 80 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.16 3797 65.55.158.81 3544 udp - - - - SHR T F 0 ^d 0 0 1 137 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.16 3797 83.170.1.38 32900 udp teredo 0.065485 2367 11243 SF T F 0 Dd 12 2703 13 11607 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH T F 0 - 1 52 1 52 CHhAvVGS1DHFjwGM9,CUM0KZ3MLUfNB0cl11 +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 T F 0 ShADad 10 2279 12 11191 CUM0KZ3MLUfNB0cl11 +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH T T 0 - 1 88 0 0 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH T F 0 - 1 64 0 0 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.vxlan-unknown-internal-packet/conn.log b/testing/btest/Baseline/core.tunnels.vxlan-unknown-internal-packet/conn.log index 200f6e79b9..e4bc9b8e50 100644 --- a/testing/btest/Baseline/core.tunnels.vxlan-unknown-internal-packet/conn.log +++ b/testing/btest/Baseline/core.tunnels.vxlan-unknown-internal-packet/conn.log @@ -1,12 +1,13 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path conn -#open 2023-01-25-16-21-59 +#open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -1673538029.809899 CHhAvVGS1DHFjwGM9 172.30.0.1 48036 172.30.0.2 4789 udp - - - - OTH - - 0 C 0 0 0 0 - -1673538054.797831 ClEkJM2Vm5giqnMf4h 172.30.0.1 45303 172.30.0.2 4789 udp - - - - OTH - - 0 C 0 0 0 0 - -1673538167.375490 C4J4Th3PJpwUYZZ6gc 172.30.0.1 36030 172.30.0.2 4789 udp - - - - OTH - - 0 C 0 0 0 0 - -#close 2023-01-25-16-21-59 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.30.0.1 48036 172.30.0.2 4789 udp - - - - OTH T T 0 C 0 0 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.30.0.1 45303 172.30.0.2 4789 udp - - - - OTH T T 0 C 0 0 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 172.30.0.1 36030 172.30.0.2 4789 udp - - - - OTH T T 0 C 0 0 0 0 - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.tunnels.vxlan/conn.log b/testing/btest/Baseline/core.tunnels.vxlan/conn.log index 0688cd19d0..5b4f30a46f 100644 --- a/testing/btest/Baseline/core.tunnels.vxlan/conn.log +++ b/testing/btest/Baseline/core.tunnels.vxlan/conn.log @@ -7,9 +7,9 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 10.0.0.1 8 10.0.0.2 0 icmp - 3.004616 224 224 OTH - - 0 - 4 336 4 336 CUM0KZ3MLUfNB0cl11,C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.56.12 38071 192.168.56.11 4789 udp vxlan 3.004278 424 0 S0 - - 0 D 4 536 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.56.12 40908 192.168.56.11 4789 udp vxlan - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.11 39924 192.168.56.12 4789 udp vxlan - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.56.11 48134 192.168.56.12 4789 udp vxlan 3.004434 424 0 S0 - - 0 D 4 536 0 0 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 10.0.0.1 8 10.0.0.2 0 icmp - 3.004616 224 224 OTH T T 0 - 4 336 4 336 CUM0KZ3MLUfNB0cl11,C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.56.12 38071 192.168.56.11 4789 udp vxlan 3.004278 424 0 S0 T T 0 D 4 536 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.56.12 40908 192.168.56.11 4789 udp vxlan - - - S0 T T 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.56.11 39924 192.168.56.12 4789 udp vxlan - - - S0 T T 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.56.11 48134 192.168.56.12 4789 udp vxlan 3.004434 424 0 S0 T T 0 D 4 536 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.vlan-mpls/conn.log b/testing/btest/Baseline/core.vlan-mpls/conn.log index 0428f70d92..6625b40126 100644 --- a/testing/btest/Baseline/core.vlan-mpls/conn.log +++ b/testing/btest/Baseline/core.vlan-mpls/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH - - 0 SADF 11 470 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF - - 0 ShADdFaf 12 730 10 9945 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.20.80.1 50343 10.0.0.15 80 tcp http 0.004152 9 3429 SF - - 0 ShADadfF 7 381 7 3801 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.2.1 11001 10.34.0.1 23 tcp - 2.102560 26 0 SH T T 0 SADF 11 470 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.42.64.125 56730 125.190.109.199 80 tcp http 1.733303 98 9417 SF F F 0 ShADdFaf 12 730 10 9945 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.20.80.1 50343 10.0.0.15 80 tcp http 0.004152 9 3429 SF T T 0 ShADadfF 7 381 7 3801 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/core.wlanmon/conn.log b/testing/btest/Baseline/core.wlanmon/conn.log index f46222cd3a..57369a00ac 100644 --- a/testing/btest/Baseline/core.wlanmon/conn.log +++ b/testing/btest/Baseline/core.wlanmon/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp dns 0.009303 35 128 SF - - 0 Dd 1 63 1 156 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp dns - - - S0 - - 0 D 1 328 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp dns 0.009303 35 128 SF T F 0 Dd 1 63 1 156 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp dns - - - S0 T F 0 D 1 328 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 5fe1183b58..55b3673ea8 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -716,7 +716,7 @@ 0.000000 MetaHookPost CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T, failure_reason=], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> 0.000000 MetaHookPost CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) -> 0.000000 MetaHookPost CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) -> -0.000000 MetaHookPost CallFunction(Site::update_local_nets_table, , (Site::local_nets, {})) -> +0.000000 MetaHookPost CallFunction(Site::update_local_nets_table, , (Site::local_nets, {64:ff9b:1::<...>/15,fc00::<...>/10,::/128,2002:ffff:ffff::/48,::1/128,2002:cb00:7100::<...>/4,2002:c633:6400::/40,2002:a00::/24,100::<...>/8,2001:2::/48,2002:c000:200::<...>/12,2002:f000::/20,2002:7f00::/24,2001::/23,2002:6440::/26,2002:c000::<...>/16,2002:ac10::/28,2002:a9fe::/32,2002:c612::<...>/16,2002::/24,fe80::/10,2001:db8::<...>/24,2002:c0a8::<...>/24})) -> 0.000000 MetaHookPost CallFunction(Site::update_local_zones_regex, , (Site::local_zones, {})) -> 0.000000 MetaHookPost CallFunction(Site::update_neighbor_zones_regex, , (Site::neighbor_zones, {})) -> 0.000000 MetaHookPost CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::STD_DEV, SumStats::VARIANCE)) -> @@ -2289,7 +2289,7 @@ 0.000000 MetaHookPre CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T, failure_reason=], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) 0.000000 MetaHookPre CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) 0.000000 MetaHookPre CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) -0.000000 MetaHookPre CallFunction(Site::update_local_nets_table, , (Site::local_nets, {})) +0.000000 MetaHookPre CallFunction(Site::update_local_nets_table, , (Site::local_nets, {64:ff9b:1::<...>/15,fc00::<...>/10,::/128,2002:ffff:ffff::/48,::1/128,2002:cb00:7100::<...>/4,2002:c633:6400::/40,2002:a00::/24,100::<...>/8,2001:2::/48,2002:c000:200::<...>/12,2002:f000::/20,2002:7f00::/24,2001::/23,2002:6440::/26,2002:c000::<...>/16,2002:ac10::/28,2002:a9fe::/32,2002:c612::<...>/16,2002::/24,fe80::/10,2001:db8::<...>/24,2002:c0a8::<...>/24})) 0.000000 MetaHookPre CallFunction(Site::update_local_zones_regex, , (Site::local_zones, {})) 0.000000 MetaHookPre CallFunction(Site::update_neighbor_zones_regex, , (Site::neighbor_zones, {})) 0.000000 MetaHookPre CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::STD_DEV, SumStats::VARIANCE)) @@ -3861,7 +3861,7 @@ 0.000000 | HookCallFunction PacketFilter::log_policy([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T, failure_reason=], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) 0.000000 | HookCallFunction Pcap::install_pcap_filter(PacketFilter::DefaultPcapFilter) 0.000000 | HookCallFunction Pcap::precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip) -0.000000 | HookCallFunction Site::update_local_nets_table(Site::local_nets, {}) +0.000000 | HookCallFunction Site::update_local_nets_table(Site::local_nets, {64:ff9b:1::<...>/15,fc00::<...>/10,::/128,2002:ffff:ffff::/48,::1/128,2002:cb00:7100::<...>/4,2002:c633:6400::/40,2002:a00::/24,100::<...>/8,2001:2::/48,2002:c000:200::<...>/12,2002:f000::/20,2002:7f00::/24,2001::/23,2002:6440::/26,2002:c000::<...>/16,2002:ac10::/28,2002:a9fe::/32,2002:c612::<...>/16,2002::/24,fe80::/10,2001:db8::<...>/24,2002:c0a8::<...>/24}) 0.000000 | HookCallFunction Site::update_local_zones_regex(Site::local_zones, {}) 0.000000 | HookCallFunction Site::update_neighbor_zones_regex(Site::neighbor_zones, {}) 0.000000 | HookCallFunction SumStats::add_observe_plugin_dependency(SumStats::STD_DEV, SumStats::VARIANCE) @@ -4927,6 +4927,7 @@ XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ( XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Site::is_local_addr, , (192.150.187.43)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, ..., ...) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> @@ -4972,6 +4973,7 @@ XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ( XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Site::is_local_addr, , (192.150.187.43)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, ..., ...) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) @@ -5018,6 +5020,7 @@ XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.2 XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction Site::is_local_addr(192.150.187.43) XXXXXXXXXX.XXXXXX | HookCallFunction cat(...) XXXXXXXXXX.XXXXXX | HookCallFunction file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=]) XXXXXXXXXX.XXXXXX | HookCallFunction file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) @@ -5063,22 +5066,22 @@ XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookDrainEvents -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::code_in_range, , (200, 100, 199)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, ..., ...) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> @@ -5090,28 +5093,28 @@ XXXXXXXXXX.XXXXXX MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}) -> XXXXXXXXXX.XXXXXX MetaHookPost LogWrite(Log::WRITER_ASCII, default, files(XXXXXXXXXX.XXXXXX,0.0,0.0), 27, {ts (time), fuid (string), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), source (string), depth (count), analyzers (set[string]), mime_type (string), filename (string), duration (interval), local_orig (bool), is_orig (bool), seen_bytes (count), total_bytes (count), missing_bytes (count), overflow_bytes (count), timedout (bool), parent_fuid (string), md5 (string), sha1 (string), sha256 (string), extracted (string), extracted_cutoff (bool), extracted_size (count)}, ) -> true XXXXXXXXXX.XXXXXX MetaHookPost LogWrite(Log::WRITER_ASCII, default, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) -> true -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> false XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::code_in_range, , (200, 100, 199)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::set_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, ..., ...) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) @@ -5123,29 +5126,29 @@ XXXXXXXXXX.XXXXXX MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}) XXXXXXXXXX.XXXXXX MetaHookPre LogWrite(Log::WRITER_ASCII, default, files(XXXXXXXXXX.XXXXXX,0.0,0.0), 27, {ts (time), fuid (string), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), source (string), depth (count), analyzers (set[string]), mime_type (string), filename (string), duration (interval), local_orig (bool), is_orig (bool), seen_bytes (count), total_bytes (count), missing_bytes (count), overflow_bytes (count), timedout (bool), parent_fuid (string), md5 (string), sha1 (string), sha256 (string), extracted (string), extracted_cutoff (bool), extracted_size (count)}, ) XXXXXXXXXX.XXXXXX MetaHookPre LogWrite(Log::WRITER_ASCII, default, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX -XXXXXXXXXX.XXXXXX | HookCallFunction Files::log_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -XXXXXXXXXX.XXXXXX | HookCallFunction Files::set_info([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) -XXXXXXXXXX.XXXXXX | HookCallFunction Files::set_info([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Files::log_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Files::set_info([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Files::set_info([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::code_in_range(200, 100, 199) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::set_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]) XXXXXXXXXX.XXXXXX | HookCallFunction Log::log_stream_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::log_stream_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::write(Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::log_stream_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::write(Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) XXXXXXXXXX.XXXXXX | HookCallFunction Log::write(HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]) XXXXXXXXXX.XXXXXX | HookCallFunction cat(...) -XXXXXXXXXX.XXXXXX | HookCallFunction file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) -XXXXXXXXXX.XXXXXX | HookCallFunction file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookCallFunction file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) +XXXXXXXXXX.XXXXXX | HookCallFunction file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) XXXXXXXXXX.XXXXXX | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp) XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) @@ -5155,10 +5158,10 @@ XXXXXXXXXX.XXXXXX | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTPXXXX XXXXXXXXXX.XXXXXX | HookDrainEvents XXXXXXXXXX.XXXXXX | HookLogInit files 1/1 {ts (time), fuid (string), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), source (string), depth (count), analyzers (set[string]), mime_type (string), filename (string), duration (interval), local_orig (bool), is_orig (bool), seen_bytes (count), total_bytes (count), missing_bytes (count), overflow_bytes (count), timedout (bool), parent_fuid (string), md5 (string), sha1 (string), sha256 (string), extracted (string), extracted_cutoff (bool), extracted_size (count)} XXXXXXXXXX.XXXXXX | HookLogInit http 1/1 {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])} -XXXXXXXXXX.XXXXXX | HookLogWrite files [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, source=HTTP, depth=0, analyzers=, mime_type=text/plain, filename=, duration=0.000263, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX | HookLogWrite files [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, source=HTTP, depth=0, analyzers=, mime_type=text/plain, filename=, duration=0.000263, local_orig=F, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, extracted=, extracted_cutoff=, extracted_size=] XXXXXXXXXX.XXXXXX | HookLogWrite http [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags=, username=, password=, proxied=, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=FMnxxt3xjVcWNS2141, resp_filenames=, resp_mime_types=text/plain] -XXXXXXXXXX.XXXXXX | HookQueueEvent file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) -XXXXXXXXXX.XXXXXX | HookQueueEvent file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=F, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=F, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) @@ -5190,16 +5193,18 @@ XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Broker::__flush_logs, , () XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Broker::flush_logs, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Broker::log_flush, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(ChecksumOffloading::check, , ()) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=, local_resp=, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=F, local_resp=F, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(PacketAnalyzer::GTPV1::remove_gtpv1_connection, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(PacketAnalyzer::TEREDO::remove_teredo_connection, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Site::is_local_addr, , (141.142.228.5)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Site::is_local_addr, , (192.150.187.43)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Telemetry::sync, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, ..., ...) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> @@ -5231,16 +5236,18 @@ XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Broker::__flush_logs, , () XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Broker::flush_logs, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Broker::log_flush, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(ChecksumOffloading::check, , ()) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=, local_resp=, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::conn_state, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=F, local_resp=F, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::set_conn, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::log_stream_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(PacketAnalyzer::GTPV1::remove_gtpv1_connection, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(PacketAnalyzer::TEREDO::remove_teredo_connection, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Site::is_local_addr, , (141.142.228.5)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Site::is_local_addr, , (192.150.187.43)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Telemetry::sync, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, ..., ...) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) @@ -5273,16 +5280,18 @@ XXXXXXXXXX.XXXXXX | HookCallFunction Broker::__flush_logs() XXXXXXXXXX.XXXXXX | HookCallFunction Broker::flush_logs() XXXXXXXXXX.XXXXXX | HookCallFunction Broker::log_flush() XXXXXXXXXX.XXXXXX | HookCallFunction ChecksumOffloading::check() -XXXXXXXXXX.XXXXXX | HookCallFunction Conn::conn_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=, local_resp=, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp) -XXXXXXXXXX.XXXXXX | HookCallFunction Conn::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Conn::conn_state([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=, local_orig=F, local_resp=F, missed_bytes=0, history=, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], tcp) +XXXXXXXXXX.XXXXXX | HookCallFunction Conn::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) XXXXXXXXXX.XXXXXX | HookCallFunction Conn::set_conn([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::finalize_http([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::finalize_http([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::log_stream_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG) -XXXXXXXXXX.XXXXXX | HookCallFunction Log::write(Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::log_stream_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG) +XXXXXXXXXX.XXXXXX | HookCallFunction Log::write(Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) XXXXXXXXXX.XXXXXX | HookCallFunction PacketAnalyzer::GTPV1::remove_gtpv1_connection([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) XXXXXXXXXX.XXXXXX | HookCallFunction PacketAnalyzer::TEREDO::remove_teredo_connection([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) +XXXXXXXXXX.XXXXXX | HookCallFunction Site::is_local_addr(141.142.228.5) +XXXXXXXXXX.XXXXXX | HookCallFunction Site::is_local_addr(192.150.187.43) XXXXXXXXXX.XXXXXX | HookCallFunction Telemetry::sync() XXXXXXXXXX.XXXXXX | HookCallFunction cat(...) XXXXXXXXXX.XXXXXX | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) @@ -5301,7 +5310,7 @@ XXXXXXXXXX.XXXXXX | HookCallFunction to_lower(HTTP) XXXXXXXXXX.XXXXXX | HookCallFunction zeek_done() XXXXXXXXXX.XXXXXX | HookDrainEvents XXXXXXXXXX.XXXXXX | HookLogInit conn 1/1 {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])} -XXXXXXXXXX.XXXXXX | HookLogWrite conn [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=] +XXXXXXXXXX.XXXXXX | HookLogWrite conn [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=F, local_resp=F, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=] XXXXXXXXXX.XXXXXX | HookQueueEvent Broker::log_flush() XXXXXXXXXX.XXXXXX | HookQueueEvent ChecksumOffloading::check() XXXXXXXXXX.XXXXXX | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, service_violation={}, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mqtt=, mqtt_state=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) diff --git a/testing/btest/Baseline/plugins.packet-protocol/output_raw b/testing/btest/Baseline/plugins.packet-protocol/output_raw index f53ed99fa6..cea9ba5d9c 100644 --- a/testing/btest/Baseline/plugins.packet-protocol/output_raw +++ b/testing/btest/Baseline/plugins.packet-protocol/output_raw @@ -8,6 +8,6 @@ raw_layer_message (Message = 'I am encapsulating IP', Protocol = 4950) #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.22.214.60 8 192.0.78.150 0 icmp - - - - OTH - - 0 - 1 28 0 0 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH - - 0 - 1 28 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 172.22.214.60 8 192.0.78.150 0 icmp - - - - OTH T F 0 - 1 28 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.22.214.60 8 192.0.78.212 0 icmp - - - - OTH T F 0 - 1 28 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/plugins.pktsrc/conn.log b/testing/btest/Baseline/plugins.pktsrc/conn.log index 871d40cd52..5bb8c7875e 100644 --- a/testing/btest/Baseline/plugins.pktsrc/conn.log +++ b/testing/btest/Baseline/plugins.pktsrc/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.2.0.2 2527 1.2.0.3 6649 tcp - - - - S0 - - 0 S 1 64 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 1.2.0.2 2527 1.2.0.3 6649 tcp - - - - S0 F F 0 S 1 64 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/plugins.writer/output b/testing/btest/Baseline/plugins.writer/output index 1642095d4d..9786472442 100644 --- a/testing/btest/Baseline/plugins.writer/output +++ b/testing/btest/Baseline/plugins.writer/output @@ -11,14 +11,14 @@ Demo::Foo - A Foo test logging writer (dynamic, version 1.0.0) [analyzer] XXXXXXXXXX.XXXXXX|violation|protocol|DCE_RPC|ClEkJM2Vm5giqnMf4h|-|10.0.0.55|53994|60.190.189.214|8124|Binpac exception: binpac exception: &enforce violation : DCE_RPC_Header:rpc_vers|- [analyzer] XXXXXXXXXX.XXXXXX|violation|protocol|DCE_RPC|ClEkJM2Vm5giqnMf4h|-|10.0.0.55|53994|60.190.189.214|8124|Binpac exception: binpac exception: &enforce violation : DCE_RPC_Header:rpc_vers|- [analyzer] XXXXXXXXXX.XXXXXX|violation|protocol|DCE_RPC|ClEkJM2Vm5giqnMf4h|-|10.0.0.55|53994|60.190.189.214|8124|Binpac exception: binpac exception: &enforce violation : DCE_RPC_Header:rpc_vers|- -[conn] XXXXXXXXXX.XXXXXX|CHhAvVGS1DHFjwGM9|10.0.0.55|53994|60.190.189.214|8124|tcp|-|4.314406|0|0|S0|-|-|0|S|5|320|0|0|- -[conn] XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|tcp|http,socks|13.839419|3860|2934|SF|-|-|0|ShADadfF|23|5080|20|3986|- -[conn] XXXXXXXXXX.XXXXXX|C4J4Th3PJpwUYZZ6gc|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|-|-|0|F|1|52|0|0|- -[conn] XXXXXXXXXX.XXXXXX|CtPZjS20MLrsMUOJi2|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|-|-|0|F|1|52|0|0|- -[conn] XXXXXXXXXX.XXXXXX|CUM0KZ3MLUfNB0cl11|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|-|-|0|F|1|52|0|0|- -[conn] XXXXXXXXXX.XXXXXX|CmES5u32sYpV7JYN|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|-|-|0|F|1|52|0|0|- -[conn] XXXXXXXXXX.XXXXXX|CP5puj4I8PtEU4qzYg|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|-|-|0|F|1|52|0|0|- -[files] XXXXXXXXXX.XXXXXX|F44J9mUl78AQMlNe3|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|HTTP|0||image/gif|-|0.000034|-|F|1368|1368|0|0|F|-|-|-|-|-|-|- +[conn] XXXXXXXXXX.XXXXXX|CHhAvVGS1DHFjwGM9|10.0.0.55|53994|60.190.189.214|8124|tcp|-|4.314406|0|0|S0|T|F|0|S|5|320|0|0|- +[conn] XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|tcp|http,socks|13.839419|3860|2934|SF|T|F|0|ShADadfF|23|5080|20|3986|- +[conn] XXXXXXXXXX.XXXXXX|C4J4Th3PJpwUYZZ6gc|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|T|F|0|F|1|52|0|0|- +[conn] XXXXXXXXXX.XXXXXX|CtPZjS20MLrsMUOJi2|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|T|F|0|F|1|52|0|0|- +[conn] XXXXXXXXXX.XXXXXX|CUM0KZ3MLUfNB0cl11|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|T|F|0|F|1|52|0|0|- +[conn] XXXXXXXXXX.XXXXXX|CmES5u32sYpV7JYN|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|T|F|0|F|1|52|0|0|- +[conn] XXXXXXXXXX.XXXXXX|CP5puj4I8PtEU4qzYg|10.0.0.55|53994|60.190.189.214|8124|tcp|-|-|-|-|SH|T|F|0|F|1|52|0|0|- +[files] XXXXXXXXXX.XXXXXX|F44J9mUl78AQMlNe3|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|HTTP|0||image/gif|-|0.000034|F|F|1368|1368|0|0|F|-|-|-|-|-|-|- [http] XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|1|GET|www.osnews.com|/images/printer2.gif|http://www.osnews.com/|1.1|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|-|0|0|304|Not Modified|-|-||-|-|-|-|-|-|-|-|- [http] XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|2|GET|www.osnews.com|/img2/shorturl.jpg|http://www.osnews.com/|1.1|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|-|0|0|304|Not Modified|-|-||-|-|-|-|-|-|-|-|- [http] XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|10.0.0.55|53994|60.190.189.214|8124|3|GET|www.osnews.com|/images/icons/9.gif|http://www.osnews.com/|1.1|Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2|-|0|0|304|Not Modified|-|-||-|-|-|-|-|-|-|-|- diff --git a/testing/btest/Baseline/scripts.base.files.extract.limit/files.log b/testing/btest/Baseline/scripts.base.files.extract.limit/files.log index 1800c4b51b..3d7a06af51 100644 --- a/testing/btest/Baseline/scripts.base.files.extract.limit/files.log +++ b/testing/btest/Baseline/scripts.base.files.extract.limit/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid extracted extracted_cutoff extracted_size md5 sha1 sha256 #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string bool count string string string -XXXXXXXXXX.XXXXXX FCceqBvpMfirSN0Ri ClEkJM2Vm5giqnMf4h 141.142.228.5 50737 141.142.192.162 38141 FTP_DATA 0 EXTRACT text/plain - 0.001059 - F 16557 - 0 0 F - 2 T 6000 - - - +XXXXXXXXXX.XXXXXX FCceqBvpMfirSN0Ri ClEkJM2Vm5giqnMf4h 141.142.228.5 50737 141.142.192.162 38141 FTP_DATA 0 EXTRACT text/plain - 0.001059 F F 16557 - 0 0 F - 2 T 6000 - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.files.x509.files/files.log b/testing/btest/Baseline/scripts.base.files.x509.files/files.log index 3e198b81a9..e64dfc52c0 100644 --- a/testing/btest/Baseline/scripts.base.files.x509.files/files.log +++ b/testing/btest/Baseline/scripts.base.files.x509.files/files.log @@ -7,10 +7,10 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string -XXXXXXXXXX.XXXXXX FgN3AE3of2TRIqaeQe CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-user-cert - 0.000000 - F 1859 - 0 0 F - 7af07aca6d5c6e8e87fe4bb34786edc0 548b9e03bc183d1cd39f93a37985cb3950f8f06f 6bacfa4536150ed996f2b0c05ab6e345a257225f449aeb9d2018ccd88f4ede43 -XXXXXXXXXX.XXXXXX Fv2Agc4z5boBOacQi6 CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 - F 1032 - 0 0 F - 9e4ac96474245129d9766700412a1f89 d83c1a7f4d0446bb2081b81a1670f8183451ca24 a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d -XXXXXXXXXX.XXXXXX Ftmyeg2qgI2V38Dt3g CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 - F 897 - 0 0 F - 2e7db2a31d0e3da4b25f49b9542a2e1a 7359755c6df9a0abc3060bce369564c8ec4542a3 3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 -XXXXXXXXXX.XXXXXX FUFNf84cduA0IJCp07 ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-user-cert - 0.000000 - F 1859 - 0 0 F - 7af07aca6d5c6e8e87fe4bb34786edc0 548b9e03bc183d1cd39f93a37985cb3950f8f06f 6bacfa4536150ed996f2b0c05ab6e345a257225f449aeb9d2018ccd88f4ede43 -XXXXXXXXXX.XXXXXX F1H4bd2OKGbLPEdHm4 ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 - F 1032 - 0 0 F - 9e4ac96474245129d9766700412a1f89 d83c1a7f4d0446bb2081b81a1670f8183451ca24 a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d -XXXXXXXXXX.XXXXXX Fgsbci2jxFXYMOHOhi ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 - F 897 - 0 0 F - 2e7db2a31d0e3da4b25f49b9542a2e1a 7359755c6df9a0abc3060bce369564c8ec4542a3 3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 +XXXXXXXXXX.XXXXXX FgN3AE3of2TRIqaeQe CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-user-cert - 0.000000 F F 1859 - 0 0 F - 7af07aca6d5c6e8e87fe4bb34786edc0 548b9e03bc183d1cd39f93a37985cb3950f8f06f 6bacfa4536150ed996f2b0c05ab6e345a257225f449aeb9d2018ccd88f4ede43 +XXXXXXXXXX.XXXXXX Fv2Agc4z5boBOacQi6 CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 F F 1032 - 0 0 F - 9e4ac96474245129d9766700412a1f89 d83c1a7f4d0446bb2081b81a1670f8183451ca24 a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d +XXXXXXXXXX.XXXXXX Ftmyeg2qgI2V38Dt3g CHhAvVGS1DHFjwGM9 192.168.4.149 60623 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 F F 897 - 0 0 F - 2e7db2a31d0e3da4b25f49b9542a2e1a 7359755c6df9a0abc3060bce369564c8ec4542a3 3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 +XXXXXXXXXX.XXXXXX FUFNf84cduA0IJCp07 ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-user-cert - 0.000000 F F 1859 - 0 0 F - 7af07aca6d5c6e8e87fe4bb34786edc0 548b9e03bc183d1cd39f93a37985cb3950f8f06f 6bacfa4536150ed996f2b0c05ab6e345a257225f449aeb9d2018ccd88f4ede43 +XXXXXXXXXX.XXXXXX F1H4bd2OKGbLPEdHm4 ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 F F 1032 - 0 0 F - 9e4ac96474245129d9766700412a1f89 d83c1a7f4d0446bb2081b81a1670f8183451ca24 a047a37fa2d2e118a4f5095fe074d6cfe0e352425a7632bf8659c03919a6c81d +XXXXXXXXXX.XXXXXX Fgsbci2jxFXYMOHOhi ClEkJM2Vm5giqnMf4h 192.168.4.149 60624 74.125.239.129 443 SSL 0 SHA256,X509,SHA1,MD5 application/x-x509-ca-cert - 0.000000 F F 897 - 0 0 F - 2e7db2a31d0e3da4b25f49b9542a2e1a 7359755c6df9a0abc3060bce369564c8ec4542a3 3c35cc963eb004451323d3275d05b353235053490d9cd83729a2faf5e7ca1cc0 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-analyzer/conn.log b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-analyzer/conn.log index 6c830bb082..06c57f27d7 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-analyzer/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.analyzer.request-analyzer/conn.log @@ -7,28 +7,28 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd - - - - - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA - - - - - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 - - 0 ShADad - - - - - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH - - 0 ^h - - - - - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd - - - - - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA - - - - - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 F F 0 ShADad - - - - - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH F F 0 ^h - - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.register_mime_type/files.log b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.register_mime_type/files.log index 1471c3eed6..3a9a353b25 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.register_mime_type/files.log +++ b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.register_mime_type/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 MD5 text/plain - 0.000263 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac - - - - - +XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 MD5 text/plain - 0.000263 F F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac - - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.big-bof-buffer/files.log b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.big-bof-buffer/files.log index f1bb3472a0..5f5f501f18 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.big-bof-buffer/files.log +++ b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.big-bof-buffer/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 SHA1,MD5 text/plain - 0.000263 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 - - - - +XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 SHA1,MD5 text/plain - 0.000263 F F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.byteranges/files.log b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.byteranges/files.log index 95536a533e..ccef446383 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.byteranges/files.log +++ b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.byteranges/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FZkGcy26oUimsCoAH1 CHhAvVGS1DHFjwGM9 192.168.1.105 49219 198.189.255.75 80 HTTP 0 EXTRACT - - 0.046240 - F 54229 605292323 4244449 0 T - - - - extract-XXXXXXXXXX.XXXXXX-HTTP-FZkGcy26oUimsCoAH1 T 4000 +XXXXXXXXXX.XXXXXX FZkGcy26oUimsCoAH1 CHhAvVGS1DHFjwGM9 192.168.1.105 49219 198.189.255.75 80 HTTP 0 EXTRACT - - 0.046240 F F 54229 605292323 4244449 0 T - - - - extract-XXXXXXXXXX.XXXXXX-HTTP-FZkGcy26oUimsCoAH1 T 4000 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log index 9c6770e801..f3ab081b18 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log +++ b/testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 SHA256,EXTRACT,SHA1,MD5,DATA_EVENT text/plain - 0.000263 - F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18 FMnxxt3xjVcWNS2141-file F - +XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 SHA256,EXTRACT,SHA1,MD5,DATA_EVENT text/plain - 0.000263 F F 4705 4705 0 0 F - 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18 FMnxxt3xjVcWNS2141-file F - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-complex/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-complex/conn.log index ae908d8255..7f63d5e915 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-complex/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-complex/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields _write_ts _stream _innerLogged.a _innerLogged.c _innerLogged.d _system_name ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string count count set[count] string time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn 1 3 4,2,3,1 - XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-include-exclude/conn-exc.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-include-exclude/conn-exc.log index c6b0ab1cf7..6667c243f4 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-include-exclude/conn-exc.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-include-exclude/conn-exc.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields _write_ts _stream _system_name ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string string time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn-exc zeek XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-invalid/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-invalid/conn.log index b068669c9c..34b9488eb8 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-invalid/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-invalid/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields _write_ts _stream _system_name ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string string time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -- - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 tcp - 0.211484 136 5007 SF - - 0 ShADadFf 7 512 7 5379 - +- - - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 tcp - 0.211484 136 5007 SF F F 0 ShADadFf 7 512 7 5379 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-optional/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-optional/conn.log index 52a249c7eb..4f95af9642 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-optional/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension-optional/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields _write_ts _system_name _undefined_string ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string string time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX zeek - XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension/conn.log index c7e02fbe2f..3909d9cb52 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-extension/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields _write_ts _stream _system_name ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string string time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX conn zeek XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map/conn.log index 53037976a6..31b368c2c9 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid src src_port dst dst_port proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map2/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map2/conn.log index c1914a7908..0a7e28aa9d 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map2/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.field-name-map2/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid src_ip src_port dst_ip dst_port proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.2 49159 192.168.1.1 20000 tcp - 0.463113 120 0 S0 - - 0 SAD 5 332 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.2 49159 192.168.1.1 20000 tcp - 0.463113 120 0 S0 T T 0 SAD 5 332 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep/conn.log index 67caf1fbfc..5f2cd16e77 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id_orig_h id_orig_p id_resp_h id_resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep_and_field_name_map/conn.log b/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep_and_field_name_map/conn.log index 53037976a6..31b368c2c9 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep_and_field_name_map/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.scope_sep_and_field_name_map/conn.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid src src_port dst dst_port proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.wikipedia/conn.select b/testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.wikipedia/conn.select index e11c400b04..08082a678f 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.wikipedia/conn.select +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.sqlite.wikipedia/conn.select @@ -1,35 +1,35 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -XXXXXXXXXX.XXXXXX|CHhAvVGS1DHFjwGM9|141.142.220.202|5353|224.0.0.251|5353|udp|dns||||S0|||0|D|1|73|0|0| -XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|fe80::217:f2ff:fed7:cf65|5353|ff02::fb|5353|udp|dns||||S0|||0|D|1|199|0|0| -XXXXXXXXXX.XXXXXX|C4J4Th3PJpwUYZZ6gc|141.142.220.50|5353|224.0.0.251|5353|udp|dns||||S0|||0|D|1|179|0|0| -XXXXXXXXXX.XXXXXX|CtPZjS20MLrsMUOJi2|141.142.220.118|35634|208.80.152.2|80|tcp||0.0613288879394531|463|350|OTH|||0|DdA|2|567|1|402| -XXXXXXXXXX.XXXXXX|CUM0KZ3MLUfNB0cl11|141.142.220.118|48649|208.80.152.118|80|tcp|http|0.1199049949646|525|232|S1|||0|ShADad|4|741|3|396| -XXXXXXXXXX.XXXXXX|CmES5u32sYpV7JYN|141.142.220.118|43927|141.142.2.2|53|udp|dns|0.000435113906860352|38|89|SF|||0|Dd|1|66|1|117| -XXXXXXXXXX.XXXXXX|CP5puj4I8PtEU4qzYg|141.142.220.118|37676|141.142.2.2|53|udp|dns|0.000420093536376953|52|99|SF|||0|Dd|1|80|1|127| -XXXXXXXXXX.XXXXXX|C37jN32gN3y3AZzyf6|141.142.220.118|40526|141.142.2.2|53|udp|dns|0.000391960144042969|38|183|SF|||0|Dd|1|66|1|211| -XXXXXXXXXX.XXXXXX|C3eiCBGOLw3VtHfOj|141.142.220.118|49996|208.80.152.3|80|tcp|http|0.218501091003418|1171|733|S1|||0|ShADad|6|1491|4|949| -XXXXXXXXXX.XXXXXX|CwjjYJ2WqgTbAqiHl6|141.142.220.118|49997|208.80.152.3|80|tcp|http|0.219720125198364|1125|734|S1|||0|ShADad|6|1445|4|950| -XXXXXXXXXX.XXXXXX|C0LAHyvtKSQHyJxIl|141.142.220.118|32902|141.142.2.2|53|udp|dns|0.000317096710205078|38|89|SF|||0|Dd|1|66|1|117| -XXXXXXXXXX.XXXXXX|CFLRIC3zaTU1loLGxh|141.142.220.118|59816|141.142.2.2|53|udp|dns|0.000343084335327148|52|99|SF|||0|Dd|1|80|1|127| -XXXXXXXXXX.XXXXXX|C9rXSW3KSpTYvPrlI1|141.142.220.118|59714|141.142.2.2|53|udp|dns|0.000375032424926758|38|183|SF|||0|Dd|1|66|1|211| -XXXXXXXXXX.XXXXXX|Ck51lg1bScffFj34Ri|141.142.220.118|49998|208.80.152.3|80|tcp|http|0.215893030166626|1130|734|S1|||0|ShADad|6|1450|4|950| -XXXXXXXXXX.XXXXXX|C9mvWx3ezztgzcexV7|141.142.220.118|58206|141.142.2.2|53|udp|dns|0.000339031219482422|38|89|SF|||0|Dd|1|66|1|117| -XXXXXXXXXX.XXXXXX|CNnMIj2QSd84NKf7U3|141.142.220.118|38911|141.142.2.2|53|udp|dns|0.000334978103637695|52|99|SF|||0|Dd|1|80|1|127| -XXXXXXXXXX.XXXXXX|C7fIlMZDuRiqjpYbb|141.142.220.118|59746|141.142.2.2|53|udp|dns|0.000420808792114258|38|183|SF|||0|Dd|1|66|1|211| -XXXXXXXXXX.XXXXXX|CykQaM33ztNt0csB9a|141.142.220.118|49999|208.80.152.3|80|tcp|http|0.220960855484009|1137|733|S1|||0|ShADad|6|1457|4|949| -XXXXXXXXXX.XXXXXX|CtxTCR2Yer0FR1tIBg|141.142.220.118|50000|208.80.152.3|80|tcp|http|0.229603052139282|1148|734|S1|||0|ShADad|6|1468|4|950| -XXXXXXXXXX.XXXXXX|CpmdRlaUoJLN3uIRa|141.142.220.118|45000|141.142.2.2|53|udp|dns|0.000384092330932617|38|89|SF|||0|Dd|1|66|1|117| -XXXXXXXXXX.XXXXXX|C1Xkzz2MaGtLrc1Tla|141.142.220.118|48479|141.142.2.2|53|udp|dns|0.000316858291625977|52|99|SF|||0|Dd|1|80|1|127| -XXXXXXXXXX.XXXXXX|CqlVyW1YwZ15RhTBc4|141.142.220.118|48128|141.142.2.2|53|udp|dns|0.000422954559326172|38|183|SF|||0|Dd|1|66|1|211| -XXXXXXXXXX.XXXXXX|CLNN1k2QMum1aexUK7|141.142.220.118|50001|208.80.152.3|80|tcp|http|0.227283954620361|1178|734|S1|||0|ShADad|6|1498|4|950| -XXXXXXXXXX.XXXXXX|CBA8792iHmnhPLksKa|141.142.220.118|56056|141.142.2.2|53|udp|dns|0.000402212142944336|36|131|SF|||0|Dd|1|64|1|159| -XXXXXXXXXX.XXXXXX|CGLPPc35OzDQij1XX8|141.142.220.118|55092|141.142.2.2|53|udp|dns|0.000374078750610352|36|198|SF|||0|Dd|1|64|1|226| -XXXXXXXXXX.XXXXXX|CiyBAq1bBLNaTiTAc|141.142.220.118|35642|208.80.152.2|80|tcp|http|0.120040893554688|534|412|S1|||0|ShADad|4|750|3|576| -XXXXXXXXXX.XXXXXX|CFSwNi4CNGxcuffo49|141.142.220.235|6705|173.192.163.128|80|tcp|||||OTH|||0|^h|0|0|1|48| -XXXXXXXXXX.XXXXXX|Cipfzj1BEnhejw8cGf|141.142.220.44|5353|224.0.0.251|5353|udp|dns||||S0|||0|D|1|85|0|0| -XXXXXXXXXX.XXXXXX|CV5WJ42jPYbNW9JNWf|141.142.220.226|137|141.142.220.255|137|udp|dns|2.61301684379578|350|0|S0|||0|D|7|546|0|0| -XXXXXXXXXX.XXXXXX|CPhDKt12KQPUVbQz06|fe80::3074:17d5:2052:c324|65373|ff02::1:3|5355|udp|dns|0.100096225738525|66|0|S0|||0|D|2|162|0|0| -XXXXXXXXXX.XXXXXX|CAnFrb2Cvxr5T7quOc|141.142.220.226|55131|224.0.0.252|5355|udp|dns|0.100020885467529|66|0|S0|||0|D|2|122|0|0| -XXXXXXXXXX.XXXXXX|C8rquZ3DjgNW06JGLl|fe80::3074:17d5:2052:c324|54213|ff02::1:3|5355|udp|dns|0.0998010635375977|66|0|S0|||0|D|2|162|0|0| -XXXXXXXXXX.XXXXXX|CzrZOtXqhwwndQva3|141.142.220.226|55671|224.0.0.252|5355|udp|dns|0.0998489856719971|66|0|S0|||0|D|2|122|0|0| -XXXXXXXXXX.XXXXXX|CaGCc13FffXe6RkQl9|141.142.220.238|56641|141.142.220.255|137|udp|dns||||S0|||0|D|1|78|0|0| +XXXXXXXXXX.XXXXXX|CHhAvVGS1DHFjwGM9|141.142.220.202|5353|224.0.0.251|5353|udp|dns||||S0|0|0|0|D|1|73|0|0| +XXXXXXXXXX.XXXXXX|ClEkJM2Vm5giqnMf4h|fe80::217:f2ff:fed7:cf65|5353|ff02::fb|5353|udp|dns||||S0|1|0|0|D|1|199|0|0| +XXXXXXXXXX.XXXXXX|C4J4Th3PJpwUYZZ6gc|141.142.220.50|5353|224.0.0.251|5353|udp|dns||||S0|0|0|0|D|1|179|0|0| +XXXXXXXXXX.XXXXXX|CtPZjS20MLrsMUOJi2|141.142.220.118|35634|208.80.152.2|80|tcp||0.0613288879394531|463|350|OTH|0|0|0|DdA|2|567|1|402| +XXXXXXXXXX.XXXXXX|CUM0KZ3MLUfNB0cl11|141.142.220.118|48649|208.80.152.118|80|tcp|http|0.1199049949646|525|232|S1|0|0|0|ShADad|4|741|3|396| +XXXXXXXXXX.XXXXXX|CmES5u32sYpV7JYN|141.142.220.118|43927|141.142.2.2|53|udp|dns|0.000435113906860352|38|89|SF|0|0|0|Dd|1|66|1|117| +XXXXXXXXXX.XXXXXX|CP5puj4I8PtEU4qzYg|141.142.220.118|37676|141.142.2.2|53|udp|dns|0.000420093536376953|52|99|SF|0|0|0|Dd|1|80|1|127| +XXXXXXXXXX.XXXXXX|C37jN32gN3y3AZzyf6|141.142.220.118|40526|141.142.2.2|53|udp|dns|0.000391960144042969|38|183|SF|0|0|0|Dd|1|66|1|211| +XXXXXXXXXX.XXXXXX|C3eiCBGOLw3VtHfOj|141.142.220.118|49996|208.80.152.3|80|tcp|http|0.218501091003418|1171|733|S1|0|0|0|ShADad|6|1491|4|949| +XXXXXXXXXX.XXXXXX|CwjjYJ2WqgTbAqiHl6|141.142.220.118|49997|208.80.152.3|80|tcp|http|0.219720125198364|1125|734|S1|0|0|0|ShADad|6|1445|4|950| +XXXXXXXXXX.XXXXXX|C0LAHyvtKSQHyJxIl|141.142.220.118|32902|141.142.2.2|53|udp|dns|0.000317096710205078|38|89|SF|0|0|0|Dd|1|66|1|117| +XXXXXXXXXX.XXXXXX|CFLRIC3zaTU1loLGxh|141.142.220.118|59816|141.142.2.2|53|udp|dns|0.000343084335327148|52|99|SF|0|0|0|Dd|1|80|1|127| +XXXXXXXXXX.XXXXXX|C9rXSW3KSpTYvPrlI1|141.142.220.118|59714|141.142.2.2|53|udp|dns|0.000375032424926758|38|183|SF|0|0|0|Dd|1|66|1|211| +XXXXXXXXXX.XXXXXX|Ck51lg1bScffFj34Ri|141.142.220.118|49998|208.80.152.3|80|tcp|http|0.215893030166626|1130|734|S1|0|0|0|ShADad|6|1450|4|950| +XXXXXXXXXX.XXXXXX|C9mvWx3ezztgzcexV7|141.142.220.118|58206|141.142.2.2|53|udp|dns|0.000339031219482422|38|89|SF|0|0|0|Dd|1|66|1|117| +XXXXXXXXXX.XXXXXX|CNnMIj2QSd84NKf7U3|141.142.220.118|38911|141.142.2.2|53|udp|dns|0.000334978103637695|52|99|SF|0|0|0|Dd|1|80|1|127| +XXXXXXXXXX.XXXXXX|C7fIlMZDuRiqjpYbb|141.142.220.118|59746|141.142.2.2|53|udp|dns|0.000420808792114258|38|183|SF|0|0|0|Dd|1|66|1|211| +XXXXXXXXXX.XXXXXX|CykQaM33ztNt0csB9a|141.142.220.118|49999|208.80.152.3|80|tcp|http|0.220960855484009|1137|733|S1|0|0|0|ShADad|6|1457|4|949| +XXXXXXXXXX.XXXXXX|CtxTCR2Yer0FR1tIBg|141.142.220.118|50000|208.80.152.3|80|tcp|http|0.229603052139282|1148|734|S1|0|0|0|ShADad|6|1468|4|950| +XXXXXXXXXX.XXXXXX|CpmdRlaUoJLN3uIRa|141.142.220.118|45000|141.142.2.2|53|udp|dns|0.000384092330932617|38|89|SF|0|0|0|Dd|1|66|1|117| +XXXXXXXXXX.XXXXXX|C1Xkzz2MaGtLrc1Tla|141.142.220.118|48479|141.142.2.2|53|udp|dns|0.000316858291625977|52|99|SF|0|0|0|Dd|1|80|1|127| +XXXXXXXXXX.XXXXXX|CqlVyW1YwZ15RhTBc4|141.142.220.118|48128|141.142.2.2|53|udp|dns|0.000422954559326172|38|183|SF|0|0|0|Dd|1|66|1|211| +XXXXXXXXXX.XXXXXX|CLNN1k2QMum1aexUK7|141.142.220.118|50001|208.80.152.3|80|tcp|http|0.227283954620361|1178|734|S1|0|0|0|ShADad|6|1498|4|950| +XXXXXXXXXX.XXXXXX|CBA8792iHmnhPLksKa|141.142.220.118|56056|141.142.2.2|53|udp|dns|0.000402212142944336|36|131|SF|0|0|0|Dd|1|64|1|159| +XXXXXXXXXX.XXXXXX|CGLPPc35OzDQij1XX8|141.142.220.118|55092|141.142.2.2|53|udp|dns|0.000374078750610352|36|198|SF|0|0|0|Dd|1|64|1|226| +XXXXXXXXXX.XXXXXX|CiyBAq1bBLNaTiTAc|141.142.220.118|35642|208.80.152.2|80|tcp|http|0.120040893554688|534|412|S1|0|0|0|ShADad|4|750|3|576| +XXXXXXXXXX.XXXXXX|CFSwNi4CNGxcuffo49|141.142.220.235|6705|173.192.163.128|80|tcp|||||OTH|0|0|0|^h|0|0|1|48| +XXXXXXXXXX.XXXXXX|Cipfzj1BEnhejw8cGf|141.142.220.44|5353|224.0.0.251|5353|udp|dns||||S0|0|0|0|D|1|85|0|0| +XXXXXXXXXX.XXXXXX|CV5WJ42jPYbNW9JNWf|141.142.220.226|137|141.142.220.255|137|udp|dns|2.61301684379578|350|0|S0|0|0|0|D|7|546|0|0| +XXXXXXXXXX.XXXXXX|CPhDKt12KQPUVbQz06|fe80::3074:17d5:2052:c324|65373|ff02::1:3|5355|udp|dns|0.100096225738525|66|0|S0|1|0|0|D|2|162|0|0| +XXXXXXXXXX.XXXXXX|CAnFrb2Cvxr5T7quOc|141.142.220.226|55131|224.0.0.252|5355|udp|dns|0.100020885467529|66|0|S0|0|0|0|D|2|122|0|0| +XXXXXXXXXX.XXXXXX|C8rquZ3DjgNW06JGLl|fe80::3074:17d5:2052:c324|54213|ff02::1:3|5355|udp|dns|0.0998010635375977|66|0|S0|1|0|0|D|2|162|0|0| +XXXXXXXXXX.XXXXXX|CzrZOtXqhwwndQva3|141.142.220.226|55671|224.0.0.252|5355|udp|dns|0.0998489856719971|66|0|S0|0|0|0|D|2|122|0|0| +XXXXXXXXXX.XXXXXX|CaGCc13FffXe6RkQl9|141.142.220.238|56641|141.142.220.255|137|udp|dns||||S0|0|0|0|D|1|78|0|0| diff --git a/testing/btest/Baseline/scripts.base.frameworks.netcontrol.packetfilter/conn.log b/testing/btest/Baseline/scripts.base.frameworks.netcontrol.packetfilter/conn.log index 05ba461140..745260eeed 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.netcontrol.packetfilter/conn.log +++ b/testing/btest/Baseline/scripts.base.frameworks.netcontrol.packetfilter/conn.log @@ -7,9 +7,9 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.10.1.4 56166 10.10.1.1 53 udp dns 0.034025 34 100 SF - - 0 Dd 1 62 1 128 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.10.1.20 138 10.10.1.255 138 udp - - - - S0 - - 0 D 1 229 0 0 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.10.1.4 1470 74.53.140.153 25 tcp - 0.346950 0 0 S1 - - 0 Sh 1 48 1 48 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.133.100 49285 66.196.121.26 5050 tcp - 0.343008 41 0 OTH - - 0 Da 1 93 1 52 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.133.100 49648 192.168.133.102 25 tcp - 0.004707 0 0 S1 - - 0 Sh 1 64 1 60 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.10.1.4 56166 10.10.1.1 53 udp dns 0.034025 34 100 SF T T 0 Dd 1 62 1 128 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.10.1.20 138 10.10.1.255 138 udp - - - - S0 T T 0 D 1 229 0 0 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.10.1.4 1470 74.53.140.153 25 tcp - 0.346950 0 0 S1 T F 0 Sh 1 48 1 48 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.133.100 49285 66.196.121.26 5050 tcp - 0.343008 41 0 OTH T F 0 Da 1 93 1 52 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.133.100 49648 192.168.133.102 25 tcp - 0.004707 0 0 S1 T T 0 Sh 1 64 1 60 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.frameworks.notice.file-info-multiple-conns/files.log b/testing/btest/Baseline/scripts.base.frameworks.notice.file-info-multiple-conns/files.log index 3bdaebbc48..498603137e 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.notice.file-info-multiple-conns/files.log +++ b/testing/btest/Baseline/scripts.base.frameworks.notice.file-info-multiple-conns/files.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string -XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 CHhAvVGS1DHFjwGM9 127.0.0.1 48768 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 - F 34 34 0 0 F - -XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 ClEkJM2Vm5giqnMf4h 127.0.0.1 48770 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 - F 34 34 0 0 F - -XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 C4J4Th3PJpwUYZZ6gc 127.0.0.1 48776 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 - F 34 34 0 0 F - +XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 CHhAvVGS1DHFjwGM9 127.0.0.1 48768 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 T F 34 34 0 0 F - +XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 ClEkJM2Vm5giqnMf4h 127.0.0.1 48770 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 T F 34 34 0 0 F - +XXXXXXXXXX.XXXXXX FDXrtA2UOyNDs2wzk8 C4J4Th3PJpwUYZZ6gc 127.0.0.1 48776 127.0.0.1 8080 HTTP 0 SHA1 text/plain - 0.002150 T F 34 34 0 0 F - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/conn.log index ed0f85e5d2..d8ba78b4a4 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.cwd-navigation/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.3.22.91 58218 10.167.25.101 21 tcp ftp 600.931043 41420 159830 S1 - - 233 ShAdDaGg 4139 206914 4178 326799 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.3.22.91 58218 10.167.25.101 21 tcp ftp 600.931043 41420 159830 S1 T T 233 ShAdDaGg 4139 206914 4178 326799 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-invalid-reply-code/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-invalid-reply-code/conn.log index dd5edb3ab7..a771ef6ad5 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-invalid-reply-code/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-invalid-reply-code/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51354 127.0.0.1 21 tcp - 9.891089 34 71 SF - - 0 ShAdDaFf 13 718 10 599 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51354 127.0.0.1 21 tcp - 9.891089 34 71 SF T T 0 ShAdDaFf 13 718 10 599 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv4/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv4/conn.log index 6db3df46ee..8f53340c7d 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv4/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv4/conn.log @@ -7,9 +7,9 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - - 0 ShAdfFa 4 216 4 562 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - - 0 ShAdfFa 4 216 4 297 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - - 0 ShADaFf 5 614 3 164 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - - 0 ShADaFf 5 349 3 164 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF - - 0 ShAdDfFa 38 2164 25 4458 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF F F 0 ShAdfFa 4 216 4 562 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF F F 0 ShAdfFa 4 216 4 297 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF F F 0 ShADaFf 5 614 3 164 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF F F 0 ShADaFf 5 349 3 164 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.235 50003 199.233.217.249 21 tcp ftp 38.055625 180 3146 SF F F 0 ShAdDfFa 38 2164 25 4458 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log index 26f318b433..f5c050d839 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-ipv6/conn.log @@ -7,10 +7,10 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF - - 0 ShAdfFa 5 372 4 642 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49187 2001:470:4867:99::21 57087 tcp ftp-data 0.217501 0 43 SF - - 0 ShAdfFa 5 372 4 343 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49188 2001:470:4867:99::21 57088 tcp ftp-data 0.217941 0 77 SF - - 0 ShAdfFa 5 372 4 377 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF - - 0 ShADFaf 5 449 4 300 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF - - 0 ShAdDfFa 57 4426 34 5908 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF - - 0 ShADFaf 5 714 4 300 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49186 2001:470:4867:99::21 57086 tcp ftp-data 0.219721 0 342 SF F F 0 ShAdfFa 5 372 4 642 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49187 2001:470:4867:99::21 57087 tcp ftp-data 0.217501 0 43 SF F F 0 ShAdfFa 5 372 4 343 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49188 2001:470:4867:99::21 57088 tcp ftp-data 0.217941 0 77 SF F F 0 ShAdfFa 5 372 4 377 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 2001:470:4867:99::21 55785 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49189 tcp ftp-data 0.109813 77 0 SF F F 0 ShADFaf 5 449 4 300 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49185 2001:470:4867:99::21 21 tcp ftp 26.658219 310 3448 SF F F 0 ShAdDfFa 57 4426 34 5908 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 2001:470:4867:99::21 55647 2001:470:1f11:81f:c999:d94:aa7c:2e3e 49190 tcp ftp-data 0.109181 342 0 SF F F 0 ShADFaf 5 714 4 300 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-command-length/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-command-length/conn.log index c7fb619584..b7b5ee66ee 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-command-length/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-command-length/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58634 127.0.0.1 21 tcp ftp 0.213412 358 313 SF - - 0 ShAdDaFf 23 1562 17 1205 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 58634 127.0.0.1 21 tcp ftp 0.213412 358 313 SF T T 0 ShAdDaFf 23 1562 17 1205 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-pending-commands/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-pending-commands/conn.log index 289866c930..a04bfebdc3 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-pending-commands/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-max-pending-commands/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 37950 127.0.0.1 21 tcp ftp 0.202144 98 261 SF - - 0 ShADadfF 21 1198 20 1309 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 37950 127.0.0.1 21 tcp ftp 0.202144 98 261 SF T T 0 ShADadfF 21 1198 20 1309 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-reply-code/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-reply-code/conn.log index f8ad05cb2d..2e9476abd0 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-reply-code/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-reply-code/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51344 127.0.0.1 21 tcp - 10.862185 34 74 SF - - 0 ShAdDaFf 13 718 10 602 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51344 127.0.0.1 21 tcp - 10.862185 34 74 SF T T 0 ShAdDaFf 13 718 10 602 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-space-after-reply-code/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-space-after-reply-code/conn.log index b3cbeecb64..52f9eea846 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-space-after-reply-code/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.ftp-missing-space-after-reply-code/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51346 127.0.0.1 21 tcp - 11.705309 34 68 SF - - 0 ShAdDaFf 13 718 10 596 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 51346 127.0.0.1 21 tcp - 11.705309 34 68 SF T T 0 ShAdDaFf 13 718 10 596 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ftp.gridftp/conn.log b/testing/btest/Baseline/scripts.base.protocols.ftp.gridftp/conn.log index 54be7e243c..40c6105af6 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ftp.gridftp/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ftp.gridftp/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.57.103 60108 192.168.57.101 2811 tcp ftp,ssl,gridftp 0.294743 4491 6659 SF - - 0 ShAdDaFf 22 5643 21 7759 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.57.103 35391 192.168.57.101 55968 tcp gridftp-data,ssl 0.010760 2109 3196 S1 - - 0 ShADad 7 2481 6 3516 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.57.103 60108 192.168.57.101 2811 tcp ftp,ssl,gridftp 0.294743 4491 6659 SF T T 0 ShAdDaFf 22 5643 21 7759 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.57.103 35391 192.168.57.101 55968 tcp gridftp-data,ssl 0.010760 2109 3196 S1 T T 0 ShADad 7 2481 6 3516 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/conn.log b/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/conn.log index 96034b9449..030d8f4edc 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/conn.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 tcp http 0.125216 117 10290 SF - - 0 ShADadFf 9 593 7 10662 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 tcp http 0.173517 111 10284 SF - - 0 ShADadtFf 11 703 10 10812 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 tcp http 0.124639 117 10290 SF - - 0 ShADadFf 11 697 9 10766 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 tcp http 0.125216 117 10290 SF T F 0 ShADadFf 9 593 7 10662 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 tcp http 0.173517 111 10284 SF T F 0 ShADadtFf 11 703 10 10812 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 tcp http 0.124639 117 10290 SF T F 0 ShADadFf 11 697 9 10766 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/files.log b/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/files.log index 2ef29b8d5c..6b5f32fd1b 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/files.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.concurrent-range-requests/files.log @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-connect-with-header/conn.log b/testing/btest/Baseline/scripts.base.protocols.http.http-connect-with-header/conn.log index 82468423a9..42be1377b7 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-connect-with-header/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-connect-with-header/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 ::1 52522 ::1 80 tcp ssl,http 0.691241 3644 55499 S1 - - 0 ShAaDd 29 5744 29 57599 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 ::1 52522 ::1 80 tcp ssl,http 0.691241 3644 55499 S1 T T 0 ShAaDd 29 5744 29 57599 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-connect/conn.log b/testing/btest/Baseline/scripts.base.protocols.http.http-connect/conn.log index 2326b14a08..c23e7cabcb 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-connect/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-connect/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 79.26.245.236 3378 254.228.86.79 8240 tcp smtp,http 6.722274 1685 223 SF - - 0 ShADadtTfF 14 2257 16 944 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 79.26.245.236 3378 254.228.86.79 8240 tcp smtp,http 6.722274 1685 223 SF F T 0 ShADadtTfF 14 2257 16 944 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/conn.log b/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/conn.log index 8d0abd4ebe..b4ee4b9085 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.6.206 49783 5.2.136.90 80 tcp http 109.987365 36349 1483945 SF - - 0 ShADadfF 406 52601 1113 1528477 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.6.206 49783 5.2.136.90 80 tcp http 109.987365 36349 1483945 SF T F 0 ShADadfF 406 52601 1113 1528477 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.imap.starttls/conn.log b/testing/btest/Baseline/scripts.base.protocols.imap.starttls/conn.log index 4d4596876a..35d0d31b52 100644 --- a/testing/btest/Baseline/scripts.base.protocols.imap.starttls/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.imap.starttls/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.53 49640 212.227.17.186 143 tcp imap,ssl 2.827002 540 5653 SF - - 0 ShAdDafFr 18 1284 14 6225 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.17.53 49640 212.227.17.186 143 tcp imap,ssl 2.827002 540 5653 SF T F 0 ShAdDafFr 18 1284 14 6225 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.irc.basic/conn.log b/testing/btest/Baseline/scripts.base.protocols.irc.basic/conn.log index f00ff5d5b9..7ef328574d 100644 --- a/testing/btest/Baseline/scripts.base.protocols.irc.basic/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.irc.basic/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.1.77 57655 209.197.168.151 1024 tcp irc-dcc-data 2.256935 124 42208 SF - - 0 ShAdDaFf 28 1592 43 44452 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 tcp irc 178.237017 453 25404 S3 - - 0 ShADdTtaf 63 3761 52 28194 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.1.77 57655 209.197.168.151 1024 tcp irc-dcc-data 2.256935 124 42208 SF T F 0 ShAdDaFf 28 1592 43 44452 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.77 57640 66.198.80.67 6667 tcp irc 178.237017 453 25404 S3 T F 0 ShADdTtaf 63 3761 52 28194 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.irc.starttls/conn.log b/testing/btest/Baseline/scripts.base.protocols.irc.starttls/conn.log index 5e9e4dec6c..2e9ddbecd6 100644 --- a/testing/btest/Baseline/scripts.base.protocols.irc.starttls/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.irc.starttls/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 203.143.168.47 55123 185.18.76.170 6667 tcp irc,ssl 4.923144 913 1903 SF - - 0 ShADadFRf 11 1469 9 2379 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 203.143.168.47 55123 185.18.76.170 6667 tcp irc,ssl 4.923144 913 1903 SF F F 0 ShADadFRf 11 1469 9 2379 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.krb.krb-service-name/conn.log b/testing/btest/Baseline/scripts.base.protocols.krb.krb-service-name/conn.log index 8f5bfdce29..bace262688 100644 --- a/testing/btest/Baseline/scripts.base.protocols.krb.krb-service-name/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.krb.krb-service-name/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.202.110 43792 192.168.229.251 88 tcp krb_tcp 0.010000 110 90 S1 - - 0 ^hADd 2 214 2 206 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.202.110 43792 192.168.229.251 88 tcp krb_tcp 0.010000 110 90 S1 T T 0 ^hADd 2 214 2 206 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.events/conn.log b/testing/btest/Baseline/scripts.base.protocols.modbus.events/conn.log index c022f8d0af..d59551d159 100644 --- a/testing/btest/Baseline/scripts.base.protocols.modbus.events/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.events/conn.log @@ -7,13 +7,13 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.57 2387 10.0.0.3 502 tcp - 0.000493 0 0 SF - - 0 FafA 2 80 2 80 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.0.0.57 2579 10.0.0.8 502 tcp modbus 23.256631 24 0 SF - - 0 ShADaFf 6 272 5 208 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.57 2578 10.0.0.3 502 tcp modbus 385.694948 112 138 S3 - - 0 ShADdf 20 920 12 626 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 10.0.0.9 3082 10.0.0.3 502 tcp modbus 177.095534 72 69 SF - - 0 ShADdFaf 16 720 9 437 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 10.0.0.57 2585 10.0.0.8 502 tcp - 76.561880 926 0 SF - - 0 ShADafF 8 1254 7 288 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 10.0.0.8 502 10.0.0.57 4446 tcp - 155.114237 128 0 SF - - 0 ShADaFf 16 776 15 608 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.66.235 2582 166.161.16.230 502 tcp - 2.905078 0 0 S0 - - 0 S 2 96 0 0 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.66.235 2582 166.161.16.230 502 tcp - 85.560847 1692 1278 S1 - - 0 ShADad 167 8380 181 8522 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 10.1.1.234 51411 10.10.5.85 502 tcp modbus 2100.811351 237936 4121200 S2 - - 0 ShADdaF 39659 2300216 20100 5166412 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.57 2387 10.0.0.3 502 tcp - 0.000493 0 0 SF T T 0 FafA 2 80 2 80 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 10.0.0.57 2579 10.0.0.8 502 tcp modbus 23.256631 24 0 SF T T 0 ShADaFf 6 272 5 208 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.57 2578 10.0.0.3 502 tcp modbus 385.694948 112 138 S3 T T 0 ShADdf 20 920 12 626 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 10.0.0.9 3082 10.0.0.3 502 tcp modbus 177.095534 72 69 SF T T 0 ShADdFaf 16 720 9 437 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 10.0.0.57 2585 10.0.0.8 502 tcp - 76.561880 926 0 SF T T 0 ShADafF 8 1254 7 288 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 10.0.0.8 502 10.0.0.57 4446 tcp - 155.114237 128 0 SF T T 0 ShADaFf 16 776 15 608 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.66.235 2582 166.161.16.230 502 tcp - 2.905078 0 0 S0 T F 0 S 2 96 0 0 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.66.235 2582 166.161.16.230 502 tcp - 85.560847 1692 1278 S1 T F 0 ShADad 167 8380 181 8522 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 10.1.1.234 51411 10.10.5.85 502 tcp modbus 2100.811351 237936 4121200 S2 T T 0 ShADdaF 39659 2300216 20100 5166412 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-12.conn.log b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-12.conn.log index 88b2432f33..fa781afa14 100644 --- a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-12.conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-12.conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 82.239.87.25 58132 79.107.90.25 3306 tcp ssl,mysql 2.043921 724 3255 SF - - 0 ShAdDaFf 14 1460 11 3835 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 82.239.87.25 58132 79.107.90.25 3306 tcp ssl,mysql 2.043921 724 3255 SF F F 0 ShAdDaFf 14 1460 11 3835 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-13.conn.log b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-13.conn.log index cbefcc3d33..0f4f938e2b 100644 --- a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-13.conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted-aws-rds/tls-13.conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 82.239.87.25 57902 79.107.90.25 3306 tcp ssl,mysql 6.756360 1076 3776 SF - - 0 ShAdDaFf 19 2072 14 4512 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 82.239.87.25 57902 79.107.90.25 3306 tcp ssl,mysql 6.756360 1076 3776 SF F F 0 ShAdDaFf 19 2072 14 4512 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/conn.log b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/conn.log index a04cc634bf..355dd54ba8 100644 --- a/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.mysql.encrypted/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 59272 127.0.0.1 3306 tcp ssl,mysql 0.021783 713 1959 SF - - 0 ShAdDaFf 10 1241 8 2383 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 59272 127.0.0.1 3306 tcp ssl,mysql 0.021783 713 1959 SF T T 0 ShAdDaFf 10 1241 8 2383 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.pop3.starttls/conn.log b/testing/btest/Baseline/scripts.base.protocols.pop3.starttls/conn.log index 52af982449..a43e4b10b3 100644 --- a/testing/btest/Baseline/scripts.base.protocols.pop3.starttls/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.pop3.starttls/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.4.149 54775 192.168.4.149 110 tcp ssl,pop3 2.489002 851 2590 SF - - 0 ShAadDfFr 16 1695 17 3462 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.4.149 54775 192.168.4.149 110 tcp ssl,pop3 2.489002 851 2590 SF T T 0 ShAadDfFr 16 1695 17 3462 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-fail/conn.log b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-fail/conn.log index 1b781cd665..b18abda0fe 100644 --- a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-fail/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-fail/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.38.1 63568 192.168.38.102 3389 udp - 6.226782 3696 0 S0 - - 0 D 3 3780 0 0 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.38.1 63568 192.168.38.102 3389 udp - 6.226782 3696 0 S0 T T 0 D 3 3780 0 0 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-success/conn.log b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-success/conn.log index 0abc27f049..b3a2f5609c 100644 --- a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-success/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp-handshake-success/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 ::1 61291 ::1 3389 udp rdpeudp 0.122551 1738 2655 SF - - 0 Dd 5 1978 5 2895 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 ::1 61291 ::1 3389 udp rdpeudp 0.122551 1738 2655 SF T T 0 Dd 5 1978 5 2895 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp2-handshake-success/conn.log b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp2-handshake-success/conn.log index 2cfa8f930c..e458a3bcb1 100644 --- a/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp2-handshake-success/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.rdp.rdpeudp2-handshake-success/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.57.5 65368 192.168.57.8 3389 udp rdpeudp 0.036087 2398 6585 SF - - 0 Dd 3 2482 7 6781 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.57.5 65368 192.168.57.8 3389 udp rdpeudp 0.036087 2398 6585 SF T T 0 Dd 3 2482 7 6781 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-fscontrol/out b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-fscontrol/out index 493f266542..c4a111f52f 100644 --- a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-fscontrol/out +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-fscontrol/out @@ -1,3 +1,4 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. [credit_charge=0, status=0, command=17, credits=2, flags=255, message_id=576460756581679103, process_id=213, tree_id=0, session_id=11555726885438752000, signature=\x01\x05\x05\x02\xa0`0^\xa000.\x06\x09*\x86] [persistent=6859950276847483450, volatile=7016448126591398502] [free_space_start_filtering=1869373806, free_space_threshold=1601467760, free_space_stop_filtering=1933860724, delete_quota_threshold=7308895133777551220, default_quota_limit=100, fs_control_flags=4278190080] diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log index 3dfffb7806..20a6d49517 100644 --- a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-read-write/files.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FVTHwlRSH2WI8fFw2 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 SMB 0 (empty) text/plain pythonfile 0.000000 - F 16 16 0 0 F - - - - - - - -XXXXXXXXXX.XXXXXX FAI5Dc4cLr5RAw3j0e CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 SMB 0 (empty) text/plain pythonfile2 0.000000 - T 7000 - 0 0 F - - - - - - - +XXXXXXXXXX.XXXXXX FVTHwlRSH2WI8fFw2 CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 SMB 0 (empty) text/plain pythonfile 0.000000 T F 16 16 0 0 F - - - - - - - +XXXXXXXXXX.XXXXXX FAI5Dc4cLr5RAw3j0e CHhAvVGS1DHFjwGM9 169.254.128.18 49155 169.254.128.15 445 SMB 0 (empty) text/plain pythonfile2 0.000000 T T 7000 - 0 0 F - - - - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2/files.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2/files.log index 2c2ba45310..93bf183246 100644 --- a/testing/btest/Baseline/scripts.base.protocols.smb.smb2/files.log +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2/files.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count -XXXXXXXXXX.XXXXXX FwL5Z01az5ZsFYcHh5 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 SMB 0 (empty) application/pdf WP_SMBPlugin.pdf 0.073970 - T 1508939 - 0 0 F - - - - - - - +XXXXXXXXXX.XXXXXX FwL5Z01az5ZsFYcHh5 CHhAvVGS1DHFjwGM9 10.0.0.11 49208 10.0.0.12 445 SMB 0 (empty) application/pdf WP_SMBPlugin.pdf 0.073970 T T 1508939 - 0 0 F - - - - - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/files.log b/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/files.log index f5a0c09caf..182e229fb3 100644 --- a/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/files.log +++ b/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/files.log @@ -7,8 +7,8 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string -XXXXXXXXXX.XXXXXX FmFp351N5nhsMmAfQg CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 3 (empty) text/plain - 0.000000 - T 77 - 0 0 F - -XXXXXXXXXX.XXXXXX Fqrb1K5DWEfgy4WU2 CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 4 (empty) text/html - 0.000061 - T 1868 - 0 0 F - -XXXXXXXXXX.XXXXXX FEFYSd1s8Onn9LynKj CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 5 (empty) text/plain NEWS.txt 1.165512 - T 10809 - 0 0 F - -XXXXXXXXXX.XXXXXX Fc5KpS3kUYqDLwWSMf CUM0KZ3MLUfNB0cl11 192.168.133.100 49648 192.168.133.102 25 SMTP 1 (empty) text/plain - 0.000000 - T 204 - 0 0 F - +XXXXXXXXXX.XXXXXX FmFp351N5nhsMmAfQg CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 3 (empty) text/plain - 0.000000 T T 77 - 0 0 F - +XXXXXXXXXX.XXXXXX Fqrb1K5DWEfgy4WU2 CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 4 (empty) text/html - 0.000061 T T 1868 - 0 0 F - +XXXXXXXXXX.XXXXXX FEFYSd1s8Onn9LynKj CHhAvVGS1DHFjwGM9 10.10.1.4 1470 74.53.140.153 25 SMTP 5 (empty) text/plain NEWS.txt 1.165512 T T 10809 - 0 0 F - +XXXXXXXXXX.XXXXXX Fc5KpS3kUYqDLwWSMf CUM0KZ3MLUfNB0cl11 192.168.133.100 49648 192.168.133.102 25 SMTP 1 (empty) text/plain - 0.000000 T T 204 - 0 0 F - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ssh.basic/conn.log b/testing/btest/Baseline/scripts.base.protocols.ssh.basic/conn.log index 32648066b7..bb796a9761 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ssh.basic/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.ssh.basic/conn.log @@ -7,29 +7,29 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 tcp ssh 6.159326 2669 2501 SF - - 0 ShAdDaFf 25 3981 20 3549 - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.18 40184 128.2.6.88 41644 tcp ssh 2.079071 3813 3633 SF - - 0 ShADadFf 22 4965 26 5017 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57189 192.168.2.158 22 tcp ssh 6.641754 5253 3489 SF - - 0 ShADadFf 38 7241 29 5005 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 57191 192.168.2.158 22 tcp ssh 3.862198 576 813 SF - - 0 ShAdDaFf 23 1784 16 1653 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 55179 192.168.2.158 2200 tcp ssh 2.557930 2757 1721 RSTR - - 0 ShADadFr 37 4693 29 3225 - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.1 56594 192.168.2.158 22 tcp ssh 8.841749 480 537 SF - - 0 ShAdDaFf 17 1376 14 1273 - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.2.1 56821 192.168.2.158 22 tcp ssh 1.106250 820 1125 SF - - 0 ShAdDaFf 26 2184 20 2173 - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.1 56837 192.168.2.158 22 tcp ssh 1.080767 692 997 SF - - 0 ShAdDaFf 25 2004 19 1993 - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.1 56845 192.168.2.158 22 tcp ssh 1.302395 660 965 SF - - 0 ShAdDaFf 26 2024 20 2013 - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.1 56875 192.168.2.158 22 tcp ssh 12.013506 588 549 SF - - 0 ShAdDaFf 19 1588 16 1389 - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 56878 192.168.2.158 22 tcp ssh 3.628964 684 825 SF - - 0 ShAdDaFf 25 1996 19 1821 - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 56940 192.168.2.158 22 tcp ssh 0.104978 500 609 SF - - 0 ShAdDaFf 14 1240 10 1137 - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.2.1 57831 192.168.2.158 22 tcp ssh 2.758790 576 813 SF - - 0 ShAdDaFf 23 1784 18 1757 - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.2.1 59246 192.168.2.158 22 tcp ssh 3.076752 3049 4165 SF - - 0 ShADadFf 32 4725 23 5369 - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41164 128.2.10.238 22 tcp ssh 8.485357 6087 3015 SF - - 0 ShADadFf 32 7759 33 4763 - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.32 33910 128.2.13.133 22 tcp ssh 1.910959 6471 6037 SF - - 0 ShADadFf 33 8195 29 7565 - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.32 41268 128.2.10.238 22 tcp ssh 2.710778 5613 2487 SF - - 0 ShADadFf 24 6869 20 3535 - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.1.31 52294 192.168.1.32 22 tcp ssh 3.658968 3729 2229 SF - - 0 ShADadFf 36 5613 24 3497 - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.1.31 57621 192.168.1.255 57621 udp - - - - S0 - - 0 D 1 72 0 0 - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.1.32 57621 192.168.1.31 57621 udp - - - - S0 - - 0 D 1 72 0 0 - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 192.168.1.31 51476 192.168.1.32 8118 tcp - 0.000539 76 0 SF - - 0 DaFfA 6 388 5 284 - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 192.168.1.31 51489 192.168.1.32 22 tcp ssh 4.926958 4029 2497 SF - - 0 ShAdDaFf 42 6249 27 3937 - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 192.168.1.32 58641 131.103.20.168 22 tcp ssh 0.587601 2885 2309 SF - - 0 ShADdaFf 16 3725 13 2993 - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 192.168.1.32 58646 131.103.20.168 22 tcp ssh 2.236727 4477 535101 SF - - 0 ShADadFf 179 13793 226 546861 - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 192.168.1.32 58649 131.103.20.168 22 tcp ssh 2.066433 4477 534861 SF - - 0 ShADadFf 183 14001 236 547141 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 tcp ssh 6.159326 2669 2501 SF T F 0 ShAdDaFf 25 3981 20 3549 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.18 40184 128.2.6.88 41644 tcp ssh 2.079071 3813 3633 SF T F 0 ShADadFf 22 4965 26 5017 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57189 192.168.2.158 22 tcp ssh 6.641754 5253 3489 SF T T 0 ShADadFf 38 7241 29 5005 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 57191 192.168.2.158 22 tcp ssh 3.862198 576 813 SF T T 0 ShAdDaFf 23 1784 16 1653 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 55179 192.168.2.158 2200 tcp ssh 2.557930 2757 1721 RSTR T T 0 ShADadFr 37 4693 29 3225 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.1 56594 192.168.2.158 22 tcp ssh 8.841749 480 537 SF T T 0 ShAdDaFf 17 1376 14 1273 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.2.1 56821 192.168.2.158 22 tcp ssh 1.106250 820 1125 SF T T 0 ShAdDaFf 26 2184 20 2173 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.1 56837 192.168.2.158 22 tcp ssh 1.080767 692 997 SF T T 0 ShAdDaFf 25 2004 19 1993 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.1 56845 192.168.2.158 22 tcp ssh 1.302395 660 965 SF T T 0 ShAdDaFf 26 2024 20 2013 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.1 56875 192.168.2.158 22 tcp ssh 12.013506 588 549 SF T T 0 ShAdDaFf 19 1588 16 1389 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 56878 192.168.2.158 22 tcp ssh 3.628964 684 825 SF T T 0 ShAdDaFf 25 1996 19 1821 - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 56940 192.168.2.158 22 tcp ssh 0.104978 500 609 SF T T 0 ShAdDaFf 14 1240 10 1137 - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.2.1 57831 192.168.2.158 22 tcp ssh 2.758790 576 813 SF T T 0 ShAdDaFf 23 1784 18 1757 - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.2.1 59246 192.168.2.158 22 tcp ssh 3.076752 3049 4165 SF T T 0 ShADadFf 32 4725 23 5369 - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41164 128.2.10.238 22 tcp ssh 8.485357 6087 3015 SF T F 0 ShADadFf 32 7759 33 4763 - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.32 33910 128.2.13.133 22 tcp ssh 1.910959 6471 6037 SF T F 0 ShADadFf 33 8195 29 7565 - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.32 41268 128.2.10.238 22 tcp ssh 2.710778 5613 2487 SF T F 0 ShADadFf 24 6869 20 3535 - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.1.31 52294 192.168.1.32 22 tcp ssh 3.658968 3729 2229 SF T T 0 ShADadFf 36 5613 24 3497 - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 192.168.1.31 57621 192.168.1.255 57621 udp - - - - S0 T T 0 D 1 72 0 0 - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 192.168.1.32 57621 192.168.1.31 57621 udp - - - - S0 T T 0 D 1 72 0 0 - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 192.168.1.31 51476 192.168.1.32 8118 tcp - 0.000539 76 0 SF T T 0 DaFfA 6 388 5 284 - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 192.168.1.31 51489 192.168.1.32 22 tcp ssh 4.926958 4029 2497 SF T T 0 ShAdDaFf 42 6249 27 3937 - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 192.168.1.32 58641 131.103.20.168 22 tcp ssh 0.587601 2885 2309 SF T F 0 ShADdaFf 16 3725 13 2993 - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 192.168.1.32 58646 131.103.20.168 22 tcp ssh 2.236727 4477 535101 SF T F 0 ShADadFf 179 13793 226 546861 - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 192.168.1.32 58649 131.103.20.168 22 tcp ssh 2.066433 4477 534861 SF T F 0 ShADadFf 183 14001 236 547141 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.ssh.basic/ssh.log b/testing/btest/Baseline/scripts.base.protocols.ssh.basic/ssh.log index f9dc1ff60b..e3168186e6 100644 --- a/testing/btest/Baseline/scripts.base.protocols.ssh.basic/ssh.log +++ b/testing/btest/Baseline/scripts.base.protocols.ssh.basic/ssh.log @@ -7,8 +7,8 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p version auth_success auth_attempts direction client server cipher_alg mac_alg compression_alg kex_alg host_key_alg host_key #types time string addr port addr port count bool count enum string string string string string string string string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 2 - 0 - SSH-2.0-OpenSSH_5.9 SSH-2.0-OpenSSH_5.8 aes128-ctr hmac-md5 zlib@openssh.com ecdh-sha2-nistp256 ecdsa-sha2-nistp256 a7:26:62:3f:75:1f:33:8a:f3:32:90:8b:73:fd:2c:83 -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.18 40184 128.2.6.88 41644 2 T 1 - SSH-2.0-OpenSSH_6.6 SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1 aes128-ctr hmac-md5 none ecdh-sha2-nistp256 ssh-rsa 8a:8d:55:28:1e:71:04:99:94:43:22:89:e5:ff:e9:03 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.1.79 51880 131.159.21.1 22 2 - 0 OUTBOUND SSH-2.0-OpenSSH_5.9 SSH-2.0-OpenSSH_5.8 aes128-ctr hmac-md5 zlib@openssh.com ecdh-sha2-nistp256 ecdsa-sha2-nistp256 a7:26:62:3f:75:1f:33:8a:f3:32:90:8b:73:fd:2c:83 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 10.0.0.18 40184 128.2.6.88 41644 2 T 1 OUTBOUND SSH-2.0-OpenSSH_6.6 SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1 aes128-ctr hmac-md5 none ecdh-sha2-nistp256 ssh-rsa 8a:8d:55:28:1e:71:04:99:94:43:22:89:e5:ff:e9:03 XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57189 192.168.2.158 22 2 T 3 - SSH-2.0-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 aes128-ctr hmac-md5-etm@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 28:78:65:c1:c3:26:f7:1b:65:6a:44:14:d0:04:8f:b3 XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 57191 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98 XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 55179 192.168.2.158 2200 2 T 1 - SSH-2.0-OpenSSH_6.2 SSH-2.0-paramiko_1.15.2 aes128-ctr hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 60:73:38:44:cb:51:86:65:7f:de:da:a2:2b:5a:57:d5 @@ -21,12 +21,12 @@ XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 56878 192.168.2.158 22 1 - 0 - S XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 56940 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98 XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.2.1 57831 192.168.2.158 22 1 - 0 - SSH-1.5-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 - - - - - a1:73:d1:e1:25:72:79:71:56:56:65:ed:81:bf:67:98 XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 192.168.2.1 59246 192.168.2.158 22 2 T 2 - SSH-2.0-OpenSSH_6.2 SSH-1.99-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 arcfour256 hmac-md5-etm@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 28:78:65:c1:c3:26:f7:1b:65:6a:44:14:d0:04:8f:b3 -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41164 128.2.10.238 22 2 T 5 - SSH-2.0-OpenSSH_6.6p1-hpn14v4 SSH-1.99-OpenSSH_3.4+p1+gssapi+OpenSSH_3.7.1buf_fix+2006100301 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 7f:e5:81:92:26:77:05:44:c4:60:fb:cd:89:c8:81:ee -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.32 33910 128.2.13.133 22 2 T 1 - SSH-2.0-OpenSSH_6.6p1-hpn14v4 SSH-2.0-OpenSSH_5.3 aes128-ctr hmac-md5 none diffie-hellman-group-exchange-sha256 ssh-rsa 93:d8:4c:0d:b2:c3:2e:da:b9:c0:67:db:e4:8f:95:04 -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.32 41268 128.2.10.238 22 2 F 6 - SSH-2.0-OpenSSH_6.6 SSH-1.99-OpenSSH_3.4+p1+gssapi+OpenSSH_3.7.1buf_fix+2006100301 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 7f:e5:81:92:26:77:05:44:c4:60:fb:cd:89:c8:81:ee +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41164 128.2.10.238 22 2 T 5 OUTBOUND SSH-2.0-OpenSSH_6.6p1-hpn14v4 SSH-1.99-OpenSSH_3.4+p1+gssapi+OpenSSH_3.7.1buf_fix+2006100301 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 7f:e5:81:92:26:77:05:44:c4:60:fb:cd:89:c8:81:ee +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 192.168.1.32 33910 128.2.13.133 22 2 T 1 OUTBOUND SSH-2.0-OpenSSH_6.6p1-hpn14v4 SSH-2.0-OpenSSH_5.3 aes128-ctr hmac-md5 none diffie-hellman-group-exchange-sha256 ssh-rsa 93:d8:4c:0d:b2:c3:2e:da:b9:c0:67:db:e4:8f:95:04 +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 192.168.1.32 41268 128.2.10.238 22 2 F 6 OUTBOUND SSH-2.0-OpenSSH_6.6 SSH-1.99-OpenSSH_3.4+p1+gssapi+OpenSSH_3.7.1buf_fix+2006100301 aes128-cbc hmac-md5 none diffie-hellman-group-exchange-sha1 ssh-rsa 7f:e5:81:92:26:77:05:44:c4:60:fb:cd:89:c8:81:ee XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 192.168.1.31 52294 192.168.1.32 22 2 T 2 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_6.7 chacha20-poly1305@openssh.com hmac-sha2-512-etm@openssh.com none curve25519-sha256@libssh.org ssh-ed25519-cert-v01@openssh.com e4:b1:8e:ca:6e:0e:e5:3c:7e:a4:0e:70:34:9d:b2:b1 XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 192.168.1.31 51489 192.168.1.32 22 2 T 3 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_6.7 chacha20-poly1305@openssh.com hmac-sha2-512-etm@openssh.com none curve25519-sha256@libssh.org ssh-ed25519-cert-v01@openssh.com e4:b1:8e:ca:6e:0e:e5:3c:7e:a4:0e:70:34:9d:b2:b1 -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 192.168.1.32 58641 131.103.20.168 22 2 F 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 192.168.1.32 58646 131.103.20.168 22 2 T 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 192.168.1.32 58649 131.103.20.168 22 2 T 1 - SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 192.168.1.32 58641 131.103.20.168 22 2 F 1 OUTBOUND SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 192.168.1.32 58646 131.103.20.168 22 2 T 1 OUTBOUND SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 192.168.1.32 58649 131.103.20.168 22 2 T 1 OUTBOUND SSH-2.0-OpenSSH_6.7 SSH-2.0-OpenSSH_5.3 aes128-ctr umac-64@openssh.com none diffie-hellman-group-exchange-sha256 ssh-rsa 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.xmpp.starttls/conn.log b/testing/btest/Baseline/scripts.base.protocols.xmpp.starttls/conn.log index 8093b691d6..ebb1bc2d64 100644 --- a/testing/btest/Baseline/scripts.base.protocols.xmpp.starttls/conn.log +++ b/testing/btest/Baseline/scripts.base.protocols.xmpp.starttls/conn.log @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 198.128.203.95 56048 146.255.57.229 5222 tcp ssl,xmpp 2.213218 676 4678 SF - - 0 ShADadfFr 19 1676 15 5442 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 198.128.203.95 56048 146.255.57.229 5222 tcp ssl,xmpp 2.213218 676 4678 SF F F 0 ShADadfFr 19 1676 15 5442 - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.utils.directions-and-hosts/output b/testing/btest/Baseline/scripts.base.utils.directions-and-hosts/output index 3fe34e9f77..ccda3ce586 100644 --- a/testing/btest/Baseline/scripts.base.utils.directions-and-hosts/output +++ b/testing/btest/Baseline/scripts.base.utils.directions-and-hosts/output @@ -3,21 +3,21 @@ LOCAL_HOSTS(10.0.0.100) == T: SUCCESS REMOTE_HOSTS(10.0.0.100) == F: SUCCESS ALL_HOSTS(10.0.0.100) == T: SUCCESS NO_HOSTS(10.0.0.100) == F: SUCCESS -LOCAL_HOSTS(192.168.1.100) == F: SUCCESS -REMOTE_HOSTS(192.168.1.100) == T: SUCCESS +LOCAL_HOSTS(192.168.1.100) == F: FAIL +REMOTE_HOSTS(192.168.1.100) == T: FAIL ALL_HOSTS(192.168.1.100) == T: SUCCESS NO_HOSTS(192.168.1.100) == F: SUCCESS INBOUND(o: 10.0.0.100, r: 10.0.0.200) == F: SUCCESS INBOUND(o: 10.0.0.100, r: 192.168.1.100) == F: SUCCESS -INBOUND(o: 192.168.1.100, r: 10.0.0.100) == T: SUCCESS +INBOUND(o: 192.168.1.100, r: 10.0.0.100) == T: FAIL INBOUND(o: 192.168.1.100, r: 192.168.1.200) == F: SUCCESS OUTBOUND(o: 10.0.0.100, r: 10.0.0.200) == F: SUCCESS -OUTBOUND(o: 10.0.0.100, r: 192.168.1.100) == T: SUCCESS +OUTBOUND(o: 10.0.0.100, r: 192.168.1.100) == T: FAIL OUTBOUND(o: 192.168.1.100, r: 10.0.0.100) == F: SUCCESS OUTBOUND(o: 192.168.1.100, r: 192.168.1.200) == F: SUCCESS BIDIRECTIONAL(o: 10.0.0.100, r: 10.0.0.200) == F: SUCCESS -BIDIRECTIONAL(o: 10.0.0.100, r: 192.168.1.100) == T: SUCCESS -BIDIRECTIONAL(o: 192.168.1.100, r: 10.0.0.100) == T: SUCCESS +BIDIRECTIONAL(o: 10.0.0.100, r: 192.168.1.100) == T: FAIL +BIDIRECTIONAL(o: 192.168.1.100, r: 10.0.0.100) == T: FAIL BIDIRECTIONAL(o: 192.168.1.100, r: 192.168.1.200) == F: SUCCESS NO_DIRECTION(o: 10.0.0.100, r: 10.0.0.200) == F: SUCCESS NO_DIRECTION(o: 10.0.0.100, r: 192.168.1.100) == F: SUCCESS diff --git a/testing/btest/Baseline/scripts.check-test-all-policy/output b/testing/btest/Baseline/scripts.check-test-all-policy/output index dc5cecd6d8..49d861c74c 100644 --- a/testing/btest/Baseline/scripts.check-test-all-policy/output +++ b/testing/btest/Baseline/scripts.check-test-all-policy/output @@ -1,2 +1 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -WARNING: No Site::local_nets have been defined. It's usually a good idea to define your local networks. diff --git a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.deprecated b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.deprecated index f3a85bc941..9908333d39 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.deprecated +++ b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.deprecated @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid tx_hosts rx_hosts conn_uids #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string set[addr] set[addr] set[string] -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 C4J4Th3PJpwUYZZ6gc -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 CHhAvVGS1DHFjwGM9 -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 ClEkJM2Vm5giqnMf4h +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 C4J4Th3PJpwUYZZ6gc +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - 88.198.248.254 192.168.0.107 ClEkJM2Vm5giqnMf4h #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.new b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.new index 2ef29b8d5c..6b5f32fd1b 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.new +++ b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields-concurrent-range-requests/files.log.new @@ -7,7 +7,7 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - -XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 - F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 C4J4Th3PJpwUYZZ6gc 192.168.0.107 58720 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 CHhAvVGS1DHFjwGM9 192.168.0.107 58716 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - +XXXXXXXXXX.XXXXXX FaGjhv1ozACeoEnwg5 ClEkJM2Vm5giqnMf4h 192.168.0.107 58718 88.198.248.254 80 HTTP 0 (empty) - - 0.076646 F F 30003 104857600 179998 0 T - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.deprecated b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.deprecated index 5cf09741a9..4664ffb864 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.deprecated +++ b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.deprecated @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid tx_hosts rx_hosts conn_uids #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string set[addr] set[addr] set[string] -XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 (empty) text/plain - 0.000263 - F 4705 4705 0 0 F - 192.150.187.43 141.142.228.5 CHhAvVGS1DHFjwGM9 +XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 (empty) text/plain - 0.000263 F F 4705 4705 0 0 F - 192.150.187.43 141.142.228.5 CHhAvVGS1DHFjwGM9 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.new b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.new index 0f8a43504f..1e6ed8b6c8 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.new +++ b/testing/btest/Baseline/scripts.policy.frameworks.files.deprecated-fields/files.log.new @@ -7,5 +7,5 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid #types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string -XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 (empty) text/plain - 0.000263 - F 4705 4705 0 0 F - +XXXXXXXXXX.XXXXXX FMnxxt3xjVcWNS2141 CHhAvVGS1DHFjwGM9 141.142.228.5 59856 192.150.187.43 80 HTTP 0 (empty) text/plain - 0.000263 F F 4705 4705 0 0 F - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn1.log b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn1.log index c8f8c877e2..d50fe7619b 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn1.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn1.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_l2_addr resp_l2_addr #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH - - 0 H 1 48 0 0 - 00:13:7f:be:8c:ff 00:e0:db:01:cf:4b -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 85 0 0 - 00:16:76:23:d9:e3 01:00:5e:00:00:fb -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 179 0 0 - 00:17:f2:d7:cf:65 01:00:5e:00:00:fb -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 - - 0 D 1 73 0 0 - 00:30:48:bd:3e:c4 01:00:5e:00:00:fb -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 - - 0 D 7 546 0 0 - f0:4d:a2:47:ba:25 ff:ff:ff:ff:ff:ff -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 - - 0 D 2 122 0 0 - f0:4d:a2:47:ba:25 01:00:5e:00:00:fc -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 - - 0 D 2 122 0 0 - f0:4d:a2:47:ba:25 01:00:5e:00:00:fc -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 - - 0 D 1 78 0 0 - 00:23:32:b6:0c:46 ff:ff:ff:ff:ff:ff -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 199 0 0 - 00:17:f2:d7:cf:65 33:33:00:00:00:fb -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 - - 0 D 2 162 0 0 - f0:4d:a2:47:ba:25 33:33:00:01:00:03 -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 - - 0 D 2 162 0 0 - f0:4d:a2:47:ba:25 33:33:00:01:00:03 +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 173.192.163.128 80 141.142.220.235 6705 tcp - - - - OTH F F 0 H 1 48 0 0 - 00:13:7f:be:8c:ff 00:e0:db:01:cf:4b +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 32902 141.142.2.2 53 udp - 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 37676 141.142.2.2 53 udp - 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 38911 141.142.2.2 53 udp - 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 40526 141.142.2.2 53 udp - 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 43927 141.142.2.2 53 udp - 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 45000 141.142.2.2 53 udp - 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 48128 141.142.2.2 53 udp - 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 48479 141.142.2.2 53 udp - 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 55092 141.142.2.2 53 udp - 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 56056 141.142.2.2 53 udp - 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 58206 141.142.2.2 53 udp - 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 59714 141.142.2.2 53 udp - 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 59746 141.142.2.2 53 udp - 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 59816 141.142.2.2 53 udp - 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.44 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 85 0 0 - 00:16:76:23:d9:e3 01:00:5e:00:00:fb +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.50 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 179 0 0 - 00:17:f2:d7:cf:65 01:00:5e:00:00:fb +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 35642 208.80.152.2 80 tcp - 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.118 49996 208.80.152.3 80 tcp - 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.118 49997 208.80.152.3 80 tcp - 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 49998 208.80.152.3 80 tcp - 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 49999 208.80.152.3 80 tcp - 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 50000 208.80.152.3 80 tcp - 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 50001 208.80.152.3 80 tcp - 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.118 48649 208.80.152.118 80 tcp - 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - 00:24:7e:e0:1d:b5 00:13:7f:be:8c:ff +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.202 5353 224.0.0.251 5353 udp - - - - S0 F F 0 D 1 73 0 0 - 00:30:48:bd:3e:c4 01:00:5e:00:00:fb +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.226 137 141.142.220.255 137 udp - 2.613017 350 0 S0 F F 0 D 7 546 0 0 - f0:4d:a2:47:ba:25 ff:ff:ff:ff:ff:ff +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 55131 224.0.0.252 5355 udp - 0.100021 66 0 S0 F F 0 D 2 122 0 0 - f0:4d:a2:47:ba:25 01:00:5e:00:00:fc +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 141.142.220.226 55671 224.0.0.252 5355 udp - 0.099849 66 0 S0 F F 0 D 2 122 0 0 - f0:4d:a2:47:ba:25 01:00:5e:00:00:fc +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.238 56641 141.142.220.255 137 udp - - - - S0 F F 0 D 1 78 0 0 - 00:23:32:b6:0c:46 ff:ff:ff:ff:ff:ff +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 199 0 0 - 00:17:f2:d7:cf:65 33:33:00:00:00:fb +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp - 0.099801 66 0 S0 T F 0 D 2 162 0 0 - f0:4d:a2:47:ba:25 33:33:00:01:00:03 +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp - 0.100096 66 0 S0 T F 0 D 2 162 0 0 - f0:4d:a2:47:ba:25 33:33:00:01:00:03 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn2.log b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn2.log index 348b0ec967..777791d24a 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn2.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn2.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_l2_addr resp_l2_addr #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp - 0.041654 35 128 SF - - 0 Dd 1 63 1 156 - 90:72:40:97:b6:f5 44:2b:03:aa:ab:8d -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp - - - - S0 - - 0 D 1 328 0 0 - a4:67:06:f7:ec:54 33:33:00:00:00:fb +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.17.156.76 61738 208.67.220.220 53 udp - 0.041654 35 128 SF T F 0 Dd 1 63 1 156 - 90:72:40:97:b6:f5 44:2b:03:aa:ab:8d +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::a667:6ff:fef7:ec54 5353 ff02::fb 5353 udp - - - - S0 T F 0 D 1 328 0 0 - a4:67:06:f7:ec:54 33:33:00:00:00:fb #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn3.log b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn3.log index 09487cf0ac..9d40df77c7 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn3.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.mac-logging/conn3.log @@ -7,1337 +7,1337 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents orig_l2_addr resp_l2_addr #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNdne23ox8SQTgPoy3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeGt004UBsXLoZSeCg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTrywc2ra7tcWn2af 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzmEfj4RValNyLfT58 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCk2V03QgWwIurU3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgc67J2CpHIVN7HAw4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgwPkWkJfuBIJsNi4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CImWJ03GsvPvA0P67i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKJVAj1rNx0nolFFc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CD7vfu1qu4YJKe1nGi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWhRtK3eXodviHmbo7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqVUM4vyqCacqFiud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CudMuD3jKHCaCU5CE 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRJ9x54IaE7bkVEpad 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAvUKGaEgLlR4i6t2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ck78JG32Y4I7AGp7Vb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgwg7Z1MHA1YkiZmm3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDNchHwRoXhVzzHB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeP1sc28dOzbbYkbA 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COOKv01AQPAqfGMN9k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0JEpR1Ij6308CwEhh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQcXCjONUKqMfnhXb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVcd914ZFpaUisaVf2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5pL731XEkARXOq253 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CB0Ovs3cNZgLQ93FSh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM4z3Z2rdNfyHYQ0Df 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1dGa34JRiYAKbMI0c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtEfXf4f39NRDu1Dr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdY2UF17xGQ6lUx7e8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkD1144ZtRYffh5zjg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbI5Qt4rlFnOHuL522 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjGaD11BLkmCG5cEVf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdGkzc4fIBRo0721v 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1ejhC4SXsZ4pEdOd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CisPKv3PhjrFFhZbq7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCgIHR2Vna1ZW9BPjd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWqViP2k4EKfYWy7Y1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBr8Cp4juBTcRQZAA4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWMTYT1vZEQXErCXY7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9Mb033HGlhETKxUbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGwfOa4GYyzNItzc9j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4C8Lr4DOGUTRZPAW8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfQutTEgs3g8sUrsa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKvlqe4bTVu5HNGrb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C04EG53Yaw6dgjGT3k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdzNo91LLZlfe0pmT8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cb2Rv3Wek35VDwxDk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsLUyBLEs5x3GKtgk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CF00uX66iWHtiV1q1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkVqlMyWLZSpdNcPa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6Frs83UqNszgcqN15 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQCAYJ2zCov16vZwf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cil9Tc1rwfQS9uqdsb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgHhMv2Ww0Y4oQNtd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFTS591Wnlb7gnrpP7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoVJDI3K3qTiTnPoV9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChHNpz2Xf9xMo2lnC4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch5tsG3OlOd7l83JFc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3AXaL2up5k3PR4VW4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2qZRm2yQg9RoQNkVg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6tA8aOk3QI9oIaHl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CggxJkLPcdPyKjfma 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CI5pddk2aeicnmmoj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKpb612OxJundLAeRf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcwXC81REVUrKprLz 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5OBjqCVHlPAjKQXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cb7w0T1dHZUPXzdgRi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cuhrwt2ypWdmhxNcjb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJmTVn4YcEf19Wo137 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COvnS21VmREmS5Xzuf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpKJJiDUPEBNMGSC 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5II0Z3yZFhDzHSKrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQ7b0y4Vd4NVQ3nJRi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C68HZHafWQbOYWkYi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CX9xXW3s3cSCaIB9a2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUTgljebkkh2Ydhzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsnMLaDyNeIqxq6i2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuIjKg2hEOBmXsIvx4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1alUz23K74AR4WZUc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9ywcdnOP5TLfD97e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7aJ8S1bYoBzPdxRDb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTISqXQMVxGJCVG2i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjsoT83JnYI2Be2f8j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CohWkh4QvZcB1WXOVe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CL7JR54e4lOc3aUAph 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CS9xQJ3Jly032E9jC2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPOg0SZxpoHbNzpG5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgYh1L1mwsOxSqVBu9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPEPje2CwXXxGGPo27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIWOQa2vaf6TxyZ2Jg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqyxRG6TRKYW41Zz5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3HR3r12iwKiqXa9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C823dt2fd3qQ26XyU 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CalQkN3MoYim6AEEe4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzZuKd2XEy2jlcWqT6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVgpXQ1plHZSjZoGq9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPnPwW1vseaFvOVKZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cr5ot64fYu8c0wBtik 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CceZRf3q969iOibom4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cfv1oI1ypkphPOMD7g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkgPZ03tcwpxYjnOSc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeYlkM3WxZVUmujyB9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8yjkq23bmUk9MkLf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CevQX3116xo72LIoK9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChN5cQ1faCW2xBl8Ki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjTrQkID6Z2SNK3ha 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CA4o9G1CB2Af4WWhCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cf8FAq4I77xaBMSVT9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPjxvb4XleEtywR72 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7XVqL2qUJ1enNZYag 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjqWgiHlaYFi9YImg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1uJul2gbxeDRNFura 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbIFhV2t1dFcA47mxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAy1xs4SqOffMYYoi6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3sUxYJbMLLrlkY2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cz7T4t4CVp8k2htbIk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cqn0E64YUKHGEJtXE9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwkPvf43XtOGn09xUb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQKymemsGWxk8qNhi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4DpKm2ihMjo33xAK9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cx1J5T2RlUHdnWX4P7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cq5Tn24Flxl5ykcPB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBMc5Bq8xeq3TqHyl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwalhH1EmkTCp6Z5oj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoBPIr1bmfwOHYS8k7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CauDdy1kS45qWx7Jaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeivHI16nJNE1XoDn8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cwks1t1XCX1VVKWlui 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COzc1t4726TvteJAq9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CySyNg2Q7X5Wig9qXc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdHHGD21PDk8qHCNZi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CytmUVLD1AW7Bjdda 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyAz9V2XDShWvc9X85 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9mSwv1EoAGeQwdxia 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSqd0W3t872JJDPQR7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBdUFS64H8SD3CRc7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXmENaHXj6AAZ6z67 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHxNzE4i1HGC9aNQb8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCOssQ1lVW9L4luov7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CH4Zqaz7LIoXnVdx6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmYN6N1hsT2MgdKQo9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkH9U915OzOOjvkSJi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCwJVWbbaSCkRe2K9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRGnRy2aYiKuVFnIG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3JRhD4EKTLL9ETgB6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTy7qulV8eG6LkeUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUN1fq1Nh9yg0qjEZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cy1IPuLzKTRb2fGF8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2sbOw4qh4NrDdHRH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsTLYp3UVyKHvvF8jl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COJL3m2IFflzZ1Cvdk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAR8U13yNQoRQJZLcd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYXkGL3OwfyucBURVl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfyyuF35s6IHIKaPy1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6lrWz3udBitB6moKf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJBk991FDSqc8wRBK1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeoHSa1uBAQlDI3FEe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnB5fj2ShUFnGngqf8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C850go2IsfiAcSGCfc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRM6Kv2JvySZyj1qrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChDijs42aziwiDYP4c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiZMlr41UYw4zUSiH7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Car6PO34Q2yGqFhtw8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwUICHbZAZuWABr9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLvoof1o65FluhXQI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C45NxP1qI6S5UMi6Ta 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C73cNq1ss4gZpfV8Jj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWnddL27sIwroPwU4h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwP7As3BK8V5lwj7D8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaEkUY1AI0qcJSl8Cd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBkOwg2KK7rXFXUTmd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0u03i3hv4B4fSd7zg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CITjhO2n7PZKsy3Mw4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ci0XPI2JfTjInNGHJ7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvRIiA3mohju9nTku6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUAWQS1YtxjDhtxxte 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgcc4N2eKsv3m3nA87 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWT4zv7sNwj1cnBeb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CylDMs45x5z5lRx9se 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CT4t8k1zeBe7ZRUBg5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQHUiY2AW9ZT2iB0x8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZvB3g1drtq6h6KP8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBeoy737B8VrP0iSS6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cs4vHa2laJaNpjym2a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYwHEGkAUO1v9YGk8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzcPSa4HIZVpmSAZQ1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmVWUQ1Zj8v9tk8Tn9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cyyy781JVg92X5mDUc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMU7t24bL4QMZtMO2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Czv7tI2Aq1yfgdryG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CR7XxA2W5vLwE5KTs 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmDpIN2aFGjiOMOJWe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5p9eh4XiSATtqsZi5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVLeLf3d954JlCj5Ch 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUeKfb4nbjydJsNdId 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cekrs3zkM6eSou1mg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUVPVWOtpPH13Hfck 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfhuF84Ji7AdXxsAA6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgfSWCkLmMlaKMWUl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRYwli4VJ5IlPTDWIl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CguHTc3ErOLWFoQyBa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpDj0c1fnKaDIGyqma 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CF5tR03Af5y0DJD2he 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbaJQC9l9K3ELB1u1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9xsW63PP2wB8hiDUk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzWoyC1HE4FO1zdT3a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyVhox28QHRlYRbY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C57jQA4eBlGbOkJ0xc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CimLTH3Vi2F5nxs6Bf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COlS4I3p8lZG3vxBag 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch4OGK13MCwxE2a1O9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzTeK32euJBRHTY2z5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CA1qPq3zXlCZGMTF3d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClzajT3YA0FYcHeIsi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoW1ycpevZQjU9uK 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4mAqd3q1os6WQrFGi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoLfC03bP9cbW0s7Cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDZen84XixQL22chD7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEUdRVRpBWnzWSuJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COUblG2yCsr6J0Z8k3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtAsd2ykOOaUv0sel 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8iXoIHQrMuYvFD7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEZ4zB1w0bcdFufPv5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHwfwB4tWYNdiXgqj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpXYCp3HhrY4ziK5w6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cu3mx7WQp10fiKvVd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJK73d2tv5bceelJs1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiBJbd1e77zhCc8o92 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrDDne3jAfXkyEZLZh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrtbM81EwribjjBbs6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CinzyU2OZ3RzfO3iQb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdMDAn1K65PDClegO2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CL72Eb6pZzrrF1MPc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTH9yVeqRZ7hCysmc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7dQb6wN8PS99nDpc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7zVw01Vz6Gp5SUxgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChrOVe26x8jzyNa2uf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNSAUE2BML8biNfBQ 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNJ4Xn4VtXlynW3J3a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChGNUG3biEoPUuqOa6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXw2CyoyLEXO1cDi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjvpgV6kqW0852q3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxUw172WrEAdzXMRL7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeRlLB2HA8cgJm1oe9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkQkiC4YuLauG6WZEa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfgLCv4QFww6gvQ87j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8jLEg3BRmkSv2OTHd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGCF331JLuHl54L5rd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWBzQU3jlmCFJxIvW7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuQnVY1S26nokuHtw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDLpxA3tPGVgwxSem 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqWOXg3fwJ6pVRPP41 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CH9f4S31R76ubzMqXl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7NKKJ363Po1sp1G76 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Coa3vE2Wqxw7XtPyaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPbwgd4HAWmMrjHmBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cg3va11ZQR3RERyK2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CX1G5j2XAjJVbgRRYg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1BbhC2e0BR83RHPhe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBMwL219aumFxhrnzd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ce8sjQ1yXYbarn3Mv 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C78sjv46n0JEJJ9Ixa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2z8sX3Zt54zcv7nHb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrmZ753z4MFkzJPjfk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmZgh34NMetxae8Pm8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtsyPdY3mkmf7kLb4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ct0FdeHeoqV11oqi3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHpfPUBDLI48ElQX6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6QeBz4zMAkwfJKzp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvZvjb1h22zExFA9Z5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQnxI03CHdqwafO4o2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CV85Bg1jB95m3NCt2b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cpa0UQ2794FcjpykQh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9U9nP2cjbHpr2TZZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIkXHw1k27sxdK1IL3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6sQTZ3batj1lRDpFf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrLzH72bC4Py0O0Pw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwByX11akVrJXiAL89 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMrmZC4fwKKms3eVfe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIMbgg4rrK1rYO007 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl92e44KbzduaHbhyg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5yYvFfVOJPVQqJWb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaIW4B1CNbhrY3Z9P5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuFyuJ3RcaoYD2YSlb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkeuvB3U6Z48hwsmd7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmZ5913VmiwYcCMsV9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4iWMr1o5OhwPrp8sc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeVw7f1PrVOGyux7f8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cv7Ojs44cHurW5mca 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CG1IZO2kmbIytfrjF 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFo4ijFpPMOaVkxyc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6aRsb3UekWRpglS77 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFOKe2YkWP7etA8pi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C37mAJ2U5Kisle0Qgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgjcpf4p7v2QzNmLSf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CH7oxC2LFgxSRkfdi8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaQ3deHsj3TrWL6J 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHfOyV1EmktPdJYs1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAP1W92itot6anqOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C42zWs36ET4H6JkMAf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChCctc1RXXIqfN02T2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMIGG63blVyQrgtKZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cm5hUStLXU9qmc9oi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CST4021EoQxELJXa23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEUV1F4e4X7KZmIQjg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMXu7r17v95iIWljHb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cf2iT43rdptpnlRFaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKee4U3Z4oY4yRz57c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyyAsI1bENRZJHsPxi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFfE5G2444nCYFZKB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3qdoZ1n9Z9JKjUDzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8F0wsJvnG24pWYob 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeHfJV2oKMDd0Y5Q7i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnDV6B3aFu2Rig5pDc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAYs6PGpPpvE5HD45 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnYoeO12NNlpv8vJw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7qhx8MH4aXtRLCz5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmqlEJhGZCyPSVeVg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C30S013blQYUkUFuKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfUaZj2hvTwscPvXpa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CI8nPFXkU5AYE84Ei 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtnR3q3r0iCKvV7N7b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKjWKd4Mq2FDzB7lNa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsmwQW1n5WCKtRZWOa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CisUSAKIZdFFX8lWh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeyYdH2Qfmpzbjsr2h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0i55oDRpoYXbScq 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cog8rV2Ws6Hv7UCGta 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CW524A4Jvs7LV4nSi2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZImj8vHpyMzhT9Xh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZ7qJ91KzEqUNJwu96 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cz0TOI3Oz84uu7WmSc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpkFh021CJKOiZXyPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cggyq72pcsVl1twmKc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkjjDD4mVrHaOHrTpb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl2Pp43hVt8yeVkbI9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXahDdeDuBzEqAb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTecLV1manIXTrjAIe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsLyVu1YU7im0wl04e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLYYbS2z9Ou3vNkkZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cpj9DeO0yZuq6Ute 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cc8BePGbhxSxkHHjf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwYtAfMvzk9Fod7cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUfWl31hYnv6Wwvt1j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C89fm75JmUuUqVjL2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CR8db31SCvKcWQu7se 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZ5SE92qMLKBRvXPTg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CextRf3AOZqeA1XkZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTPOjD2rPLS9mqWtI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cx2fdd4vASV4hGNamk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxO4Hl2za3S1dI7BF1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbTCX64fnBOz5Rnss5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7fmrSMRs5eEbiXEj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cfoam51KJQvseaC6O4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1Cfql1xwhiHqaEiGk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcKAdX2Q0thi02ReMe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CR4uj7veM5o7mhLT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM36EW1l3dYeFyEps8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6RIBPCLUqy7QrkG7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Czd0jk2Saz3xxLJsU3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6IvVK1opBeZQ7AQ7a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUDpIg3BIilKU95Loh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYSUaV17LYTkbrEVpa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnSEAH1VZnpGoxnDPb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNJWdr1axp5uTe7O79 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cd0PwY1sOnxvxlpOUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3plZ01VSnQwnkq1Ce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CF0xAHahJVVCD5Fi4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTPJGE4d84dfLkqXCb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVuUh142e1YgH4Ofll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLMQOF35kFy3YN5Xx8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuMT6LYNk1J990vRk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1Almd46wwAwBRkkE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cx2o7z1ve2pwRELwm2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7ORHD2Ge1bznHOYxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1hBHK2Ako3EciFj8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAKOnF2dhpD2lIpMW5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsVB753IMy3ksnCXJc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnPxgy4t7wZRlJlXic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUgy2o3FvSC7r4Z9ya 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cxd0L53LzmLx1GQL3i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdERFK2TuqeY6bOLIk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7gYx43YuJLYHaolL 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQ02Hh28fM99vbB7t8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZ6vmo2iQaPNxh2Cp5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkOZDv22AxQ2YWa9d9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C913kM1HJAW0Z0QCWc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKgKAx20fbelsVSjj3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRhBnt2F6fTBWyjylj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Css94F2wp6eqs3AG2g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5Iwq42ShwCJuekrR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiThk046sKXUN21yT7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIKTEw1hGfX8fLggpl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cuqf1SXU2lRMru8ab 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CViQRu2F6CP81AHxN7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClxNef4rXFifWlnVe5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ce9ZL977eCsGAEVwh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcsJ6S3KeIOnq32dUf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNeOYwF6hHL1iYy7a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtIalz3JApUL6lBk5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiGbMU1lOEKc8ZcnJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZ7cfF1ZmnbEKFCL86 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtwugB8dqTukJE53l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzuDds1p0W3c1OxtQa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8icM720Rm3KFNSaO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBqI3A3aZ9wbTqAHKc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDI2sycOSZMfUwDej 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdPmeZ2wefP1W2pDaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ctqz3r2Q6Hhh45ynBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZ3VMr9TGKr4pDG49 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9L1P41WGLblqJ5lX9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjpsNzwm6pkRPysTl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXKlOW2OXCLUH0tag2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaX41W2rQe7myStGic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwL1AP20TmhyPubBzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGsgYT2M54ThS9dD1i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ct7NPa2Gjw99Ds55Fa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmYrUP1Jii5rRzA2N4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfAQDb3ztIZ9Esdhnb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6gNhw2NFYJKnnBJAb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLrESm1lxkihbOfujc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGxlGu1ohd5JBhXb3l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTCzwn49MMq762o5wl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLvYvUL9THPcxwH09 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CordDM2ka874SoTG4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6SzT4NIAosKk51Ne 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzpRvg1ZARpYbvKZLd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRJfqUBQrh1OECRKh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUD9vt2xm6AFEFb9te 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGTvIE10hTfMDqvRg8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1USEM2mkGmssUQFnc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuwWUn1WWhrDuebDLg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cn0jH9tRvniY1wOdi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3JTJw4PGH9c3y1zOk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpvOTy47aAhFPLLhy2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBZ93D1F4V32UnHVuc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CU5NwdnJySKzDO6Ia 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxseO02jluUsidcJ62 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUxHC03hhHZPPZPPd7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4F8Mc19wr3znjj7ec 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCa0k62q3tTbsgMjD6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgPOxw4ZcDNtb4qUGb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cr2WN61qD7lqnpZNrd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmcxqC1uCPLsuEWiwh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAYq3UzQvLCe76Zc3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyO8GYetxJ83COadh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cn4Im3oIZPuXCwbBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGvCUk133LGTDCu1j1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpXlZE1JfmFmO9ezNe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CereAezpP5CfTQdme 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8ldQR1zcqOsEUFCO8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvZeCEJYay1Ly86ce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTUAHv3hD1FX8aHrlc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4Badl1Yn0KV5EiZI4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZTcLz2NmHcn4ZD5cc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6VgL03HYoBgYkYcwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBekaf1GPCZTu5hfEb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CorcCoU4w4ta7bXdb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIBpBT20L8Wr5vMz6e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiFKHS3FlSxbhZirR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyeHfv5JsaGfR6Q9h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiCUSr4CVHoG6yVoce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4gVAPgEpkdEDZxR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpkdiS3JOJCsLKSJh5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CF9ZRQ3YWkwyOaZtZ3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVtLls2idlUP7gvVfa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0iDve2iVKhr0DZq4j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEpMvc44Y9buZQW9R 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSznMg1xj0hV5nntTd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRMyfvgvdHPOGXlY5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKVSkGTNGUHtVkSih 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPSiwK2DMpE2jH6Vyh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Coz5244kxG3F2Uwsp1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4ZIj1N89EJ4eXGG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQnl3dyMoPF8TrJKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBEXHD3r3x6EhHlQak 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4qlRm371SZUAlFHTe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COUK6C40KLFuCC2Bnj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5aYAD4Cn2Ubc3Lhgc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHBOAd3sRJs4TZG5rk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1KXFY1d00OW56NOug 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaqiRv1kssCwKFiAEi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2ImrtGJ5Was24kO5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkIEMY2v5zXcCRAK06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9nK7T2OW1zdBcXRr 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyNYn63xqRCtJ0Swci 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuxhD94HGUTuDMCPeh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CztBgE4sLwXhmXQ1V7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtBp2AhjFqcG9qhq5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIVadw3MmsEwKSXoRc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsJlJw3gPwZPfiVGdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXe01x1FHRzA4kaake 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY25m12Au0LbTQ7ajh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cz9mVbJ3mLhtk3Vda 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBGwJBRTFD8aLOKJc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkSzRz17ol01kBjlNf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZLdPO2kd9vZKOmwTh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEmAHt4Xvq0HLd9W82 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3838x22eO0vcv6Mgb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpltvGXeH3DLAPPT4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3Z4pJiqtIGHawj0g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChL9vB4VvykErujpb4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ca5orO1gBdPoGkIAGe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcwdAP1q3qj9kGbD64 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGoZfnZAUfEApqP12 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CULfbN3hEwMuuClQlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5CCVa2TESFWWp4h2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbEhxC3seucNFjJzl7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNkqdY1uFJUpLHcIfd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJ5lKt1FBnPOLExVJi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7tQLt4nj8nmymJNBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNndLX2qcoBO1T5h3i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl6URq30CgLqZmHbdl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQrWXaeiNsamnLxJe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUUubM1kNFUIoAtRDi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cdm9Cl2oExwyIrTygf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnKdXm4Tf4ML9ukOYh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C66i3N2Qa1eqAyN8N8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoXkaI3nBcggoQSFO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRJy7L2YDZXsYxDhC3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl2pecmmIw1GjkVJb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHWRw82poLxopSRDzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnflkX1d2USQ4QeAK8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C16ibw2KpRbXYrd0Yl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFiVSW1o9EVx5N4Jb6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbGXIX2xTZKRuIZwCj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCvExA2GM22zrnZkZi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CV5jTHZXiRRacOOud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClpAsC4U0tWM3Z6Gz1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGToTMGh5q3VrJjni 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfEaWC21ew1UaBmeLa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoNHfb4cDZSJh2h1l2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAu0Oo4x3iftOu5dF4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoysEl2JglWGPKCEF8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfPVQm1k7F6Fd9dXi8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXEAGK24uAf1EMpLV4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cga10I1NjMZq5YSNWd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CABy0s1rpWlZ6X6tW5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFIQPc4ShJClVxKPr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIYmfgVlNE7B6N4ec 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ctu1Eu1GyUwEttbbRb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUBLiE4H0lDoOyqIr3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdoKkT2Ke5De7MWN6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkibYw4PuXuckQflIh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9HQs14k8DJZQaqRmd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ct2bcYZHIODrba6hg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgUlJjlqbB9Kzozkj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CI6Avt2cWWdmpsQnb9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUn1iH2S48i4Heqnzh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7CXmL3ysk9qbtIpVl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1Zh983vVGDE8rpT2b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwhQVj4Sr6YxoNBRek 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CC1mwWtpL7QIsnIu 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqQ3mZ3WK7Dpj8ebI1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cuoe3c3Hv3XA5H3auc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNm68aOVy0Yxl7tHg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CecHQz1SmJzVmrjLc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7FoyE15oylgO2D0vh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdjqSs1yLtNe7Xiylk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaQnjV3UHc2hg5HvJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPqeCK3u65w4FShPC2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJIWFo1ifuQFC3myBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpIBX42j0JTDLqNky9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrDPHt2myMadMHRtGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChUf2j8A2cckuCB9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CodUX14FayPV287Dka 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpYISz2x0t1IB0QTDf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9aPOm1XvemsGRM5n2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwA7AO3h7M0tClfk14 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5OuLn1RyWY1Cbhc24 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTrEfQ2OTZ6XwuqzF6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CB7oN32GMSHJRH46Q9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cts2Bw3UyYSC8eJbw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COVKbVuLViTpKix0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtcBaG9xFLC4GY3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEukfh1EN6VBqvS5V5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwK86z3GfLlLdBtjf7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgKGYB4pW3vOfMBV 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMn4xD3x1CpYubrX2f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY9Su7UUQHd3QxCU7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChWyT7DaScEmURW7i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHCWma4mS3ppsLP48e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLDNHl1Z4OK0sDBoif 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM2JMA3ZfXFcSbIVb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLe3ci30E20BAchq3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfgmfA4jTr8Y6eLJHg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CW4Csw229iMW5e0Rlk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeoYqm4Iisj3ozpq92 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cbr3ZX2RpOAHKjmCff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COwrPBGIpzPLJeW68 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNsMUUGQHroPHA8Ci 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C426X13okmzS5nezed 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ctvhwu1lrpdV6DZdwb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6b9XS2XeGtwYY87xk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYCYdh13mKTqx1ydmg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzzvQk2VG9RA5JUFa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3qPT62UwGnCqVIHe3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsBdJ51j1nLK3tl2F3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGF4CK3UKYLwIPRwyl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CS9Igm4X2rCHxh8EI2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZVWmQN2v8aUbBLrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiWSbfVPxd3DU1Tkl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CN8vYE2x91ejKzzsD1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWfGo22Wn4dNhEMG06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQwX581RWAcdloUaCl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcHqZF4mAmTipPOItj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDbHurHHYzQh16a75 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeOJdl3twOYDJJ71De 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CB2C6x1g0GQKuoDeTj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrynIf4rhiaSYubZmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgpa8U1xzUsAFVfqac 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLSa0ZadTj6WeeEu5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnxPqm1SEHF2WwWUG4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXhpq14dW9SZTBfHJ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCgTLd2teo52h0Wstf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeFdYqfRlkaD4rak9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9mchV3W5GidlSM84 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMErzU3stNQPLKaMU9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0I0Rx1ymjsyaZC0jh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiKVFD1jyEZMI1gXIb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cdnacw1CFnnqrlU3O4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPStWmXe4km0Cl0ol 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJRkQA3jOwlmlfcqU1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeEFRd4qMWwv0Jh8k7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQ9bIuaEcQxsRROo5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C284OX195pTFFffz36 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNGTy6cxx7ybLF9W9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7q4oH2DTPedalIPWe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChBuyc19gI9J1KGmY 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqDFty3SRyrnf90hfi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cggwuf3G2K5ZN4oakd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM7VSScmo8RxJVRq4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CouMIolaAAuU3uBsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEAWkJ28DI9nEKRfOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLYTyf2HBOn3UVjHO1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CO6Ebe3kdaK8oiVzs 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGTZtF4cqefNQf85xi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch03izqlxvJxYGLH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9I5rZ3zk42R1XANoc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaU2kGXngY73q9ukb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTm5e81lzI1LnBExS 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxmPyngR6MzIa1Eh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbFrYB4DZH8tDkL0Y 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMXdX44qcXXU2h79Z3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEFFYl4SiGIgQVBwlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch7jT14FYeXA4zibfh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJGat7FcGiecvRUsg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNatvs4kRF4PKwSQa6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2NBCp3jV77cmR5Zt8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6WtsQczYdAqti8rf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUhe5I3aTm7jZot2n3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNFZJ71R8kIIoPNIk5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcUcWO2v7gHgNp7Q62 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cb3KX21dAVvTruW5u5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ck2Rvb2bOsJDxQIHh2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDI95K1GQpHhlE1WO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkQ1G62jdm35jCXtlh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPVwfY3kLDmu8VeKdi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXOtEWMw2dl3XsTGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C96Nem3M5LAE4wmxq8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch4s3N255T98eOAbg7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRfKrw2WpPG0f6YNab 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkvEuA3A1e1PDP6u9l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJGA6LrfAhefNKwZg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxAT1S1sipPu2RSOK5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CR9GIt1uVcCEzQmX0d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CG0N5A4T0LUzvnAdr9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfXYNY2Gtu2mOvJMAb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqUr0V2Ejojsue0UB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvrWt84lulkHNvYqk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGb1NjWtOcccF7wwj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CilF4d1b6woayAE906 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8j5rU2S8wOqxY7Xzf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuUrLB3Xprhr47zsPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpIcgv424hVeESIlv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgVp8E3o8WDS25ZEah 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaN1s3SLGBQ4aYcp4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLIxGjgqmKhRAW0A6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBcpca4v5bAbAgFPnk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cx0S392Jm2GGs57Vqh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0rM4y1xCN8gaJlx65 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWTYeZLvhVCqQ0Oii 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHdNJ23h8TGauylVzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmlD1G1PBWF7V3AqC4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxD8fj1FHwuZnvlIDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpXPjc2FWuGLYIHrq7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXStoPw0l608HE7Wa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CppWZ13XXmGNWo1sa5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsOsbJtpfytT4Zwmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAp5VrBkO3ZBZDw7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdArbn3VkPQ2LQ6IZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFQWWm3dCGqvIQuOIf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cuf8Te1rhfkUe3Ps39 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXQYhQ1U3eH1eCHbO1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLd7E94pRH1IAYvYYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXSjf889bs6zGkd1l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmudKn4wcczZ81CgS 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7cysk1k80rr0XAVGc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeAngf2WowKEx9bxt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COlxFa21bPstCyqFbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFLsus24dYUFU43gT4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COPxfr3aAGe1RkBpY5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkChJz10kLSqA8jzMh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZLWOymP9apVN0cS1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClpiTi38HDCVH757G8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cc6Ywj2npKqeQWf0Xj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CURyWM3JQc50i4uAy4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPlAAd1glpWofm9c48 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cs22AT1iDlXjpnEh23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CX9APc3bZVpG3EOoJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cu5n8i1eR1Uq7cpNp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQZgXn37WW1G2MlGkd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfSvmp2TftQyAmW5Zi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjVLso4czHP84pCpIe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4SV4k38RC1OUl5bJg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLODqD4BvYLZkLD46e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYrTQs2MBgNd1gdB54 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEePRr28Y2Y1Mk7fol 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cp9nfP3Ll0DU202fD5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CB1p8vzDu27Xh8mjb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1cf2A1IEXB6OWP7g8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNH2dH2ojKinxj8Znl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSw824rvuPrp6U7lb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSLQtD1VcMg50oXYij 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtS0rHoMhL7UNXlk9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpNVijnE2lWwqFUTd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjsNda3kT7BMmn79r5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgYgjg4uU6EPRMKrHe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGv6GGMohalagEtfh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSW3Ia4wgHVN2LR2x6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIocUB2QmNtAt98Raa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cc4qTzr0Vrfu3VYJ8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbTdzs3jEHRNU2hFC6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnxLUi2KiCwChGAqX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQWG8r2dfrbg8LUlua 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CngLM039cnn4Mvt3Df 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPchod2Y4uAM4sSS9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFTJ5k1BeIJn84TMH3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyZqmk3JlFJTzRoIM4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvI2Po42hxTw7EWx0d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUNPU92OvaTuTi9Mn6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCljqz1dhNjSOwPtt2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQxarQ3Old0ATLJU34 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cw0Nu83mpEDdLy8MC6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChnNNF3g5zHZRnTnB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuuVrm28b4g38DwYsc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMXwF2rCJiIRPl6jd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cvez3u2SD3arHlyAhb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ca4smwv5Bm87TV2Tl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPm8hfqbQLr7uupN8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpkkHm4vwb3YqzXCZf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfjnpA16loSFIdknW6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cps5Az3rXyb1nHevh1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXmQLh4nwA2enaBMqg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cw3UIy3L6yJtxXSNa2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZKPJ624uO7F4s4uH8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqPUf01ahHtGb1RWvf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0KvlV3xhBAS0TjIDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyMvF62XUvVdRK9MI8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGOfGiDKJQjG94tMd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwA19D3CGPf5cw6el7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTR9yW1pU9hdggZRuk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChvW5E4jKCLmJGFNg5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjJLKQ1Tjc2vp8BG8a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsXjRw16FavgTXwrbf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUCes41sQHFSrH1ZEe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CH3IYJ2c8Jen6r8iV8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClE3yWP7k1x6qEyPl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDMnmw29INxxeNQYE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNncBmG60jrMYE6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8eX4r3Cp2UPufTe1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cgt8oPuPHbri1sDsf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0tU0J3qBSNPZvvCs2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8KI9R1ifxBOWmcYbk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Chmysb4fi1r6OFHDDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0QO6i301914TaOGJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1ORxn3XJz6yGFeo1g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C16xpV1tjLQ8icxRRe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEMDMT1e4PPAuvjdM8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIUQGp3FrmzWVrNbWi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmQYii6kvBaNTuNVk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C75hcC2LEEqHPcTGQg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgOLAF3SB0Iuo1RoGb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdThD72YLnxl0tAhx9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7pyIc1SjyxmZqpP2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CG40jK2kO1NXwdRjlf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFT5QX2NGkWvDoS73b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Culfcf32j5G4hy5STj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbyYXp3OuxgvSs1rnd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CX4BSWvxCOPQSsoz8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJU0ts38Nm9alT7qOa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CmNRTy2A3u7dm89xd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0iw8dgSzn6Lt2l87 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaRZ9m4zUs222cMaf6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyNxcw4xw2VLy5xqM9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdRhWT3WJiNJd6yI4d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCZZib3Y9pjgYtJW2f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2lPJTbmBFDRGZltf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBNXBD24hjefp0LZkj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbnyaU2sWQc9hrOFsg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrSfRNn9Y6TpKSYwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfcTNZ3VzQGbNyOYm1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnrF0h45yKF5cL7XQ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ccw4T01sNMI4v5qGs3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxZjbb1da9hcaT6Bt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C840ag3wJtif3z9DV 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoXTPA2KVYz9zNYlib 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C92XxR3BCHdnrMocM5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cvjzja4a0xIU8nOkg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cadfsn2NN5nFfCVO97 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CT2pLJkKDfRbdDUWk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgQAlXJSKaQ8YnvPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQLrXR3icdsWYVPKg2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZxRwdVLWuciheCb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C90m229PgBu1jrrF5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4Evyd2E8m6d4Xhqsi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ctt4oD26CzPAWcJQCl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAVH4i4ZVYN0WDoo27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGiOCL3c4KjdZuXuff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Chc8Fa457qFmtuEYY8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKMhv2oB2z1eyRX6d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSHS0H1H0rjxicgcAg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJuvoE1YyLGhjELqf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMdhHL152FlWWz9vr1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJfYiM1E2zyHG1NoGk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDvkJz2zlMjW4EqRb9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUozuC4RUktVWsM4C1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4LIRIHQPjU6UiSOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkW4Mh33uCHmIm9Hdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTjtV749YvoXcl8Nd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFEIoY1dUsibWoByJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgBkDF4bRECntkASrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWSdwH3KEQ3oqHyRAe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRwYxf2x9mIXyPwkJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6IE5b4s4Qoqk5pgni 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxyBM33gWvfqTVKzb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CogwD74Lz7PMpUif8i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C93l5e4yKVetWUxmIb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWKen9tbdg32AFm98 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeCoMC2Dl66C9enIj2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQnCV1iF8YjETdeQf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYmjX01wozt3Bngyne 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvDeSJECATHoiOMig 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcfaGF3WOUkVaqaPs2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4yqWO3VAbIxES2rH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CugL4P2LP2PttPSKNj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCWbyI1qxx4x5p9JCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Caiz9z3pIV3Vw8bLA2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLlaSu3305zpdumq64 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgUrgP2EUQhnVU0mhh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFS3FG2WRxrhm1dYj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cu46pf3vovzIOnRuGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cg6txW3WQysgx9vIN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWV1P3151cMujgYXRk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2cQQGuP8RfmlD1yg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7HQwd40e8TI0qTbCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwddlB7WvzDnYFgOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEDuC91bJvWJYKl6d7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbmmXy37yurxWpeoib 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtooJF4JHtk2Dew0Vl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbCZuG4MmggnzhJmL7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLr3hj4nHaqHaIRjSf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3LL3aI2IfjynCCu5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cn15F21dn89NwMjUjh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CniUKjRyvTYk6WBv9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CghlGU17ItoPIDGyn1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJVKIq4FzEOY3CJmfl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjGaO63WQ0GHxJJSk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMI1IP3AFxaLd0eVOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwrX304jrMjLIeAM5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3Mkiu9LkW3gl5KFc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAzVmk2t7tdRqXyzqk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeI5mjbpx6OYSJkrd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWMQeA3cuWTnRkxSKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBjDGy2vGTS1KryS56 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuSlgI15ZcagsYuCRh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiFQosvqoGjiz52G2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuQyJQ1xb6qBH5mv0g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8BMk54ff2CdTgLcB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRoARV3xDWYArG9vL1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CETFoW1N76CJjEjT9d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTeOjNzx0LGGuuKX9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CO7Hw14t1CywZ0yUwk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Czne8F2sr7nAi9C5D5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqqsZIhawJagd7XAa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIdqf72xgABNn2nYD1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcyrTu1f7iAFTnrVl5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrozhMW1WU9fALA72 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCvsjuhEYzjznKVi7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cvx5Qs2kADc9pywrK7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4wohC17dIkpiAbtv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM5Lx21gZyMpPtOOob 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM4rP44To5Keaj6Xbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiLI3a139hB8I8ntOf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4henr1eVw3EMMJQBa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzhrlT2CAXztbzeFmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CifFNK2knaMKUFXnH1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXMQFe5QDnd36lRki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8bErJ3q2mS9xxwSwc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDkOR54icnCqIB0tN8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJkGixVUU9nbF8rue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cb2zqa3PSKO9Zh9Ull 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQZ5a64bHSy6ZYaGoe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7yRPv4jexg8uI21ki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDTQan1SsGgBKte2ld 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLv8H3vjbMwHcVIJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cq817s1MTFzkHnmih 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CO4vvcBZfWsIRgFBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5cF4Q1gr9Sq1DIJw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2XXQN3HVBDKRX09Ui 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CM6mii17UPgzVUOOSb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1miNmjS2Lo1RG2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CStGtB4Si077kSmnP4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNJBsF4nhSDAXQ9An1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVDp5B1mDeUv2LkX22 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CD7fKL2uNfgd9JUnv3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCK6ws41WuM7BfinG3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CC0oNM20B5fEE2iDJd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cot7Du210ANamYj5Uf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8eIdf2rXg9IZJGZa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cz1Rx629LLmmyzvfF3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl9UtTOVQpbj8EQbe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1vTL64Gr0Nv7uAH23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cd4UghVP1yZSaJmh6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CegO0K37XS9XyGQ0p3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyMu0h12iZg1usDPM6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeiKu03BGkM33M6hde 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuXCbU2pPFsSsDgG3e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5R4aj3pNdq8ur7KJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CL8AQ43cVT3zg9mXVe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4CPZlyAhV7lzddu3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBbEFo2iNwrO3EmNn4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CU6agx2rD4wFNvYzF3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNf7VA2g9xKfDq3oic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWba3C3KcZdjT76YV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVukb93tlV2MQNu2R9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2kJEa2bWgLLSUMV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cc0EBI3i4Sg2p5V1B4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbHKU34s9H2DTlSin7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C79vGi3WgsbTVBMGYd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjpfZMPPll5f3aMO 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cy1NOD4AzXLyEkvF96 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgDsU32KkitFRq5lKl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcMyDA4phiU99YuPj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWYF7J1GZoiMLC6p09 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwzvDa1UBD9o0gY6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTJexFQEEX6Q6Y147 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuURcXPy9Yf3fffp3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C73nFd1kHhSg9H0we 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbJW752k4xO0AGgb86 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEQVKVBDKRxjES593 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBWXZk44HPgXMc89P2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8cd7s4s2BP6B2fJNi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClH5jbDR1LYIRXd71 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaICTV1ibR59BsqEjl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8SJ9k39WeDEkTYoO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtUWcL3TWvF8KhVem5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyloG21FfI5ZrMVFn2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C88UNG2NmUgRCRsNue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLVT864ykyCrW11LY4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3IHPG3oSm29zc3p3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cw2LWlnnRKp1pyz1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoZu1c1NzNQYFKmJKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEpktv1QzqZ01hu1Ll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COLt8K3RVsghUlwwlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPNrE51wE94CGcz2y2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrHjBv4IxQageHT2hf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CakBqG2eh8LpGPpMie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8OTyM3QLLANhzAhS1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChJeRQ1Fk8dImYddYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZKmJe3BZnVOLOScJg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ck0ZIns7FRqEDteY6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEAAeHq9NVabX7dsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRSG7beuuCV4Awie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMGTqYUKMiEPlDu1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7N6YdogWVuNPxt5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHmJal1SqsPRLYVucf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGV5WX3XamXfeCPIQ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Csdqbs4Gl2KXcYu4c3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrSLew3moViFbz1qm6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRWY5P1O5XpXWdV5w8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6t8vm2lI5YLsixcL 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSkk3F4465nT62JjM6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CySinR2Ukr7K255cYk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSmiWy2ijhhZYx51aj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5VCTW1d4Y04IFrmyd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJHfOa2essjP0bgKz2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgqUvZ1nEsLTpeM14h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNHO3k4NgRtiR9LGg4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvTDqyv0AzFZYhvYa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cwl5An2Zl1KmfDmeuh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrPiC82XSrQHnWbSX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEqAJrLp6vnKEWMSe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CU1iZ02xS6oIywBvre 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0xJcY2DtdXEexKa73 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqqMfq1eRUAlRBVTil 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChPlIQn7hT4ielqD4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPzlHT1W7t9ae9GYod 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8L93h4WLd8rzjnDk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUxHYs1Khzuo2rNPrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeAk8k1y2fNlUN41L9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNrfn43LSwXw9bRMT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzgGhXxDgtHrQx1Cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPCuNh4yfaVBf03vwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CujTOp1hfr9YtLUL77 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMfhB12Y3M2xmf2lUh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMSugk33CuYdOCnrj2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQU75q2w6MKlL7TOw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0jKCV1vJ5dNrFbKyj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGklVD3bA0Y144Jsd8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6HGJp3SJ9z8NWIWue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClFEx44Cxokti2M5a3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeUHgQ10eSfaPljB8i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtHB5M1FZqEMBsDqmc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3gaJq28J9Z0bJwkt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGaqMT2Bkznty4vuRj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9Kktu3h8egsI8bXul 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4bhw0253RfFe8QQgb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkzPML2sTaC8EpDQq1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTFVYg3F6kPgvvigZ3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7alhG18cdswwf49B9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnwiJo3C6bzuaTB2Ng 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQZvsX2MZK2MLgB8W 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6JDfkEbDcWUF325l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRo99W2oC6tPJyIqmb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cf8KoB2oIsPLUEaLTl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjsgRCNRaU0bXmXO6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C98t3N3vGfFxouiY5e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeJaoEsgZUUehqGXf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyWDN9mnZGMJ1saLe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvZPT62WfToKxceyEf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9pfbjOVDc6OP6iY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkO2bn2PlAVTlrXvra 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CgaS9u2aLx3wKaTlml 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C30LxW2Th1gjujVr22 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcEJR83FsF84gpOd99 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxSX2XRSWdjDgyNz6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWwkUh4P2SNipqOgL1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2ZaFAfQnfzGByPC7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxQLCs4niKD8U6Pz9i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxCf8J2esw472Ielw 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuaG7w1ufkC6A9gtFh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPba6z3CUAMjAVWIk5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CfYXN8RcLJE1ncGsf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtwsWy2janmDrrsrmi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CCBUYR130FjWz8Bg6d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSlCZo3oIlpqVFvL9i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuLqt91wSykza0MUr 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cr6BDA1u5j3a1jfbMf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CznkyN5OS360c7fzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cjlzzx3hDTXYwCCZfi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBlqmd40gboMM18XRj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4AeuTNzLiWRGK4Te 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cg39xa3V4NdPUzWJP9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdN9Ip3sqmcRtT6c06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvrdKi3MZkWWOHzZba 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsA0Ka1rED2oJVwNh9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoOuCA3ocam2A7NYCe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8ECoi1gSfd8MF51Vi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaRKSZ2vQuFygUO8mk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbH8HE1wAvU9RKMdOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaWQM53kzXuppddTD5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTGxwZ17I9IK4IPe7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZgDR43jpwQ9wjb3d4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsA5eg2ZCIorZpTdT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGIniW2GzJdP6AIbJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHDTTo3cs7h0VcRLyd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLPttK3P6NNlayture 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8XeSi2ysHv635JUMb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpApEnPgUSa06tsxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cln6984XP6WQL2a6jh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqEAVT1aXMorGMNSvb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cg2HHq2uL1cpzLEWOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUrs2G36GBmRYMAeUe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYJ0oW3tQfJQCAst1d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CN8aXr1Q63uhBnt3gi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwFpNj16f144BTWjI3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKUInZ3I9NXuVRJ0Gh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ClDE4n16xMQPvjODEf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CML1AY3hOt5zvH1TT8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX COlSNEF18pudbNONd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYE02G18YwMa6n39k9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CALuC816KX0SuRA93k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLgXhW3nduerCXCJZh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUuqeQ1jV5e1C0hRW1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ci8Hhb32NQGkzEhQxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiP0kcArU4JsR0Bg9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxrLmv46qzXI9L3Wad 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0CuYWAzapH9Y1N9h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDXH4xJCnyb5tOLii 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CykG4n3Dxwvrk8ST9e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CYbdBD1xNg67gOWIHe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPEstI3RgL6nRsJ8W5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGoDMnzCLhEMKVLrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVPyZY3yBTgzZRquV3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQghfc2KfUgjWFzIp 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHmtZi4dWdmwAF1le4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cr9A2y47TA7mm1zpt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnK96q4UmUem8G4KUi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVKsXw3ESdgONGrYyk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8Cz1kEKMFmaBpwFk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1Oihq3c0CnGxnsyb7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8e6AA3EEmfxrlaA76 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cn8XC64o03t3dm0UYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1gS9LiwgpfSE6c1b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CaQlwk3hIHyw5CbUT3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CANA543bVGTX8nPqc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDqrws3sJtHbatTcof 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CH9Ezw4lGM8yAvG9k9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Clj6pF1D7hB5fnMBg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3TNnl1P9wFMmMTNll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CoeZek83RtKuXfxN5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ci3UVZ1k3npfds09I3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CuMnFP3678h2jQ7ulh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CenkCO2hmdyEL8FPKg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY2fO53hF8GwkyHa12 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGJT3l1VgeuACrsEr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPt6WNG3WWvYoglu4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTNsnW3LZuKQ7ybUmj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtPqGp3ivrqkDfCHW9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDkrrE4xRnuwaOYzB1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9tgDs41wRFwrwMHDb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9VusU2DYszWdN5lv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CovX3L36kxML9jD8Ql 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CK3H7F2i2EFuRQmHr8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcAWbc4k7xJ4cwzFcj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDsfJ83mBfShtP3ra3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtA8cD3dbZbDyD3ggb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIMc7c3MIoZBJIrN8l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxfzyB3K82Ybv72ug7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4BrGE1jIIuMPtZJjk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChTknA2H7Dsub8YRxc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFMigc3cSgZsWMpKff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLt9861h4kL32m3j7f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZz5Al2VYRjHdflA8h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CI8Whj2h6r6LcSfVub 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cj7NVNNrbAqyXqUw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cy6tdt3KfDywtI7Ob2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrAxoy2GoejEATJvDh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CwaLTn4LXluo7UvqTf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZqwGT2kwjPGescsFe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFKxJC2R9cBSw9fpjf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cpso3f36rgNdVupv79 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CppBrMUywKphAbms5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkGInR1qK0eOnMHvkc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyGCzw47PTvCscGFQh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKRgKA35Bl8MptEZ98 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CidM6JqQOb2FHVtUi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ci9Qqo4Mqhkhd7qFZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHY8RiUHiFhKhES27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjBnuMqmiaV3z7i7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAZ39E4TQkxd0lBVNg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CLuA6a3JjPP1pqXDgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cx3A5Z1dvTDKH5xurg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ct5q9b3OYGNtBKVNSb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9WYFL3vuvOx7uhvxg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPMkCm4JEbNgyx5Ewd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cva7PE4j6kICfsMksa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPfswM1AJyRPS775mf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVLcgX1RZ13gUgyf5h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C42eDo2F7NJVIz04oa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CU2ANA1Yt4ObqJFRY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CX3IPy3pUxul2z02q6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcoTmD3IHZnRv6mtOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CGT6YF1SsJIs9T9lnf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cqlwx01oD12uO94Ib8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDLOMy2vjf76gI0rEb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1YUOM3kd8rSJQYu4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cu3NBQsaY2BAcBVN7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUSG2v16HRuh7yK0S8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJ0hRn2MsrZOv31smh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqGMy32Z8uKHOnELh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDWB1b1haIEHVS9sb3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRAZht1smUfIWWMRsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBWnVl4AhC2yViYHq6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7viQw259LpLw1bef1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CWeakb4xAgF95QleOe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cay5bn2vtLHX9KwOje 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5LNRFqO8x4l43CF4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIhkRr4eHA71oq6BC 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTggH82xFpM171oygh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CNtx0XvYoJ8ljgsj6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqKkoXjDIKqwN4xp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CN5oXL1vK53j2UehWc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CyVWZ63RmCoT7Jda67 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C4wshM3dMV4pJySvXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDROSq1z8LAIXNUmhk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcXZsf1GB9mlwwT7F6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChGADDsCZhKs9BcFe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C5pIAZq3OcXUdJVx 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVxCZu2vfyEgzJTSZ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChhFkQ36rFvb52Ye61 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CR6t1A3SZnlSLUonm7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHYPfS2TDpyiCxWKY 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpjaKw2UzL2pMQIdsa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CPiEgIQRKv8QZLRWf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CsMqt73dlmRROjwIUe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ca9ZmG4i82iE2d0YR3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxR52Y3GzT5T7QPGrj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0m7qm2cK3rhFZySFb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cq4vle2OoD0gt9mBd6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiEIqD3A03Z25mZpP1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcxfVg2FUarIYu7CT7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkftvZ2kq3sDL3Kco8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9nivj101nFcyZv5A5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CtefJ6ox2Y36z8fU2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJjRzu40yZQmdLa7af 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdEhA81a9gr5DFlDK8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpN0AM1QmlCca61py9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CEdPh92zmv83S2Nkl7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CN4lI43Zc9ELnQbdL9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3cZ3nRZ7QcfNlcA1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cfd5UC4SjyBeRgJLE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C22vJE3gkYDqoRi69f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cyv1Q53irT6Dh7AgHc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3UJgq2A2RTuKRgt23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CchdFNQuAo3IiP823 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY3Z1SRmzjBaIwPZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzZawy1pgVAgYUyYKi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3sEsF3VPXkvtnrzU4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CiRblW13ZKi1thxWQb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cu35wahBF5Imcilk8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cm12m71K09UdwP4REb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFwye24v2TzbFWF6h2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDWNQu2lmBr3AjHR5l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Chn0u74Z84C8gRRMk9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvBNEh2BX7uj2WBB4k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C2wkTtkbOqgitNpie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CqelPd3lByl65cwW0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CXXaK91JJmd6qlH3g2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeyA8eddGDVUGHUud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CDavIt2ice9TjDxiA3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkmozifGdEBYaNd2a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CRFhntGpfiLw8Pv0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1dZ433UvCCjRtEjzl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cw2cfZCugd0Q63rI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CK4u8R36tgECdnBZ04 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C6sJ4j3d8WLg8YnFO7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CofNlYPxkrXg6WnY1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CSMq1t4LlwsA7FZxzc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJXpd22FaR9f85tITj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnKf1OWDIpFR3yip4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjIFm71sV0Kam01oac 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcdNPj2qOnTcLkcNej 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CdMKxC2TJXnB2ycVhf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CKByou4dCuNE1OUoPe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAUTzU3lsdTflOr7Nj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C7Ur701fO8ULRsKar 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CeBTMV30QJxZRtURgj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cczxwh2v1MVpMCkWf3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CMgjaQencP0Pv3kqj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAcVss2KDF0ton5JIh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBHupf4ZYdpKEW6qc1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CVm1PF3PnRHFuJuSKk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CA9q8t4O0VUp7uhQWl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CcpP2rwrG9PfcdDki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZAGCb3Fu0tfU51eD2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C3b81P1uqoaf5M4IXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CFjfL12CkVQIBjKvb5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CIuGzw4zzngxgGtPed 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cf2Jq43a5S93qH7Cx7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CTMTvD2czD52f1cpS5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChIy11cKIY7wF59lb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CS6FIu9dD05jdClR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CnNZty15Hqn2xhgJGg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cn8vaY3NVNZcimP1K2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxBtUd3YCJxBhKCNV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CpBKFj1oWgquf8Jq5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQSFxVDVIk4IIuHV4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CZUtzG1SNOonX286De 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CbDLnv3P4wxNruySI8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ce2gy92a3Zdxn8U5Q 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CAmLMR3rs3nnp7BC7e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C9ni9syojCRMsSjzd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0B0K22KRamKeoqSz6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY5kdp51F3oeCijJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CJKWcFBAgZzVVtF03 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CY2VN44UarHiJwjbg6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CQxEWi1F3d6K4qjmb5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX ChX0Vn4uasaGJIe7Fg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CxO0Uf4uUDyFU7u9l4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CzY97244I3S03VcMdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cl1tlc2gLRTcw4Bcw7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CjhFfB1x1TpkFpuwN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CrGRrI1ZI7AGukEkUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CHkdVF40CArtrW2IMb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Ch7MMq0yqytJoNWpk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C8INLO2H6kVl0oKAEc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cax5UJ3dNqfI1V9N38 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CavCYn4sbKc30BxpQ7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Crf81W1wnKqCkmdQQk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CvGWHB3BSp1gpHFFKi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C0Q2If35e26kj6oqL4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CviTe74vjHLLx7AISe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX Cf0ZeH1gKEDckEkJV1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX C1hQrk1L844cx5tTNd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CBP3Hu4RKc79x58Y2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CUbAnm2k9C1iEtTmgd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - -XXXXXXXXXX.XXXXXX CkWokd3nscpygp5lIc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH - - 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNdne23ox8SQTgPoy3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeGt004UBsXLoZSeCg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTrywc2ra7tcWn2af 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzmEfj4RValNyLfT58 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCk2V03QgWwIurU3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgc67J2CpHIVN7HAw4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgwPkWkJfuBIJsNi4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CImWJ03GsvPvA0P67i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKJVAj1rNx0nolFFc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CD7vfu1qu4YJKe1nGi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWhRtK3eXodviHmbo7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqVUM4vyqCacqFiud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CudMuD3jKHCaCU5CE 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRJ9x54IaE7bkVEpad 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAvUKGaEgLlR4i6t2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ck78JG32Y4I7AGp7Vb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgwg7Z1MHA1YkiZmm3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDNchHwRoXhVzzHB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeP1sc28dOzbbYkbA 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COOKv01AQPAqfGMN9k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0JEpR1Ij6308CwEhh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQcXCjONUKqMfnhXb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVcd914ZFpaUisaVf2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5pL731XEkARXOq253 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CB0Ovs3cNZgLQ93FSh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM4z3Z2rdNfyHYQ0Df 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1dGa34JRiYAKbMI0c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtEfXf4f39NRDu1Dr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdY2UF17xGQ6lUx7e8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkD1144ZtRYffh5zjg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbI5Qt4rlFnOHuL522 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjGaD11BLkmCG5cEVf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdGkzc4fIBRo0721v 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1ejhC4SXsZ4pEdOd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CisPKv3PhjrFFhZbq7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCgIHR2Vna1ZW9BPjd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWqViP2k4EKfYWy7Y1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBr8Cp4juBTcRQZAA4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWMTYT1vZEQXErCXY7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9Mb033HGlhETKxUbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGwfOa4GYyzNItzc9j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4C8Lr4DOGUTRZPAW8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfQutTEgs3g8sUrsa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKvlqe4bTVu5HNGrb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C04EG53Yaw6dgjGT3k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdzNo91LLZlfe0pmT8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cb2Rv3Wek35VDwxDk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsLUyBLEs5x3GKtgk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CF00uX66iWHtiV1q1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkVqlMyWLZSpdNcPa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6Frs83UqNszgcqN15 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQCAYJ2zCov16vZwf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cil9Tc1rwfQS9uqdsb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgHhMv2Ww0Y4oQNtd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFTS591Wnlb7gnrpP7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoVJDI3K3qTiTnPoV9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChHNpz2Xf9xMo2lnC4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch5tsG3OlOd7l83JFc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3AXaL2up5k3PR4VW4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2qZRm2yQg9RoQNkVg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6tA8aOk3QI9oIaHl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CggxJkLPcdPyKjfma 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CI5pddk2aeicnmmoj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKpb612OxJundLAeRf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcwXC81REVUrKprLz 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5OBjqCVHlPAjKQXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cb7w0T1dHZUPXzdgRi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cuhrwt2ypWdmhxNcjb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJmTVn4YcEf19Wo137 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COvnS21VmREmS5Xzuf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpKJJiDUPEBNMGSC 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5II0Z3yZFhDzHSKrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQ7b0y4Vd4NVQ3nJRi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C68HZHafWQbOYWkYi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CX9xXW3s3cSCaIB9a2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUTgljebkkh2Ydhzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsnMLaDyNeIqxq6i2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuIjKg2hEOBmXsIvx4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1alUz23K74AR4WZUc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9ywcdnOP5TLfD97e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7aJ8S1bYoBzPdxRDb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTISqXQMVxGJCVG2i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjsoT83JnYI2Be2f8j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CohWkh4QvZcB1WXOVe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CL7JR54e4lOc3aUAph 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CS9xQJ3Jly032E9jC2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPOg0SZxpoHbNzpG5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgYh1L1mwsOxSqVBu9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPEPje2CwXXxGGPo27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIWOQa2vaf6TxyZ2Jg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqyxRG6TRKYW41Zz5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3HR3r12iwKiqXa9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C823dt2fd3qQ26XyU 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CalQkN3MoYim6AEEe4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzZuKd2XEy2jlcWqT6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVgpXQ1plHZSjZoGq9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPnPwW1vseaFvOVKZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cr5ot64fYu8c0wBtik 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CceZRf3q969iOibom4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cfv1oI1ypkphPOMD7g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkgPZ03tcwpxYjnOSc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeYlkM3WxZVUmujyB9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8yjkq23bmUk9MkLf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CevQX3116xo72LIoK9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChN5cQ1faCW2xBl8Ki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjTrQkID6Z2SNK3ha 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CA4o9G1CB2Af4WWhCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cf8FAq4I77xaBMSVT9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPjxvb4XleEtywR72 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7XVqL2qUJ1enNZYag 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjqWgiHlaYFi9YImg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1uJul2gbxeDRNFura 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbIFhV2t1dFcA47mxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAy1xs4SqOffMYYoi6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3sUxYJbMLLrlkY2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cz7T4t4CVp8k2htbIk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cqn0E64YUKHGEJtXE9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwkPvf43XtOGn09xUb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQKymemsGWxk8qNhi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4DpKm2ihMjo33xAK9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cx1J5T2RlUHdnWX4P7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cq5Tn24Flxl5ykcPB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBMc5Bq8xeq3TqHyl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwalhH1EmkTCp6Z5oj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoBPIr1bmfwOHYS8k7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CauDdy1kS45qWx7Jaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeivHI16nJNE1XoDn8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cwks1t1XCX1VVKWlui 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COzc1t4726TvteJAq9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CySyNg2Q7X5Wig9qXc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdHHGD21PDk8qHCNZi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CytmUVLD1AW7Bjdda 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyAz9V2XDShWvc9X85 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9mSwv1EoAGeQwdxia 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSqd0W3t872JJDPQR7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBdUFS64H8SD3CRc7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXmENaHXj6AAZ6z67 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHxNzE4i1HGC9aNQb8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCOssQ1lVW9L4luov7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CH4Zqaz7LIoXnVdx6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmYN6N1hsT2MgdKQo9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkH9U915OzOOjvkSJi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCwJVWbbaSCkRe2K9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRGnRy2aYiKuVFnIG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3JRhD4EKTLL9ETgB6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTy7qulV8eG6LkeUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUN1fq1Nh9yg0qjEZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cy1IPuLzKTRb2fGF8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2sbOw4qh4NrDdHRH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsTLYp3UVyKHvvF8jl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COJL3m2IFflzZ1Cvdk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAR8U13yNQoRQJZLcd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYXkGL3OwfyucBURVl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfyyuF35s6IHIKaPy1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6lrWz3udBitB6moKf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJBk991FDSqc8wRBK1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeoHSa1uBAQlDI3FEe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnB5fj2ShUFnGngqf8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C850go2IsfiAcSGCfc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRM6Kv2JvySZyj1qrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChDijs42aziwiDYP4c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiZMlr41UYw4zUSiH7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Car6PO34Q2yGqFhtw8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwUICHbZAZuWABr9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLvoof1o65FluhXQI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C45NxP1qI6S5UMi6Ta 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C73cNq1ss4gZpfV8Jj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWnddL27sIwroPwU4h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwP7As3BK8V5lwj7D8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaEkUY1AI0qcJSl8Cd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBkOwg2KK7rXFXUTmd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0u03i3hv4B4fSd7zg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CITjhO2n7PZKsy3Mw4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ci0XPI2JfTjInNGHJ7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvRIiA3mohju9nTku6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUAWQS1YtxjDhtxxte 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgcc4N2eKsv3m3nA87 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWT4zv7sNwj1cnBeb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CylDMs45x5z5lRx9se 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CT4t8k1zeBe7ZRUBg5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQHUiY2AW9ZT2iB0x8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZvB3g1drtq6h6KP8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBeoy737B8VrP0iSS6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cs4vHa2laJaNpjym2a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYwHEGkAUO1v9YGk8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzcPSa4HIZVpmSAZQ1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmVWUQ1Zj8v9tk8Tn9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cyyy781JVg92X5mDUc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMU7t24bL4QMZtMO2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Czv7tI2Aq1yfgdryG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CR7XxA2W5vLwE5KTs 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmDpIN2aFGjiOMOJWe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5p9eh4XiSATtqsZi5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVLeLf3d954JlCj5Ch 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUeKfb4nbjydJsNdId 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cekrs3zkM6eSou1mg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUVPVWOtpPH13Hfck 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfhuF84Ji7AdXxsAA6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgfSWCkLmMlaKMWUl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRYwli4VJ5IlPTDWIl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CguHTc3ErOLWFoQyBa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpDj0c1fnKaDIGyqma 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CF5tR03Af5y0DJD2he 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbaJQC9l9K3ELB1u1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9xsW63PP2wB8hiDUk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzWoyC1HE4FO1zdT3a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyVhox28QHRlYRbY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C57jQA4eBlGbOkJ0xc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CimLTH3Vi2F5nxs6Bf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COlS4I3p8lZG3vxBag 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch4OGK13MCwxE2a1O9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzTeK32euJBRHTY2z5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CA1qPq3zXlCZGMTF3d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClzajT3YA0FYcHeIsi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoW1ycpevZQjU9uK 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4mAqd3q1os6WQrFGi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoLfC03bP9cbW0s7Cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDZen84XixQL22chD7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEUdRVRpBWnzWSuJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COUblG2yCsr6J0Z8k3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtAsd2ykOOaUv0sel 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8iXoIHQrMuYvFD7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEZ4zB1w0bcdFufPv5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHwfwB4tWYNdiXgqj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpXYCp3HhrY4ziK5w6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cu3mx7WQp10fiKvVd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJK73d2tv5bceelJs1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiBJbd1e77zhCc8o92 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrDDne3jAfXkyEZLZh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrtbM81EwribjjBbs6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CinzyU2OZ3RzfO3iQb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdMDAn1K65PDClegO2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CL72Eb6pZzrrF1MPc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTH9yVeqRZ7hCysmc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7dQb6wN8PS99nDpc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7zVw01Vz6Gp5SUxgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChrOVe26x8jzyNa2uf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNSAUE2BML8biNfBQ 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNJ4Xn4VtXlynW3J3a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChGNUG3biEoPUuqOa6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXw2CyoyLEXO1cDi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjvpgV6kqW0852q3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxUw172WrEAdzXMRL7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeRlLB2HA8cgJm1oe9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkQkiC4YuLauG6WZEa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfgLCv4QFww6gvQ87j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8jLEg3BRmkSv2OTHd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGCF331JLuHl54L5rd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWBzQU3jlmCFJxIvW7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuQnVY1S26nokuHtw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDLpxA3tPGVgwxSem 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqWOXg3fwJ6pVRPP41 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CH9f4S31R76ubzMqXl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7NKKJ363Po1sp1G76 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Coa3vE2Wqxw7XtPyaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPbwgd4HAWmMrjHmBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cg3va11ZQR3RERyK2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CX1G5j2XAjJVbgRRYg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1BbhC2e0BR83RHPhe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBMwL219aumFxhrnzd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ce8sjQ1yXYbarn3Mv 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C78sjv46n0JEJJ9Ixa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2z8sX3Zt54zcv7nHb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrmZ753z4MFkzJPjfk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmZgh34NMetxae8Pm8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtsyPdY3mkmf7kLb4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ct0FdeHeoqV11oqi3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHpfPUBDLI48ElQX6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6QeBz4zMAkwfJKzp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvZvjb1h22zExFA9Z5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQnxI03CHdqwafO4o2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CV85Bg1jB95m3NCt2b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cpa0UQ2794FcjpykQh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9U9nP2cjbHpr2TZZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIkXHw1k27sxdK1IL3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6sQTZ3batj1lRDpFf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrLzH72bC4Py0O0Pw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwByX11akVrJXiAL89 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMrmZC4fwKKms3eVfe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIMbgg4rrK1rYO007 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl92e44KbzduaHbhyg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5yYvFfVOJPVQqJWb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaIW4B1CNbhrY3Z9P5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuFyuJ3RcaoYD2YSlb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkeuvB3U6Z48hwsmd7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmZ5913VmiwYcCMsV9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4iWMr1o5OhwPrp8sc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeVw7f1PrVOGyux7f8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cv7Ojs44cHurW5mca 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CG1IZO2kmbIytfrjF 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFo4ijFpPMOaVkxyc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6aRsb3UekWRpglS77 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFOKe2YkWP7etA8pi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C37mAJ2U5Kisle0Qgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgjcpf4p7v2QzNmLSf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CH7oxC2LFgxSRkfdi8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaQ3deHsj3TrWL6J 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHfOyV1EmktPdJYs1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAP1W92itot6anqOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C42zWs36ET4H6JkMAf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChCctc1RXXIqfN02T2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMIGG63blVyQrgtKZc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cm5hUStLXU9qmc9oi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CST4021EoQxELJXa23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEUV1F4e4X7KZmIQjg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMXu7r17v95iIWljHb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cf2iT43rdptpnlRFaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKee4U3Z4oY4yRz57c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyyAsI1bENRZJHsPxi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFfE5G2444nCYFZKB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3qdoZ1n9Z9JKjUDzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8F0wsJvnG24pWYob 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeHfJV2oKMDd0Y5Q7i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnDV6B3aFu2Rig5pDc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAYs6PGpPpvE5HD45 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnYoeO12NNlpv8vJw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7qhx8MH4aXtRLCz5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmqlEJhGZCyPSVeVg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C30S013blQYUkUFuKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfUaZj2hvTwscPvXpa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CI8nPFXkU5AYE84Ei 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtnR3q3r0iCKvV7N7b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKjWKd4Mq2FDzB7lNa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsmwQW1n5WCKtRZWOa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CisUSAKIZdFFX8lWh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeyYdH2Qfmpzbjsr2h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0i55oDRpoYXbScq 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cog8rV2Ws6Hv7UCGta 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CW524A4Jvs7LV4nSi2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZImj8vHpyMzhT9Xh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZ7qJ91KzEqUNJwu96 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cz0TOI3Oz84uu7WmSc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpkFh021CJKOiZXyPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cggyq72pcsVl1twmKc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkjjDD4mVrHaOHrTpb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl2Pp43hVt8yeVkbI9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXahDdeDuBzEqAb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTecLV1manIXTrjAIe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsLyVu1YU7im0wl04e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLYYbS2z9Ou3vNkkZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cpj9DeO0yZuq6Ute 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cc8BePGbhxSxkHHjf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwYtAfMvzk9Fod7cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUfWl31hYnv6Wwvt1j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C89fm75JmUuUqVjL2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CR8db31SCvKcWQu7se 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZ5SE92qMLKBRvXPTg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CextRf3AOZqeA1XkZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTPOjD2rPLS9mqWtI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cx2fdd4vASV4hGNamk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxO4Hl2za3S1dI7BF1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbTCX64fnBOz5Rnss5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7fmrSMRs5eEbiXEj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cfoam51KJQvseaC6O4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1Cfql1xwhiHqaEiGk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcKAdX2Q0thi02ReMe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CR4uj7veM5o7mhLT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM36EW1l3dYeFyEps8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6RIBPCLUqy7QrkG7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Czd0jk2Saz3xxLJsU3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6IvVK1opBeZQ7AQ7a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUDpIg3BIilKU95Loh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYSUaV17LYTkbrEVpa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnSEAH1VZnpGoxnDPb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNJWdr1axp5uTe7O79 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cd0PwY1sOnxvxlpOUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3plZ01VSnQwnkq1Ce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CF0xAHahJVVCD5Fi4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTPJGE4d84dfLkqXCb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVuUh142e1YgH4Ofll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLMQOF35kFy3YN5Xx8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuMT6LYNk1J990vRk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1Almd46wwAwBRkkE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cx2o7z1ve2pwRELwm2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7ORHD2Ge1bznHOYxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1hBHK2Ako3EciFj8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAKOnF2dhpD2lIpMW5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsVB753IMy3ksnCXJc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnPxgy4t7wZRlJlXic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUgy2o3FvSC7r4Z9ya 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cxd0L53LzmLx1GQL3i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdERFK2TuqeY6bOLIk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7gYx43YuJLYHaolL 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQ02Hh28fM99vbB7t8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZ6vmo2iQaPNxh2Cp5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkOZDv22AxQ2YWa9d9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C913kM1HJAW0Z0QCWc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKgKAx20fbelsVSjj3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRhBnt2F6fTBWyjylj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Css94F2wp6eqs3AG2g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5Iwq42ShwCJuekrR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiThk046sKXUN21yT7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIKTEw1hGfX8fLggpl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cuqf1SXU2lRMru8ab 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CViQRu2F6CP81AHxN7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClxNef4rXFifWlnVe5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ce9ZL977eCsGAEVwh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcsJ6S3KeIOnq32dUf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNeOYwF6hHL1iYy7a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtIalz3JApUL6lBk5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiGbMU1lOEKc8ZcnJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZ7cfF1ZmnbEKFCL86 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtwugB8dqTukJE53l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzuDds1p0W3c1OxtQa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8icM720Rm3KFNSaO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBqI3A3aZ9wbTqAHKc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDI2sycOSZMfUwDej 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdPmeZ2wefP1W2pDaf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ctqz3r2Q6Hhh45ynBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZ3VMr9TGKr4pDG49 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9L1P41WGLblqJ5lX9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjpsNzwm6pkRPysTl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXKlOW2OXCLUH0tag2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaX41W2rQe7myStGic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwL1AP20TmhyPubBzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGsgYT2M54ThS9dD1i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ct7NPa2Gjw99Ds55Fa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmYrUP1Jii5rRzA2N4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfAQDb3ztIZ9Esdhnb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6gNhw2NFYJKnnBJAb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLrESm1lxkihbOfujc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGxlGu1ohd5JBhXb3l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTCzwn49MMq762o5wl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLvYvUL9THPcxwH09 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CordDM2ka874SoTG4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6SzT4NIAosKk51Ne 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzpRvg1ZARpYbvKZLd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRJfqUBQrh1OECRKh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUD9vt2xm6AFEFb9te 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGTvIE10hTfMDqvRg8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1USEM2mkGmssUQFnc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuwWUn1WWhrDuebDLg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cn0jH9tRvniY1wOdi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3JTJw4PGH9c3y1zOk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpvOTy47aAhFPLLhy2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBZ93D1F4V32UnHVuc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CU5NwdnJySKzDO6Ia 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxseO02jluUsidcJ62 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUxHC03hhHZPPZPPd7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4F8Mc19wr3znjj7ec 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCa0k62q3tTbsgMjD6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgPOxw4ZcDNtb4qUGb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cr2WN61qD7lqnpZNrd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmcxqC1uCPLsuEWiwh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAYq3UzQvLCe76Zc3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyO8GYetxJ83COadh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cn4Im3oIZPuXCwbBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGvCUk133LGTDCu1j1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpXlZE1JfmFmO9ezNe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CereAezpP5CfTQdme 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8ldQR1zcqOsEUFCO8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvZeCEJYay1Ly86ce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTUAHv3hD1FX8aHrlc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4Badl1Yn0KV5EiZI4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZTcLz2NmHcn4ZD5cc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6VgL03HYoBgYkYcwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBekaf1GPCZTu5hfEb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CorcCoU4w4ta7bXdb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIBpBT20L8Wr5vMz6e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiFKHS3FlSxbhZirR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyeHfv5JsaGfR6Q9h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiCUSr4CVHoG6yVoce 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4gVAPgEpkdEDZxR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpkdiS3JOJCsLKSJh5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CF9ZRQ3YWkwyOaZtZ3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVtLls2idlUP7gvVfa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0iDve2iVKhr0DZq4j 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEpMvc44Y9buZQW9R 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSznMg1xj0hV5nntTd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRMyfvgvdHPOGXlY5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKVSkGTNGUHtVkSih 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPSiwK2DMpE2jH6Vyh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Coz5244kxG3F2Uwsp1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4ZIj1N89EJ4eXGG 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQnl3dyMoPF8TrJKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBEXHD3r3x6EhHlQak 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4qlRm371SZUAlFHTe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COUK6C40KLFuCC2Bnj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5aYAD4Cn2Ubc3Lhgc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHBOAd3sRJs4TZG5rk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1KXFY1d00OW56NOug 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaqiRv1kssCwKFiAEi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2ImrtGJ5Was24kO5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkIEMY2v5zXcCRAK06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9nK7T2OW1zdBcXRr 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyNYn63xqRCtJ0Swci 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuxhD94HGUTuDMCPeh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CztBgE4sLwXhmXQ1V7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtBp2AhjFqcG9qhq5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIVadw3MmsEwKSXoRc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsJlJw3gPwZPfiVGdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXe01x1FHRzA4kaake 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY25m12Au0LbTQ7ajh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cz9mVbJ3mLhtk3Vda 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBGwJBRTFD8aLOKJc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkSzRz17ol01kBjlNf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZLdPO2kd9vZKOmwTh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEmAHt4Xvq0HLd9W82 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3838x22eO0vcv6Mgb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpltvGXeH3DLAPPT4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3Z4pJiqtIGHawj0g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChL9vB4VvykErujpb4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ca5orO1gBdPoGkIAGe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcwdAP1q3qj9kGbD64 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGoZfnZAUfEApqP12 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CULfbN3hEwMuuClQlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5CCVa2TESFWWp4h2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbEhxC3seucNFjJzl7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNkqdY1uFJUpLHcIfd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJ5lKt1FBnPOLExVJi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7tQLt4nj8nmymJNBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNndLX2qcoBO1T5h3i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl6URq30CgLqZmHbdl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQrWXaeiNsamnLxJe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUUubM1kNFUIoAtRDi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cdm9Cl2oExwyIrTygf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnKdXm4Tf4ML9ukOYh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C66i3N2Qa1eqAyN8N8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoXkaI3nBcggoQSFO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRJy7L2YDZXsYxDhC3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl2pecmmIw1GjkVJb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHWRw82poLxopSRDzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnflkX1d2USQ4QeAK8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C16ibw2KpRbXYrd0Yl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFiVSW1o9EVx5N4Jb6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbGXIX2xTZKRuIZwCj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCvExA2GM22zrnZkZi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CV5jTHZXiRRacOOud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClpAsC4U0tWM3Z6Gz1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGToTMGh5q3VrJjni 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfEaWC21ew1UaBmeLa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoNHfb4cDZSJh2h1l2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAu0Oo4x3iftOu5dF4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoysEl2JglWGPKCEF8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfPVQm1k7F6Fd9dXi8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXEAGK24uAf1EMpLV4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cga10I1NjMZq5YSNWd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CABy0s1rpWlZ6X6tW5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFIQPc4ShJClVxKPr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIYmfgVlNE7B6N4ec 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ctu1Eu1GyUwEttbbRb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUBLiE4H0lDoOyqIr3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdoKkT2Ke5De7MWN6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkibYw4PuXuckQflIh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9HQs14k8DJZQaqRmd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ct2bcYZHIODrba6hg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgUlJjlqbB9Kzozkj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CI6Avt2cWWdmpsQnb9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUn1iH2S48i4Heqnzh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7CXmL3ysk9qbtIpVl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1Zh983vVGDE8rpT2b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwhQVj4Sr6YxoNBRek 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CC1mwWtpL7QIsnIu 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqQ3mZ3WK7Dpj8ebI1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cuoe3c3Hv3XA5H3auc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNm68aOVy0Yxl7tHg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CecHQz1SmJzVmrjLc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7FoyE15oylgO2D0vh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdjqSs1yLtNe7Xiylk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaQnjV3UHc2hg5HvJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPqeCK3u65w4FShPC2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJIWFo1ifuQFC3myBb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpIBX42j0JTDLqNky9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrDPHt2myMadMHRtGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChUf2j8A2cckuCB9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CodUX14FayPV287Dka 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpYISz2x0t1IB0QTDf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9aPOm1XvemsGRM5n2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwA7AO3h7M0tClfk14 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5OuLn1RyWY1Cbhc24 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTrEfQ2OTZ6XwuqzF6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CB7oN32GMSHJRH46Q9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cts2Bw3UyYSC8eJbw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COVKbVuLViTpKix0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtcBaG9xFLC4GY3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEukfh1EN6VBqvS5V5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwK86z3GfLlLdBtjf7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgKGYB4pW3vOfMBV 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMn4xD3x1CpYubrX2f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY9Su7UUQHd3QxCU7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChWyT7DaScEmURW7i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHCWma4mS3ppsLP48e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLDNHl1Z4OK0sDBoif 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM2JMA3ZfXFcSbIVb1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLe3ci30E20BAchq3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfgmfA4jTr8Y6eLJHg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CW4Csw229iMW5e0Rlk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeoYqm4Iisj3ozpq92 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cbr3ZX2RpOAHKjmCff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COwrPBGIpzPLJeW68 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNsMUUGQHroPHA8Ci 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C426X13okmzS5nezed 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ctvhwu1lrpdV6DZdwb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6b9XS2XeGtwYY87xk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYCYdh13mKTqx1ydmg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzzvQk2VG9RA5JUFa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3qPT62UwGnCqVIHe3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsBdJ51j1nLK3tl2F3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGF4CK3UKYLwIPRwyl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CS9Igm4X2rCHxh8EI2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZVWmQN2v8aUbBLrl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiWSbfVPxd3DU1Tkl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CN8vYE2x91ejKzzsD1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWfGo22Wn4dNhEMG06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQwX581RWAcdloUaCl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcHqZF4mAmTipPOItj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDbHurHHYzQh16a75 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeOJdl3twOYDJJ71De 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CB2C6x1g0GQKuoDeTj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrynIf4rhiaSYubZmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgpa8U1xzUsAFVfqac 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLSa0ZadTj6WeeEu5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnxPqm1SEHF2WwWUG4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXhpq14dW9SZTBfHJ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCgTLd2teo52h0Wstf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeFdYqfRlkaD4rak9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9mchV3W5GidlSM84 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMErzU3stNQPLKaMU9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0I0Rx1ymjsyaZC0jh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiKVFD1jyEZMI1gXIb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cdnacw1CFnnqrlU3O4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPStWmXe4km0Cl0ol 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJRkQA3jOwlmlfcqU1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeEFRd4qMWwv0Jh8k7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQ9bIuaEcQxsRROo5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C284OX195pTFFffz36 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNGTy6cxx7ybLF9W9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7q4oH2DTPedalIPWe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChBuyc19gI9J1KGmY 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqDFty3SRyrnf90hfi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cggwuf3G2K5ZN4oakd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM7VSScmo8RxJVRq4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CouMIolaAAuU3uBsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEAWkJ28DI9nEKRfOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLYTyf2HBOn3UVjHO1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CO6Ebe3kdaK8oiVzs 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGTZtF4cqefNQf85xi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch03izqlxvJxYGLH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9I5rZ3zk42R1XANoc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaU2kGXngY73q9ukb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTm5e81lzI1LnBExS 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxmPyngR6MzIa1Eh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbFrYB4DZH8tDkL0Y 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMXdX44qcXXU2h79Z3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEFFYl4SiGIgQVBwlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch7jT14FYeXA4zibfh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJGat7FcGiecvRUsg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNatvs4kRF4PKwSQa6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2NBCp3jV77cmR5Zt8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6WtsQczYdAqti8rf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUhe5I3aTm7jZot2n3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNFZJ71R8kIIoPNIk5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcUcWO2v7gHgNp7Q62 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cb3KX21dAVvTruW5u5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ck2Rvb2bOsJDxQIHh2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDI95K1GQpHhlE1WO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkQ1G62jdm35jCXtlh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPVwfY3kLDmu8VeKdi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXOtEWMw2dl3XsTGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C96Nem3M5LAE4wmxq8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch4s3N255T98eOAbg7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRfKrw2WpPG0f6YNab 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkvEuA3A1e1PDP6u9l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJGA6LrfAhefNKwZg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxAT1S1sipPu2RSOK5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CR9GIt1uVcCEzQmX0d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CG0N5A4T0LUzvnAdr9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfXYNY2Gtu2mOvJMAb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqUr0V2Ejojsue0UB2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvrWt84lulkHNvYqk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGb1NjWtOcccF7wwj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CilF4d1b6woayAE906 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8j5rU2S8wOqxY7Xzf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuUrLB3Xprhr47zsPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpIcgv424hVeESIlv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgVp8E3o8WDS25ZEah 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaN1s3SLGBQ4aYcp4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLIxGjgqmKhRAW0A6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBcpca4v5bAbAgFPnk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cx0S392Jm2GGs57Vqh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0rM4y1xCN8gaJlx65 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWTYeZLvhVCqQ0Oii 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHdNJ23h8TGauylVzi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmlD1G1PBWF7V3AqC4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxD8fj1FHwuZnvlIDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpXPjc2FWuGLYIHrq7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXStoPw0l608HE7Wa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CppWZ13XXmGNWo1sa5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsOsbJtpfytT4Zwmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAp5VrBkO3ZBZDw7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdArbn3VkPQ2LQ6IZk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFQWWm3dCGqvIQuOIf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cuf8Te1rhfkUe3Ps39 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXQYhQ1U3eH1eCHbO1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLd7E94pRH1IAYvYYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXSjf889bs6zGkd1l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmudKn4wcczZ81CgS 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7cysk1k80rr0XAVGc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeAngf2WowKEx9bxt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COlxFa21bPstCyqFbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFLsus24dYUFU43gT4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COPxfr3aAGe1RkBpY5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkChJz10kLSqA8jzMh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZLWOymP9apVN0cS1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClpiTi38HDCVH757G8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cc6Ywj2npKqeQWf0Xj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CURyWM3JQc50i4uAy4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPlAAd1glpWofm9c48 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cs22AT1iDlXjpnEh23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CX9APc3bZVpG3EOoJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cu5n8i1eR1Uq7cpNp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQZgXn37WW1G2MlGkd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfSvmp2TftQyAmW5Zi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjVLso4czHP84pCpIe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4SV4k38RC1OUl5bJg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLODqD4BvYLZkLD46e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYrTQs2MBgNd1gdB54 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEePRr28Y2Y1Mk7fol 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cp9nfP3Ll0DU202fD5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CB1p8vzDu27Xh8mjb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1cf2A1IEXB6OWP7g8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNH2dH2ojKinxj8Znl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSw824rvuPrp6U7lb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSLQtD1VcMg50oXYij 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtS0rHoMhL7UNXlk9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpNVijnE2lWwqFUTd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjsNda3kT7BMmn79r5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgYgjg4uU6EPRMKrHe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGv6GGMohalagEtfh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSW3Ia4wgHVN2LR2x6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIocUB2QmNtAt98Raa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cc4qTzr0Vrfu3VYJ8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbTdzs3jEHRNU2hFC6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnxLUi2KiCwChGAqX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQWG8r2dfrbg8LUlua 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CngLM039cnn4Mvt3Df 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPchod2Y4uAM4sSS9c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFTJ5k1BeIJn84TMH3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyZqmk3JlFJTzRoIM4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvI2Po42hxTw7EWx0d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUNPU92OvaTuTi9Mn6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCljqz1dhNjSOwPtt2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQxarQ3Old0ATLJU34 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cw0Nu83mpEDdLy8MC6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChnNNF3g5zHZRnTnB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuuVrm28b4g38DwYsc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMXwF2rCJiIRPl6jd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cvez3u2SD3arHlyAhb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ca4smwv5Bm87TV2Tl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPm8hfqbQLr7uupN8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpkkHm4vwb3YqzXCZf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfjnpA16loSFIdknW6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cps5Az3rXyb1nHevh1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXmQLh4nwA2enaBMqg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cw3UIy3L6yJtxXSNa2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZKPJ624uO7F4s4uH8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqPUf01ahHtGb1RWvf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0KvlV3xhBAS0TjIDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyMvF62XUvVdRK9MI8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGOfGiDKJQjG94tMd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwA19D3CGPf5cw6el7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTR9yW1pU9hdggZRuk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChvW5E4jKCLmJGFNg5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjJLKQ1Tjc2vp8BG8a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsXjRw16FavgTXwrbf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUCes41sQHFSrH1ZEe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CH3IYJ2c8Jen6r8iV8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClE3yWP7k1x6qEyPl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDMnmw29INxxeNQYE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNncBmG60jrMYE6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8eX4r3Cp2UPufTe1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cgt8oPuPHbri1sDsf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0tU0J3qBSNPZvvCs2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8KI9R1ifxBOWmcYbk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Chmysb4fi1r6OFHDDj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0QO6i301914TaOGJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1ORxn3XJz6yGFeo1g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C16xpV1tjLQ8icxRRe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEMDMT1e4PPAuvjdM8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIUQGp3FrmzWVrNbWi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmQYii6kvBaNTuNVk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C75hcC2LEEqHPcTGQg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgOLAF3SB0Iuo1RoGb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdThD72YLnxl0tAhx9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7pyIc1SjyxmZqpP2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CG40jK2kO1NXwdRjlf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFT5QX2NGkWvDoS73b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Culfcf32j5G4hy5STj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbyYXp3OuxgvSs1rnd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CX4BSWvxCOPQSsoz8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJU0ts38Nm9alT7qOa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CmNRTy2A3u7dm89xd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0iw8dgSzn6Lt2l87 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaRZ9m4zUs222cMaf6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyNxcw4xw2VLy5xqM9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdRhWT3WJiNJd6yI4d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCZZib3Y9pjgYtJW2f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2lPJTbmBFDRGZltf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBNXBD24hjefp0LZkj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbnyaU2sWQc9hrOFsg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrSfRNn9Y6TpKSYwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfcTNZ3VzQGbNyOYm1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnrF0h45yKF5cL7XQ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ccw4T01sNMI4v5qGs3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxZjbb1da9hcaT6Bt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C840ag3wJtif3z9DV 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoXTPA2KVYz9zNYlib 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C92XxR3BCHdnrMocM5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cvjzja4a0xIU8nOkg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cadfsn2NN5nFfCVO97 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CT2pLJkKDfRbdDUWk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgQAlXJSKaQ8YnvPg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQLrXR3icdsWYVPKg2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZxRwdVLWuciheCb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C90m229PgBu1jrrF5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4Evyd2E8m6d4Xhqsi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ctt4oD26CzPAWcJQCl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAVH4i4ZVYN0WDoo27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGiOCL3c4KjdZuXuff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Chc8Fa457qFmtuEYY8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKMhv2oB2z1eyRX6d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSHS0H1H0rjxicgcAg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJuvoE1YyLGhjELqf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMdhHL152FlWWz9vr1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJfYiM1E2zyHG1NoGk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDvkJz2zlMjW4EqRb9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUozuC4RUktVWsM4C1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4LIRIHQPjU6UiSOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkW4Mh33uCHmIm9Hdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTjtV749YvoXcl8Nd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFEIoY1dUsibWoByJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgBkDF4bRECntkASrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWSdwH3KEQ3oqHyRAe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRwYxf2x9mIXyPwkJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6IE5b4s4Qoqk5pgni 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxyBM33gWvfqTVKzb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CogwD74Lz7PMpUif8i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C93l5e4yKVetWUxmIb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWKen9tbdg32AFm98 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeCoMC2Dl66C9enIj2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQnCV1iF8YjETdeQf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYmjX01wozt3Bngyne 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvDeSJECATHoiOMig 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcfaGF3WOUkVaqaPs2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4yqWO3VAbIxES2rH2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CugL4P2LP2PttPSKNj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCWbyI1qxx4x5p9JCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Caiz9z3pIV3Vw8bLA2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLlaSu3305zpdumq64 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgUrgP2EUQhnVU0mhh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFS3FG2WRxrhm1dYj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cu46pf3vovzIOnRuGj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cg6txW3WQysgx9vIN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWV1P3151cMujgYXRk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2cQQGuP8RfmlD1yg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7HQwd40e8TI0qTbCf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwddlB7WvzDnYFgOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEDuC91bJvWJYKl6d7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbmmXy37yurxWpeoib 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtooJF4JHtk2Dew0Vl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbCZuG4MmggnzhJmL7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLr3hj4nHaqHaIRjSf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3LL3aI2IfjynCCu5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cn15F21dn89NwMjUjh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CniUKjRyvTYk6WBv9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CghlGU17ItoPIDGyn1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJVKIq4FzEOY3CJmfl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjGaO63WQ0GHxJJSk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMI1IP3AFxaLd0eVOh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwrX304jrMjLIeAM5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3Mkiu9LkW3gl5KFc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAzVmk2t7tdRqXyzqk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeI5mjbpx6OYSJkrd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWMQeA3cuWTnRkxSKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBjDGy2vGTS1KryS56 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuSlgI15ZcagsYuCRh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiFQosvqoGjiz52G2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuQyJQ1xb6qBH5mv0g 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8BMk54ff2CdTgLcB4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRoARV3xDWYArG9vL1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CETFoW1N76CJjEjT9d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTeOjNzx0LGGuuKX9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CO7Hw14t1CywZ0yUwk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Czne8F2sr7nAi9C5D5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqqsZIhawJagd7XAa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIdqf72xgABNn2nYD1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcyrTu1f7iAFTnrVl5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrozhMW1WU9fALA72 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCvsjuhEYzjznKVi7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cvx5Qs2kADc9pywrK7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4wohC17dIkpiAbtv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM5Lx21gZyMpPtOOob 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM4rP44To5Keaj6Xbj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiLI3a139hB8I8ntOf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4henr1eVw3EMMJQBa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzhrlT2CAXztbzeFmk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CifFNK2knaMKUFXnH1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXMQFe5QDnd36lRki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8bErJ3q2mS9xxwSwc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDkOR54icnCqIB0tN8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJkGixVUU9nbF8rue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cb2zqa3PSKO9Zh9Ull 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQZ5a64bHSy6ZYaGoe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7yRPv4jexg8uI21ki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDTQan1SsGgBKte2ld 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLv8H3vjbMwHcVIJ5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cq817s1MTFzkHnmih 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CO4vvcBZfWsIRgFBl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5cF4Q1gr9Sq1DIJw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2XXQN3HVBDKRX09Ui 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CM6mii17UPgzVUOOSb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1miNmjS2Lo1RG2l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CStGtB4Si077kSmnP4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNJBsF4nhSDAXQ9An1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVDp5B1mDeUv2LkX22 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CD7fKL2uNfgd9JUnv3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCK6ws41WuM7BfinG3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CC0oNM20B5fEE2iDJd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cot7Du210ANamYj5Uf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8eIdf2rXg9IZJGZa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cz1Rx629LLmmyzvfF3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl9UtTOVQpbj8EQbe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1vTL64Gr0Nv7uAH23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cd4UghVP1yZSaJmh6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CegO0K37XS9XyGQ0p3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyMu0h12iZg1usDPM6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeiKu03BGkM33M6hde 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuXCbU2pPFsSsDgG3e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5R4aj3pNdq8ur7KJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CL8AQ43cVT3zg9mXVe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4CPZlyAhV7lzddu3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBbEFo2iNwrO3EmNn4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CU6agx2rD4wFNvYzF3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNf7VA2g9xKfDq3oic 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWba3C3KcZdjT76YV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVukb93tlV2MQNu2R9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2kJEa2bWgLLSUMV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cc0EBI3i4Sg2p5V1B4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbHKU34s9H2DTlSin7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C79vGi3WgsbTVBMGYd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjpfZMPPll5f3aMO 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cy1NOD4AzXLyEkvF96 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgDsU32KkitFRq5lKl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcMyDA4phiU99YuPj9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWYF7J1GZoiMLC6p09 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwzvDa1UBD9o0gY6l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTJexFQEEX6Q6Y147 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuURcXPy9Yf3fffp3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C73nFd1kHhSg9H0we 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbJW752k4xO0AGgb86 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEQVKVBDKRxjES593 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBWXZk44HPgXMc89P2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8cd7s4s2BP6B2fJNi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClH5jbDR1LYIRXd71 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaICTV1ibR59BsqEjl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8SJ9k39WeDEkTYoO3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtUWcL3TWvF8KhVem5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyloG21FfI5ZrMVFn2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C88UNG2NmUgRCRsNue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLVT864ykyCrW11LY4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3IHPG3oSm29zc3p3f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cw2LWlnnRKp1pyz1c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoZu1c1NzNQYFKmJKb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEpktv1QzqZ01hu1Ll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COLt8K3RVsghUlwwlj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPNrE51wE94CGcz2y2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrHjBv4IxQageHT2hf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CakBqG2eh8LpGPpMie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8OTyM3QLLANhzAhS1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChJeRQ1Fk8dImYddYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZKmJe3BZnVOLOScJg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ck0ZIns7FRqEDteY6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEAAeHq9NVabX7dsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRSG7beuuCV4Awie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMGTqYUKMiEPlDu1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7N6YdogWVuNPxt5c 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHmJal1SqsPRLYVucf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGV5WX3XamXfeCPIQ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Csdqbs4Gl2KXcYu4c3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrSLew3moViFbz1qm6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRWY5P1O5XpXWdV5w8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6t8vm2lI5YLsixcL 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSkk3F4465nT62JjM6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CySinR2Ukr7K255cYk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSmiWy2ijhhZYx51aj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5VCTW1d4Y04IFrmyd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJHfOa2essjP0bgKz2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgqUvZ1nEsLTpeM14h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNHO3k4NgRtiR9LGg4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvTDqyv0AzFZYhvYa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cwl5An2Zl1KmfDmeuh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrPiC82XSrQHnWbSX8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEqAJrLp6vnKEWMSe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CU1iZ02xS6oIywBvre 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0xJcY2DtdXEexKa73 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqqMfq1eRUAlRBVTil 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChPlIQn7hT4ielqD4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPzlHT1W7t9ae9GYod 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8L93h4WLd8rzjnDk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUxHYs1Khzuo2rNPrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeAk8k1y2fNlUN41L9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNrfn43LSwXw9bRMT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzgGhXxDgtHrQx1Cb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPCuNh4yfaVBf03vwe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CujTOp1hfr9YtLUL77 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMfhB12Y3M2xmf2lUh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMSugk33CuYdOCnrj2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQU75q2w6MKlL7TOw9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0jKCV1vJ5dNrFbKyj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGklVD3bA0Y144Jsd8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6HGJp3SJ9z8NWIWue 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClFEx44Cxokti2M5a3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeUHgQ10eSfaPljB8i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtHB5M1FZqEMBsDqmc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3gaJq28J9Z0bJwkt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGaqMT2Bkznty4vuRj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9Kktu3h8egsI8bXul 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4bhw0253RfFe8QQgb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkzPML2sTaC8EpDQq1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTFVYg3F6kPgvvigZ3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7alhG18cdswwf49B9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnwiJo3C6bzuaTB2Ng 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQZvsX2MZK2MLgB8W 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6JDfkEbDcWUF325l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRo99W2oC6tPJyIqmb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cf8KoB2oIsPLUEaLTl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjsgRCNRaU0bXmXO6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C98t3N3vGfFxouiY5e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeJaoEsgZUUehqGXf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyWDN9mnZGMJ1saLe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvZPT62WfToKxceyEf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9pfbjOVDc6OP6iY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkO2bn2PlAVTlrXvra 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CgaS9u2aLx3wKaTlml 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C30LxW2Th1gjujVr22 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcEJR83FsF84gpOd99 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxSX2XRSWdjDgyNz6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWwkUh4P2SNipqOgL1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2ZaFAfQnfzGByPC7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxQLCs4niKD8U6Pz9i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxCf8J2esw472Ielw 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuaG7w1ufkC6A9gtFh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPba6z3CUAMjAVWIk5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CfYXN8RcLJE1ncGsf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtwsWy2janmDrrsrmi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CCBUYR130FjWz8Bg6d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSlCZo3oIlpqVFvL9i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuLqt91wSykza0MUr 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cr6BDA1u5j3a1jfbMf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CznkyN5OS360c7fzg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cjlzzx3hDTXYwCCZfi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBlqmd40gboMM18XRj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4AeuTNzLiWRGK4Te 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cg39xa3V4NdPUzWJP9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdN9Ip3sqmcRtT6c06 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvrdKi3MZkWWOHzZba 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsA0Ka1rED2oJVwNh9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoOuCA3ocam2A7NYCe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8ECoi1gSfd8MF51Vi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaRKSZ2vQuFygUO8mk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbH8HE1wAvU9RKMdOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaWQM53kzXuppddTD5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTGxwZ17I9IK4IPe7d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZgDR43jpwQ9wjb3d4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsA5eg2ZCIorZpTdT2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGIniW2GzJdP6AIbJl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHDTTo3cs7h0VcRLyd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLPttK3P6NNlayture 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8XeSi2ysHv635JUMb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpApEnPgUSa06tsxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cln6984XP6WQL2a6jh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqEAVT1aXMorGMNSvb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cg2HHq2uL1cpzLEWOj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUrs2G36GBmRYMAeUe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYJ0oW3tQfJQCAst1d 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CN8aXr1Q63uhBnt3gi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwFpNj16f144BTWjI3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKUInZ3I9NXuVRJ0Gh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ClDE4n16xMQPvjODEf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CML1AY3hOt5zvH1TT8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX COlSNEF18pudbNONd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYE02G18YwMa6n39k9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CALuC816KX0SuRA93k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLgXhW3nduerCXCJZh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUuqeQ1jV5e1C0hRW1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ci8Hhb32NQGkzEhQxb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiP0kcArU4JsR0Bg9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxrLmv46qzXI9L3Wad 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0CuYWAzapH9Y1N9h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDXH4xJCnyb5tOLii 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CykG4n3Dxwvrk8ST9e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CYbdBD1xNg67gOWIHe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPEstI3RgL6nRsJ8W5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGoDMnzCLhEMKVLrc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVPyZY3yBTgzZRquV3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQghfc2KfUgjWFzIp 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHmtZi4dWdmwAF1le4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cr9A2y47TA7mm1zpt4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnK96q4UmUem8G4KUi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVKsXw3ESdgONGrYyk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8Cz1kEKMFmaBpwFk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1Oihq3c0CnGxnsyb7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8e6AA3EEmfxrlaA76 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cn8XC64o03t3dm0UYe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1gS9LiwgpfSE6c1b 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CaQlwk3hIHyw5CbUT3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CANA543bVGTX8nPqc4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDqrws3sJtHbatTcof 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CH9Ezw4lGM8yAvG9k9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Clj6pF1D7hB5fnMBg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3TNnl1P9wFMmMTNll 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CoeZek83RtKuXfxN5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ci3UVZ1k3npfds09I3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CuMnFP3678h2jQ7ulh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CenkCO2hmdyEL8FPKg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY2fO53hF8GwkyHa12 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGJT3l1VgeuACrsEr4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPt6WNG3WWvYoglu4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTNsnW3LZuKQ7ybUmj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtPqGp3ivrqkDfCHW9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDkrrE4xRnuwaOYzB1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9tgDs41wRFwrwMHDb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9VusU2DYszWdN5lv2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CovX3L36kxML9jD8Ql 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CK3H7F2i2EFuRQmHr8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcAWbc4k7xJ4cwzFcj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDsfJ83mBfShtP3ra3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtA8cD3dbZbDyD3ggb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIMc7c3MIoZBJIrN8l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxfzyB3K82Ybv72ug7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4BrGE1jIIuMPtZJjk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChTknA2H7Dsub8YRxc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFMigc3cSgZsWMpKff 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLt9861h4kL32m3j7f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZz5Al2VYRjHdflA8h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CI8Whj2h6r6LcSfVub 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cj7NVNNrbAqyXqUw5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cy6tdt3KfDywtI7Ob2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrAxoy2GoejEATJvDh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CwaLTn4LXluo7UvqTf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZqwGT2kwjPGescsFe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFKxJC2R9cBSw9fpjf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cpso3f36rgNdVupv79 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CppBrMUywKphAbms5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkGInR1qK0eOnMHvkc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyGCzw47PTvCscGFQh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKRgKA35Bl8MptEZ98 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CidM6JqQOb2FHVtUi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ci9Qqo4Mqhkhd7qFZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHY8RiUHiFhKhES27 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjBnuMqmiaV3z7i7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAZ39E4TQkxd0lBVNg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CLuA6a3JjPP1pqXDgl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cx3A5Z1dvTDKH5xurg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ct5q9b3OYGNtBKVNSb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9WYFL3vuvOx7uhvxg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPMkCm4JEbNgyx5Ewd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cva7PE4j6kICfsMksa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPfswM1AJyRPS775mf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVLcgX1RZ13gUgyf5h 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C42eDo2F7NJVIz04oa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CU2ANA1Yt4ObqJFRY9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CX3IPy3pUxul2z02q6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcoTmD3IHZnRv6mtOi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CGT6YF1SsJIs9T9lnf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cqlwx01oD12uO94Ib8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDLOMy2vjf76gI0rEb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1YUOM3kd8rSJQYu4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cu3NBQsaY2BAcBVN7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUSG2v16HRuh7yK0S8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJ0hRn2MsrZOv31smh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqGMy32Z8uKHOnELh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDWB1b1haIEHVS9sb3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRAZht1smUfIWWMRsl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBWnVl4AhC2yViYHq6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7viQw259LpLw1bef1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CWeakb4xAgF95QleOe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cay5bn2vtLHX9KwOje 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5LNRFqO8x4l43CF4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIhkRr4eHA71oq6BC 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTggH82xFpM171oygh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CNtx0XvYoJ8ljgsj6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqKkoXjDIKqwN4xp8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CN5oXL1vK53j2UehWc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CyVWZ63RmCoT7Jda67 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C4wshM3dMV4pJySvXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDROSq1z8LAIXNUmhk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcXZsf1GB9mlwwT7F6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChGADDsCZhKs9BcFe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C5pIAZq3OcXUdJVx 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVxCZu2vfyEgzJTSZ4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChhFkQ36rFvb52Ye61 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CR6t1A3SZnlSLUonm7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHYPfS2TDpyiCxWKY 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpjaKw2UzL2pMQIdsa 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CPiEgIQRKv8QZLRWf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CsMqt73dlmRROjwIUe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ca9ZmG4i82iE2d0YR3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxR52Y3GzT5T7QPGrj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0m7qm2cK3rhFZySFb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cq4vle2OoD0gt9mBd6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiEIqD3A03Z25mZpP1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcxfVg2FUarIYu7CT7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkftvZ2kq3sDL3Kco8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9nivj101nFcyZv5A5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CtefJ6ox2Y36z8fU2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJjRzu40yZQmdLa7af 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdEhA81a9gr5DFlDK8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpN0AM1QmlCca61py9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CEdPh92zmv83S2Nkl7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CN4lI43Zc9ELnQbdL9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3cZ3nRZ7QcfNlcA1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cfd5UC4SjyBeRgJLE5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C22vJE3gkYDqoRi69f 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cyv1Q53irT6Dh7AgHc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3UJgq2A2RTuKRgt23 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CchdFNQuAo3IiP823 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY3Z1SRmzjBaIwPZb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzZawy1pgVAgYUyYKi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3sEsF3VPXkvtnrzU4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CiRblW13ZKi1thxWQb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cu35wahBF5Imcilk8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cm12m71K09UdwP4REb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFwye24v2TzbFWF6h2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDWNQu2lmBr3AjHR5l 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Chn0u74Z84C8gRRMk9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvBNEh2BX7uj2WBB4k 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C2wkTtkbOqgitNpie 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CqelPd3lByl65cwW0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CXXaK91JJmd6qlH3g2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeyA8eddGDVUGHUud 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CDavIt2ice9TjDxiA3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkmozifGdEBYaNd2a 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CRFhntGpfiLw8Pv0i 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1dZ433UvCCjRtEjzl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cw2cfZCugd0Q63rI6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CK4u8R36tgECdnBZ04 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C6sJ4j3d8WLg8YnFO7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CofNlYPxkrXg6WnY1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CSMq1t4LlwsA7FZxzc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJXpd22FaR9f85tITj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnKf1OWDIpFR3yip4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjIFm71sV0Kam01oac 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcdNPj2qOnTcLkcNej 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CdMKxC2TJXnB2ycVhf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CKByou4dCuNE1OUoPe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAUTzU3lsdTflOr7Nj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C7Ur701fO8ULRsKar 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CeBTMV30QJxZRtURgj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cczxwh2v1MVpMCkWf3 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CMgjaQencP0Pv3kqj 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAcVss2KDF0ton5JIh 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBHupf4ZYdpKEW6qc1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CVm1PF3PnRHFuJuSKk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CA9q8t4O0VUp7uhQWl 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CcpP2rwrG9PfcdDki 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZAGCb3Fu0tfU51eD2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C3b81P1uqoaf5M4IXi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CFjfL12CkVQIBjKvb5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CIuGzw4zzngxgGtPed 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cf2Jq43a5S93qH7Cx7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CTMTvD2czD52f1cpS5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChIy11cKIY7wF59lb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CS6FIu9dD05jdClR8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CnNZty15Hqn2xhgJGg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cn8vaY3NVNZcimP1K2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxBtUd3YCJxBhKCNV6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CpBKFj1oWgquf8Jq5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQSFxVDVIk4IIuHV4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CZUtzG1SNOonX286De 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CbDLnv3P4wxNruySI8 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ce2gy92a3Zdxn8U5Q 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CAmLMR3rs3nnp7BC7e 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C9ni9syojCRMsSjzd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0B0K22KRamKeoqSz6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY5kdp51F3oeCijJ9 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CJKWcFBAgZzVVtF03 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CY2VN44UarHiJwjbg6 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CQxEWi1F3d6K4qjmb5 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX ChX0Vn4uasaGJIe7Fg 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CxO0Uf4uUDyFU7u9l4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CzY97244I3S03VcMdf 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cl1tlc2gLRTcw4Bcw7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CjhFfB1x1TpkFpuwN 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CrGRrI1ZI7AGukEkUd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CHkdVF40CArtrW2IMb 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Ch7MMq0yqytJoNWpk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C8INLO2H6kVl0oKAEc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cax5UJ3dNqfI1V9N38 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CavCYn4sbKc30BxpQ7 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Crf81W1wnKqCkmdQQk 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CvGWHB3BSp1gpHFFKi 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C0Q2If35e26kj6oqL4 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CviTe74vjHLLx7AISe 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX Cf0ZeH1gKEDckEkJV1 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX C1hQrk1L844cx5tTNd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CBP3Hu4RKc79x58Y2 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CUbAnm2k9C1iEtTmgd 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - +XXXXXXXXXX.XXXXXX CkWokd3nscpygp5lIc 128.3.140.132 2035 194.140.136.34 80 tcp - - - - OTH F F 0 R 1 40 0 0 - - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-post-large.log b/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-post-large.log index d762b0082b..3acc3f2a2a 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-post-large.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-post-large.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents speculative_service #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 37526 127.0.0.1 80 tcp http 0.008395 61907 60478 SF - - 0 ShADadfF 10 62435 9 60954 - http -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 60644 127.0.0.1 5000 tcp http 0.015853 61917 60478 SF - - 0 ShADadfF 10 62445 9 60954 - http +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 37526 127.0.0.1 80 tcp http 0.008395 61907 60478 SF T T 0 ShADadfF 10 62435 9 60954 - http +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 60644 127.0.0.1 5000 tcp http 0.015853 61917 60478 SF T T 0 ShADadfF 10 62445 9 60954 - http #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-wiki.log b/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-wiki.log index 2ca65734dd..8abd541713 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-wiki.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.speculative-service/conn-wiki.log @@ -7,38 +7,38 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents speculative_service #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 73 0 0 - - -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp dns - - - S0 - - 0 D 1 199 0 0 - - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.50 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 179 0 0 - - -XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF - - 0 Dd 1 66 1 117 - - -XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF - - 0 Dd 1 80 1 127 - - -XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF - - 0 Dd 1 66 1 211 - - -XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF - - 0 Dd 1 66 1 117 - - -XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF - - 0 Dd 1 80 1 127 - - -XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF - - 0 Dd 1 66 1 211 - - -XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF - - 0 Dd 1 66 1 117 - - -XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF - - 0 Dd 1 80 1 127 - - -XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF - - 0 Dd 1 66 1 211 - - -XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF - - 0 Dd 1 66 1 117 - - -XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF - - 0 Dd 1 80 1 127 - - -XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF - - 0 Dd 1 66 1 211 - - -XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF - - 0 Dd 1 64 1 159 - - -XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF - - 0 Dd 1 64 1 226 - - -XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.44 5353 224.0.0.251 5353 udp dns - - - S0 - - 0 D 1 85 0 0 - - -XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 137 141.142.220.255 137 udp dns 2.613017 350 0 S0 - - 0 D 7 546 0 0 - - -XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp dns 0.100096 66 0 S0 - - 0 D 2 162 0 0 - - -XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.226 55131 224.0.0.252 5355 udp dns 0.100021 66 0 S0 - - 0 D 2 122 0 0 - - -XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp dns 0.099801 66 0 S0 - - 0 D 2 162 0 0 - - -XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 141.142.220.226 55671 224.0.0.252 5355 udp dns 0.099849 66 0 S0 - - 0 D 2 122 0 0 - - -XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 141.142.220.238 56641 141.142.220.255 137 udp dns - - - S0 - - 0 D 1 78 0 0 - - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH - - 0 DdA 2 567 1 402 - - -XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 - - 0 ShADad 4 750 3 576 - - -XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 - - 0 ShADad 6 1491 4 949 - - -XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 - - 0 ShADad 6 1445 4 950 - - -XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 - - 0 ShADad 6 1450 4 950 - - -XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 - - 0 ShADad 6 1457 4 949 - - -XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 - - 0 ShADad 6 1468 4 950 - - -XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 - - 0 ShADad 6 1498 4 950 - - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 - - 0 ShADad 4 741 3 396 - - -XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH - - 0 ^h 0 0 1 48 - - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.202 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 73 0 0 - - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h fe80::217:f2ff:fed7:cf65 5353 ff02::fb 5353 udp dns - - - S0 T F 0 D 1 199 0 0 - - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.50 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 179 0 0 - - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 141.142.220.118 43927 141.142.2.2 53 udp dns 0.000435 38 89 SF F F 0 Dd 1 66 1 117 - - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 141.142.220.118 37676 141.142.2.2 53 udp dns 0.000420 52 99 SF F F 0 Dd 1 80 1 127 - - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 141.142.220.118 40526 141.142.2.2 53 udp dns 0.000392 38 183 SF F F 0 Dd 1 66 1 211 - - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 141.142.220.118 32902 141.142.2.2 53 udp dns 0.000317 38 89 SF F F 0 Dd 1 66 1 117 - - +XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 141.142.220.118 59816 141.142.2.2 53 udp dns 0.000343 52 99 SF F F 0 Dd 1 80 1 127 - - +XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 141.142.220.118 59714 141.142.2.2 53 udp dns 0.000375 38 183 SF F F 0 Dd 1 66 1 211 - - +XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 141.142.220.118 58206 141.142.2.2 53 udp dns 0.000339 38 89 SF F F 0 Dd 1 66 1 117 - - +XXXXXXXXXX.XXXXXX CNnMIj2QSd84NKf7U3 141.142.220.118 38911 141.142.2.2 53 udp dns 0.000335 52 99 SF F F 0 Dd 1 80 1 127 - - +XXXXXXXXXX.XXXXXX C7fIlMZDuRiqjpYbb 141.142.220.118 59746 141.142.2.2 53 udp dns 0.000421 38 183 SF F F 0 Dd 1 66 1 211 - - +XXXXXXXXXX.XXXXXX CpmdRlaUoJLN3uIRa 141.142.220.118 45000 141.142.2.2 53 udp dns 0.000384 38 89 SF F F 0 Dd 1 66 1 117 - - +XXXXXXXXXX.XXXXXX C1Xkzz2MaGtLrc1Tla 141.142.220.118 48479 141.142.2.2 53 udp dns 0.000317 52 99 SF F F 0 Dd 1 80 1 127 - - +XXXXXXXXXX.XXXXXX CqlVyW1YwZ15RhTBc4 141.142.220.118 48128 141.142.2.2 53 udp dns 0.000423 38 183 SF F F 0 Dd 1 66 1 211 - - +XXXXXXXXXX.XXXXXX CBA8792iHmnhPLksKa 141.142.220.118 56056 141.142.2.2 53 udp dns 0.000402 36 131 SF F F 0 Dd 1 64 1 159 - - +XXXXXXXXXX.XXXXXX CGLPPc35OzDQij1XX8 141.142.220.118 55092 141.142.2.2 53 udp dns 0.000374 36 198 SF F F 0 Dd 1 64 1 226 - - +XXXXXXXXXX.XXXXXX Cipfzj1BEnhejw8cGf 141.142.220.44 5353 224.0.0.251 5353 udp dns - - - S0 F F 0 D 1 85 0 0 - - +XXXXXXXXXX.XXXXXX CV5WJ42jPYbNW9JNWf 141.142.220.226 137 141.142.220.255 137 udp dns 2.613017 350 0 S0 F F 0 D 7 546 0 0 - - +XXXXXXXXXX.XXXXXX CPhDKt12KQPUVbQz06 fe80::3074:17d5:2052:c324 65373 ff02::1:3 5355 udp dns 0.100096 66 0 S0 T F 0 D 2 162 0 0 - - +XXXXXXXXXX.XXXXXX CAnFrb2Cvxr5T7quOc 141.142.220.226 55131 224.0.0.252 5355 udp dns 0.100021 66 0 S0 F F 0 D 2 122 0 0 - - +XXXXXXXXXX.XXXXXX C8rquZ3DjgNW06JGLl fe80::3074:17d5:2052:c324 54213 ff02::1:3 5355 udp dns 0.099801 66 0 S0 T F 0 D 2 162 0 0 - - +XXXXXXXXXX.XXXXXX CzrZOtXqhwwndQva3 141.142.220.226 55671 224.0.0.252 5355 udp dns 0.099849 66 0 S0 F F 0 D 2 122 0 0 - - +XXXXXXXXXX.XXXXXX CaGCc13FffXe6RkQl9 141.142.220.238 56641 141.142.220.255 137 udp dns - - - S0 F F 0 D 1 78 0 0 - - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 141.142.220.118 35634 208.80.152.2 80 tcp - 0.061329 463 350 OTH F F 0 DdA 2 567 1 402 - - +XXXXXXXXXX.XXXXXX CiyBAq1bBLNaTiTAc 141.142.220.118 35642 208.80.152.2 80 tcp http 0.120041 534 412 S1 F F 0 ShADad 4 750 3 576 - - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 141.142.220.118 49996 208.80.152.3 80 tcp http 0.218501 1171 733 S1 F F 0 ShADad 6 1491 4 949 - - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 141.142.220.118 49997 208.80.152.3 80 tcp http 0.219720 1125 734 S1 F F 0 ShADad 6 1445 4 950 - - +XXXXXXXXXX.XXXXXX Ck51lg1bScffFj34Ri 141.142.220.118 49998 208.80.152.3 80 tcp http 0.215893 1130 734 S1 F F 0 ShADad 6 1450 4 950 - - +XXXXXXXXXX.XXXXXX CykQaM33ztNt0csB9a 141.142.220.118 49999 208.80.152.3 80 tcp http 0.220961 1137 733 S1 F F 0 ShADad 6 1457 4 949 - - +XXXXXXXXXX.XXXXXX CtxTCR2Yer0FR1tIBg 141.142.220.118 50000 208.80.152.3 80 tcp http 0.229603 1148 734 S1 F F 0 ShADad 6 1468 4 950 - - +XXXXXXXXXX.XXXXXX CLNN1k2QMum1aexUK7 141.142.220.118 50001 208.80.152.3 80 tcp http 0.227284 1178 734 S1 F F 0 ShADad 6 1498 4 950 - - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 141.142.220.118 48649 208.80.152.118 80 tcp http 0.119905 525 232 S1 F F 0 ShADad 4 741 3 396 - - +XXXXXXXXXX.XXXXXX CFSwNi4CNGxcuffo49 141.142.220.235 6705 173.192.163.128 80 tcp - - - - OTH F F 0 ^h 0 0 1 48 - - #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.protocols.conn.vlan-logging/conn.log b/testing/btest/Baseline/scripts.policy.protocols.conn.vlan-logging/conn.log index bda3fcc0fd..4757ebaf2e 100644 --- a/testing/btest/Baseline/scripts.policy.protocols.conn.vlan-logging/conn.log +++ b/testing/btest/Baseline/scripts.policy.protocols.conn.vlan-logging/conn.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents vlan inner_vlan #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] int int -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.19.51.37 47808 172.19.51.63 47808 udp - 0.000100 36 0 S0 - - 0 D 2 92 0 0 - 13 10 -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 193.1.186.60 9875 224.2.127.254 9875 udp - 0.000139 552 0 S0 - - 0 D 2 608 0 0 - 13 10 +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 172.19.51.37 47808 172.19.51.63 47808 udp - 0.000100 36 0 S0 T T 0 D 2 92 0 0 - 13 10 +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 193.1.186.60 9875 224.2.127.254 9875 udp - 0.000139 552 0 S0 F F 0 D 2 608 0 0 - 13 10 #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/signatures.eval-condition/conn.log b/testing/btest/Baseline/signatures.eval-condition/conn.log index 7dbb75ee25..ac496789c1 100644 --- a/testing/btest/Baseline/signatures.eval-condition/conn.log +++ b/testing/btest/Baseline/signatures.eval-condition/conn.log @@ -7,9 +7,9 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] -XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF - - 0 ShAdfFa 4 216 4 562 - -XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF - - 0 ShAdfFa 4 216 4 297 - -XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF - - 0 ShADaFf 5 614 3 164 - -XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF - - 0 ShADaFf 5 349 3 164 - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.235 50003 199.233.217.249 21 tcp ftp,blah 38.055625 180 3146 SF - - 0 ShAdDfFa 38 2164 25 4458 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 141.142.220.235 37604 199.233.217.249 56666 tcp ftp-data 0.112432 0 342 SF F F 0 ShAdfFa 4 216 4 562 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 141.142.220.235 59378 199.233.217.249 56667 tcp ftp-data 0.111218 0 77 SF F F 0 ShAdfFa 4 216 4 297 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 199.233.217.249 61920 141.142.220.235 33582 tcp ftp-data 0.056211 342 0 SF F F 0 ShADaFf 5 614 3 164 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 199.233.217.249 61918 141.142.220.235 37835 tcp ftp-data 0.056005 77 0 SF F F 0 ShADaFf 5 349 3 164 - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 141.142.220.235 50003 199.233.217.249 21 tcp ftp,blah 38.055625 180 3146 SF F F 0 ShAdDfFa 38 2164 25 4458 - #close XXXX-XX-XX-XX-XX-XX